FreeBSD version 6.4 pipeclose()/knlist_cleardel() race condition exploit that results in a NULL pointer dereference and runs code in kernel mode giving a root shell and escaping from jail.
ff5a5f20c66ed5ad7afaa75d4c20c068bb2ea0c34ba9b00106c522b3827ab739
FreeBSD Security Advisory - When named(8) receives a specially crafted dynamic update message an internal assertion check is triggered which causes named(8) to exit. To trigger the problem, the dynamic update message must contains a record of type "ANY" and at least one resource record set (RRset) for this fully qualified domain name (FQDN) must exist on the server.
6794c843e62bd2ba63abb24337495791f839e4e7e47cd54d93099e0868941ba7