untrusted comment: verify with openbsd-79-base.pub
RWTSdNN9A3yvWEbhKuOn6FPlXi5baX7/1cIM6U7McbaaeA7vrAsXspd7EprYzyQFLjY07pOHJ9TMvF4K6BLWdrO7coFm67V9KAE=

OpenBSD 7.9 errata 044, November 5, 2026:

With unveil(2), an obscure filesystem use could lock the kernel.

Apply by doing:
    signify -Vep /etc/signify/openbsd-79-base.pub -x 044_unveil.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/kern/kern_unveil.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_unveil.c,v
diff -u -p -u -r1.57 kern_unveil.c
--- sys/kern/kern_unveil.c	11 Apr 2026 17:04:55 -0000	1.57
+++ sys/kern/kern_unveil.c	4 Nov 2026 09:11:31 -0000
@@ -647,6 +647,7 @@ unveil_check_final(struct proc *p, struc
 	struct process *pr = p->p_p;
 	struct unveil *uv = NULL, *nuv;
 	struct unvname *tname = NULL;
+	size_t nvisited = 0;
 
 	if (ni->ni_pledge == PLEDGE_UNVEIL || pr->ps_uvpaths == NULL)
 		return (0);
@@ -754,6 +755,8 @@ done:
 	 * access is allowed or not.
 	 */
 	for (uv = ni->ni_unveil_match; uv != NULL; uv = nuv) {
+		if (nvisited++ >= pr->ps_uvvcount)
+			break;
 		if (unveil_flagmatch(ni, uv->uv_flags)) {
 			DPRINTF("unveil: %s(%d): matched \"%s\" underneath/at "
 			    "vnode %p\n", pr->ps_comm, pr->ps_pid,