3 CVEs found by XGPT were patched in macOS 27 release. CVE-2026-84536 — SMBClient: remote kernel memory corruption via integer underflow in symlink resolution Apple: "An integer underflow was addressed with improved input validation. Connecting to a malicious SMB server may lead to unexpected system termination." In smbfs_smb_unix_read_symlink(), nmlen -= 2 runs on a server-controlled size_t with no minimum check; a TRANS2 QUERY_PATH_INFO (SMB_QFILEINFO_UNIX_LINK) reply carrying fewer than 2 bytes wraps nmlen to SIZE_MAX, so targetlen = nmlen * 9 + 1 becomes 0xFFFFFFFFFFFFFFF8, the oversized kalloc_data returns NULL, and that unchecked buffer is immediately written through. What broadens the reachability is that the readlink is issued automatically from smbfs_vnop_getattr(), so ordinary directory enumeration — Finder, Spotlight, an indexer — exercises the path with no user action past connecting. CVE-2026-84537 — SMBClient: kernel heap corruption via allocation/free size mismatch Apple: "The issue was addressed with improved memory handling. An app may be able to cause unexpected system termination or corrupt kernel memory." nsmb_dev_ioctl reuses rwrq->ioc_cnt for both the kalloc_data size and the post-transfer byte count: a server answering SMBIOC_READ/SMBIOC_WRITE with a short transfer leaves the field reduced, and kfree_data releases the original allocation under the smaller size — a textbook zone-confusion primitive that current XNU hardening converts into termination. Apple treats the issue as an app-triggered local one even though the triggering bytes arrive over the network. CVE-2026-84581 — HFS: local kernel heap overflow in the extent B-tree byte-swap Apple: "A buffer overflow was addressed with improved bounds checking. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory." In hfs_swap_HFSPlusBTInternalNode, recordSize is sizeof(HFSPlusExtentDescriptor) (8 bytes) while the swap loop writes a full HFSPlusExtentRecord (64), so a 20-byte bounds check admits a 76-byte access — 52 bytes past the node buffer. The corruption is a SWAP_BE32 byte reversal of adjacent heap rather than attacker-chosen data, triggered by an unprivileged user mounting a crafted disk image and reading a file.