untrusted comment: verify with openbsd-78-base.pub
RWS3/nvFmk4SWQTJDIiHvFqrqii/HCgyWduC8eo7qHcrQ7uTDdKuwC6bXzRuClQARYw51jYhyNHVsim2OxMzTGNv+5pW6bdttgQ=

OpenBSD 7.8 errata 054, September 14, 2026:

Prevent integer overflow in shmat(4).

Apply by doing:
    signify -Vep /etc/signify/openbsd-78-base.pub -x 054_shmat.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/uvm/uvm_aobj.c
===================================================================
RCS file: /cvs/src/sys/uvm/uvm_aobj.c,v
diff -u -p -r1.116 uvm_aobj.c
--- sys/uvm/uvm_aobj.c	10 Mar 2025 14:13:58 -0000	1.116
+++ sys/uvm/uvm_aobj.c	7 Sep 2026 20:38:44 -0000
@@ -966,6 +966,32 @@ uao_flush(struct uvm_object *uobj, voff_
 }
 
 /*
+ * PGO_ALLPAGES makes every requested page mandatory; otherwise only
+ * centeridx must remain within the object, because adjacent pages are
+ * fault clustering candidates rather than required fetches. Validate
+ * this distinction before allocation because pageidx directly indexes
+ * swap metadata; an out of range value can therefore access storage
+ * beyond the object's extent.
+ */
+static inline int
+uao_get_validate(struct uvm_aobj *aobj, voff_t firstpage, int maxpages,
+    int centeridx, int flags)
+{
+	if (maxpages <= 0 ||
+	    firstpage < 0 ||
+	    firstpage >= (voff_t)aobj->u_pages)
+		return 0;
+
+	if (flags & PGO_ALLPAGES)
+		return (voff_t)maxpages <=
+		    (voff_t)aobj->u_pages - firstpage;
+
+	return centeridx >= 0 &&
+	    centeridx < maxpages &&
+	    (voff_t)centeridx < (voff_t)aobj->u_pages - firstpage;
+}
+
+/*
  * uao_get: fetch me a page
  *
  * we have three cases:
@@ -987,7 +1013,7 @@ uao_get(struct uvm_object *uobj, voff_t 
     int *npagesp, int centeridx, vm_prot_t access_type, int advice, int flags)
 {
 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
-	voff_t current_offset;
+	voff_t current_offset, firstpage;
 	vm_page_t ptmp;
 	int lcv, gotpages, maxpages, swslot, rv, pageidx;
 	boolean_t done;
@@ -1001,6 +1027,13 @@ uao_get(struct uvm_object *uobj, voff_t 
  	 * get number of pages
  	 */
 	maxpages = *npagesp;
+	firstpage = offset >> PAGE_SHIFT;
+	if (!uao_get_validate(aobj, firstpage, maxpages, centeridx, flags)) {
+		*npagesp = 0;
+		if ((flags & PGO_LOCKED) == 0)
+			rw_exit(uobj->vmobjlock);
+		return VM_PAGER_BAD;
+	}
 
 	if (flags & PGO_LOCKED) {
 		/*
@@ -1060,7 +1093,7 @@ uao_get(struct uvm_object *uobj, voff_t 
 		    (lcv != centeridx && (flags & PGO_ALLPAGES) == 0))
 			continue;
 
-		pageidx = current_offset >> PAGE_SHIFT;
+		pageidx = firstpage + lcv;
 
 		/*
  		 * we have yet to locate the current page (pps[lcv]).   we