Additional comments: ssh may attempt to zero and free the buffer from

Additional comments: ssh may attempt to zero and free the buffer from
fatal().  The incorrect buffer size at the time fatal() is called will
cause it to zero an area larger then has actually been allocated.  Since
meta-data is not inline with the allocation on FreeBSD (and hence DragonFly)
systems it is believed that the worst that can happen is a crash.  On linux
systems, however, it may be possible to exploit the flaw to gain elevated
privs.