Two Bugs, One Func(), part three

Objective-See's third post in a series on macOS 10.12 kernel bugs describes a ring-0 heap overflow in the audit_arg_sockaddr() function. The bcopy() call copies sa->sa_len bytes into a fixed 128-byte sockaddr_storage field, so a UNIX socket longer than 128 bytes overflows the kernel audit record.