The following reply was made to PR kern/35278; it has been noted by GNATS.

From: yamt@mwd.biglobe.ne.jp (YAMAMOTO Takashi)
To: elad@NetBSD.org
Cc: gnats-bugs@NetBSD.org
Subject: Re: kern/35278: veriexec sometimes feeds user va to log(9)
Date: Sun, 24 Dec 2006 01:37:59 +0900 (JST)

 > > after some more thoughts, i remembered that you can't abuse SAVENAME for
 > > this purpose because filesystems have their own use of SAVENAME.
 > > (it's what SAVENAME is for)
 > 
 > why? check_exec() already uses it.
 
 it's safe for plain LOOKUPs.
 
 > what will happen if we use it in
 > sys_unlink() and rename_files() too?
 
 it ends up with double-free because filesystem can set
 SAVENAME and free pnbuf by itself,
 
 > (it's working okay here)
 
 it can work for some filesystems like ufs.
 
 YAMAMOTO Takashi