The HDA audio device model within bhyve fails to reject zero‑length Buffer Descriptor List (BDL) entries when a stream is started. A zero‑length entry can trigger out‑of‑bounds reads or writes during DMA transfer processing, allowing a malicious QEMU guest to crash the bhyve process or, under certain conditions, execute arbitrary code in the host userspace that runs the virtual machine, subject to bhyve's Capsicum sandbox. The weakness involves improper input validation of BDL lengths and potential race conditions that allow a guest to modify BDL fields after validation, resulting in a buffer over‑read and out‑of‑bounds write.

The vulnerability affects the bhyve hypervisor bundled with FreeBSD. No specific FreeBSD release or version was identified as having the issue or as safely patched, so any installation of bhyve on a FreeBSD system is potentially impacted.

The recorded CVSS score is 7, indicating a high severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation in the wild. Attackers need to be able to run code in a guest VM; the exploit chain requires the guest to construct a zero‑length BDL entry, which the hypervisor incorrectly accepts. The impact is limited to the host system hosting the VM; however, successful exploitation can lead to denial‑of‑service or privilege escalation to the host userspace context.