Rvolosatovs

A time-of-check/time-of-use (TOCTOU) race condition exists in the wasip3 wasi:sockets udp-socket host implementation. This flaw allows guests to bypass send restrictions enforced by the `socket addr check` function. A malicious guest can exploit this by racing `udp-socket.send` against `udp-socket.connect` to send attacker-controlled datagrams to addresses that the policy only permits for receiving.

The `wasmtime-wasi` component re-appends a trailing slash to rename source paths. On macOS and FreeBSD hosts, this causes the `renameat()` function to follow directory symlinks. A guest with sandbox write access can exploit this by renaming a relative symlink, such as `up/`, to move host directories into the sandbox, enabling unauthorized read and write access to those directories.