Local privilege escalation via MPU range overflow

Integer overflow in Zephyr RTOS 3.7.0 through 4.4.0 allows local users to read or write protected memory via crafted syscall buffers. arch_buffer_validate() rounds a buffer extent without safely handling 32-bit addition overflow, so a wrapped range skips every MPU-region probe and retains its access-permitted return value. Exploitation requires an Xtensa build with CONFIG_XTENSA_MPU and CONFIG_USERSPACE plus an unprivileged user thread; successful reads disclose protected memory, while writes corrupt it and enable privilege escalation or a kernel crash.