There is a heap overflow vulnerability in Apple's assembleBGScanResults when handling ioctl results. Continue reading...