Privilege escalation via semctl sequence wrap race

Race condition in semctl(2) in FreeBSD before 14.4-RELEASE-p8, 15.0-RELEASE-p12, and 15.1-RELEASE-p2 allows local users to write kernel memory. GETALL and SETALL snapshot the semaphore count, drop the set lock to allocate an array, and then rely on a sequence-number recheck that wraps after 0x8000 create and destroy cycles, so a recreated set with a different semaphore count can drive a copy past the allocated buffer. Exploitation requires local code execution and a winning create and destroy race on the same semaphore index; the resulting kernel heap out-of-bounds read or write can support privilege escalation or a crash.