--- kernel/bsd/kern/uipc_usrreq.c 2018/04/24 18:26:01 1.1.1.1 +++ kernel/bsd/kern/uipc_usrreq.c 2018/04/24 18:27:38 1.1.1.2 @@ -678,7 +678,11 @@ unp_internalize(control, p) for (i = 0; i < oldfds; i++) { (void) fdgetf(p, *(int *)rp, &fp); *rp++ = fp; - fp->f_count++; + if (++fp->f_count <= 0) + panic("unp_internalize f_count"); + /* The following line needs no overflow check + * as if f_msgcount overflows we already + * panic with the f_count overflow above */ fp->f_msgcount++; unp_rights++; } @@ -791,7 +795,8 @@ unp_gc() if (fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) { *fpp++ = fp; nunref++; - fp->f_count++; + if (++fp->f_count <= 0) + panic("unp_gc f_count"); } } for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp)