Iximeow

**Name of the Vulnerable Software and Affected Versions** illumos versions prior to illumos-gate commit 696ecf8d **Description** A reachable assertion in the bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO (Memory-Mapped I/O, a method for the CPU to access hardware devices), the functions `vie emulate movs()` and `vie emulate stos()` in `usr/src/uts/intel/io/vmm/vmm instruction emul.c` fail to clear the `VIES REPEAT` status flag on the final iteration. For MMIO regions emulated in the kernel, such as the local APIC, I/O APIC, and HPET, this stale flag causes a VERIFY assertion in `vie advance pc()` to fail, leading to a host panic. A privileged user within a guest VM can trigger this by issuing a REP MOVS or REP STOS instruction against the local APIC page, resulting in a denial of service for the host and all other guests running on it. **Recommendations** Update to illumos-gate commit 696ecf8d or a newer version.