Integer overflow in the aio_suspend function in Sun Solaris 8 through 10 and OpenSolaris when 32-bit mode is enabled allows local users to cause a denial of service (panic) via a large integer value in the second argument (aka nent argument).