The Coda filesystem kernel module as used in NetBSD and FreeBSD when Coda is loaded and Venus is running with /coda mounted allows local users to read sensitive heap memory via a large out_size value in a ViceIoctl struct to a Coda ioctl which triggers a buffer over-read.