Integer overflow in IEEE 802.11 network subsystem (ieee80211_ioctl.c) in FreeBSD before 6.0-STABLE, while scanning for wireless networks, allows remote attackers to execute arbitrary code by broadcasting crafted (1) beacon or (2) probe response frames.
https://exchange.xforce.ibmcloud.com/vulnerabilities/24192
http://www.signedness.org/advisories/sps-0x1.txt
http://www.securityfocus.com/bid/16296
http://www.blackhat.com/html/bh-europe-07/bh-eu-07-speakers.html#Eriksson
http://securitytracker.com/id?1015518