The syscons CONS_SCRSHOT ioctl in FreeBSD 5.x allows local users to read arbitrary kernel memory via (1) negative coordinates or (2) large coordinates.
https://exchange.xforce.ibmcloud.com/vulnerabilities/17584
https://euvd.enisa.europa.eu/vulnerability/EUVD-2004-0917
http://www.securityfocus.com/bid/11321