“That allowed the user (aka gdbserver) to write up to 256 bytes past the end of the array.”
A 32-bit index into a 64-bit array let ptrace overwrite the process state in task_struct on PowerPC32. Miculas found it with a custom kernel module and hardware breakpoints, then sent two patches. The PowerPC maintainer, Michael Ellerman, wrote his own fix and offered him a Reported-by tag for a bug first reported six years earlier. A tag meant to inspire bug finders to help again inspired this one to stay away.