Race condition in the Doors subsystem in the kernel in Sun Solaris 8 through 10 and OpenSolaris before snv_94 allows local users to cause a denial of service (process hang) or possibly bypass file permissions or gain kernel-context privileges via vectors involving the time at which control is transferred from a caller to a door server.