From the BSD that claims of itself:
Only two remote holes in the default install, in more than 10 years!
from its latest changelog (4.3):
Assorted improvements and code cleanup:
- ..
- TCP responses to highly fragmented packets are now constructed without risking corruption of kernel memory.
Erm, colour me confused but a network-triggered memory corruption sounds like a remote hole. At least it shouldn’t have been placed in the ‘code cleanup’ section.
