OpenBSD 3.3: improper kernel bounds check

An improper bounds check in the semget(2) system call can allow a
local user to cause a kernel panic.  No privilege escalation is
possible, the attack simply runs the kernel out of memory.  The bug
was introduced in OpenBSD 3.3, previous versions of OpenBSD are
unaffected.

The bug has been fixed in OpenBSD-current as well as the 3.3 stable
branch.  In addition, a patch is available for OpenBSD 3.3:
    ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.3/common/002_semget.patch

Credit goes to blexim for finding and reporting the problem.