untrusted comment: verify with openbsd-78-base.pub
RWS3/nvFmk4SWXD/SIhkNCaKRRUbZz2St3VWxynLCrUd4YeqmGcdYiVtMLajJYwPAGQKF9HbSVV5NAuHW0eajPoJraUZ9+yr+QI=

OpenBSD 7.8 errata 019, March 4, 2026:

unveil(2) traversals could misbehave crossing mountpoints.

Apply by doing:
    signify -Vep /etc/signify/openbsd-78-base.pub -x 019_unveil_mount.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/kern/vfs_lookup.c
===================================================================
RCS file: /cvs/src/sys/kern/vfs_lookup.c,v
diff -u -p -u -r1.90 vfs_lookup.c
--- sys/kern/vfs_lookup.c	20 Sep 2025 13:53:36 -0000	1.90
+++ sys/kern/vfs_lookup.c	23 Feb 2026 18:26:31 -0000
@@ -536,6 +536,7 @@ dirloop:
 	 */
 	if (cnp->cn_flags & ISDOTDOT) {
 		for (;;) {
+			unveil_check_component(curproc, ndp, dp);
 			if (dp == ndp->ni_rootdir || dp == rootvnode) {
 				ndp->ni_dvp = dp;
 				ndp->ni_vp = dp;