[haileys]

`boost_write` doesn't appear to validate the length of the user supplied buffer before casting and dereferencing either, so that's a kernel-mode OOB read. Not sure how exploitable this actually is though.

[AndrewGaspar]

lol yep, you're 100% right.