The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.

The hda driver is vulnerable to a buffer over-read from a guest-controlled value.

The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.

Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process.

A guest can trigger an infinite loop in the hda audio driver.