Local privilege escalation via oversized exec argument copy

Kernel buffer overflow in FreeBSD 13.5, 14.3, 14.4, and 15.0 allows local users to obtain superuser privileges via execve(2). The exec_args_adjust_args function in sys/kern/kern_exec.c adds consume instead of subtracting it when sizing memmove, so a long shebang-script argv[0] copies beyond one exec_map argument buffer into the next. Exploitation requires an unprivileged local account and a race against another exec; a demonstrated default-install chain corrupts sshd-session environment data to load attacker-controlled code as root.