untrusted comment: verify with openbsd-80-base.pub
RWSMSt0erHTctfbh1ybtYUzMTGZOcdppH8Eo6MMpdRXFBCW34ggnI5gpACY2rpXy0F6AB+gkHxXX6uBxbcCDDy6gz+InxRSKwQ8=

OpenBSD 8.0 errata 019, November 14, 2026:

A local user logged in on the glass console could write out of
bounds to kernel memory and use this to gain root privileges.

Apply by doing:
    signify -Vep /etc/signify/openbsd-80-base.pub -x 019_wscons.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/dev/wscons/wsemul_vt100.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsemul_vt100.c,v
diff -u -p -r1.49 wsemul_vt100.c
--- sys/dev/wscons/wsemul_vt100.c	30 Aug 2026 06:44:10 -0000	1.49
+++ sys/dev/wscons/wsemul_vt100.c	8 Nov 2026 17:34:54 -0000
@@ -218,7 +218,9 @@ wsemul_vt100_attach(int console, const s
 
 	edp->tabs = malloc(edp->ncols, M_DEVBUF, M_NOWAIT);
 #ifdef HAVE_DOUBLE_WIDTH_HEIGHT
-	edp->dblwid = malloc(edp->nrows, M_DEVBUF, M_NOWAIT | M_ZERO);
+	/* at least two columns needed to enable double-width characters... */
+	if (edp->ncols >= 2)
+		edp->dblwid = malloc(edp->nrows, M_DEVBUF, M_NOWAIT | M_ZERO);
 	edp->dw = 0;
 #endif
 	edp->dcsarg = malloc(DCS_MAXLEN, M_DEVBUF, M_NOWAIT);
@@ -266,8 +268,8 @@ wsemul_vt100_resetop(void *cookie, enum 
 		vt100_initchartables(edp);
 		break;
 	case WSEMUL_CLEARSCREEN:
-		(void)wsemul_vt100_ed(edp, 2);
 		edp->ccol = edp->crow = 0;
+		(void)wsemul_vt100_ed(edp, 2);	/* erase complete display */
 		(*edp->emulops->cursor)(edp->emulcookie,
 		    edp->flags & VTFL_CURSORON, 0, 0);
 		break;
@@ -537,6 +539,7 @@ wsemul_vt100_output_esc(struct wsemul_vt
 			break;
 		edp->crow = edp->savedcursor_row;
 		edp->ccol = edp->savedcursor_col;
+		CHECK_DW;
 		edp->curattr = edp->savedattr;
 		edp->bkgdattr = edp->savedbkgdattr;
 		edp->attrflags = edp->savedattrflags;
@@ -609,10 +612,10 @@ wsemul_vt100_output_esc(struct wsemul_vt
 		break;
 	case 'c': /* RIS */
 		wsemul_vt100_reset(edp);
-		rc = wsemul_vt100_ed(edp, 2);
+		edp->ccol = edp->crow = 0;
+		rc = wsemul_vt100_ed(edp, 2);	/* erase complete display */
 		if (rc != 0)
 			break;
-		edp->ccol = edp->crow = 0;
 		break;
 	case '(': case ')': case '*': case '+': /* SCS */
 		edp->designating = instate->inchar - '(';
@@ -1027,6 +1030,7 @@ wsemul_vt100_output_esc_hash(struct wsem
 					return rc;
 			}
 			edp->dblwid[edp->crow] = 1;
+			/* inline CHECK_DW */
 			edp->dw = 1;
 			if (edp->ccol > (edp->ncols >> 1) - 1)
 				edp->ccol = (edp->ncols >> 1) - 1;
@@ -1045,6 +1049,7 @@ wsemul_vt100_output_esc_hash(struct wsem
 		}
 		edp->ccol = 0;
 		edp->crow = 0;
+		CHECK_DW;
 		break;
 	default:
 #ifdef VT100_PRINTUNKNOWN
@@ -1213,6 +1218,7 @@ wsemul_vt100_output(void *cookie, const 
 			}
 			wsemul_reset_abortstate(&edp->abortstate);
 			edp->crow -= lines;
+			CHECK_DW;
 		}
 #endif
 
Index: sys/dev/wscons/wsemul_vt100_subr.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsemul_vt100_subr.c,v
diff -u -p -r1.32 wsemul_vt100_subr.c
--- sys/dev/wscons/wsemul_vt100_subr.c	5 Nov 2024 15:54:12 -0000	1.32
+++ sys/dev/wscons/wsemul_vt100_subr.c	8 Nov 2026 17:34:54 -0000
@@ -74,8 +74,8 @@ wsemul_vt100_scrollup(struct wsemul_vt10
 			memmove(&edp->dblwid[edp->scrreg_startrow],
 			    &edp->dblwid[edp->scrreg_startrow + n], help);
 		memset(&edp->dblwid[edp->scrreg_startrow + help], 0, n);
+		CHECK_DW;
 	}
-	CHECK_DW;
 #endif
 
 	return 0;
@@ -111,8 +111,8 @@ wsemul_vt100_scrolldown(struct wsemul_vt
 			memmove(&edp->dblwid[edp->scrreg_startrow + n],
 			    &edp->dblwid[edp->scrreg_startrow], help);
 		memset(&edp->dblwid[edp->scrreg_startrow], 0, n);
+		CHECK_DW;
 	}
-	CHECK_DW;
 #endif
 
 	return 0;
@@ -477,7 +477,7 @@ wsemul_vt100_handle_csi(struct wsemul_vt
 		break;
 	case 'G': /* CHA */
 	case '`': /* HPA */
-		edp->ccol = min(DEF1_ARG(0), edp->ncols) - 1;
+		edp->ccol = min(DEF1_ARG(0), NCOLS) - 1;
 		break;
 	case 'H': /* CUP */
 	case 'f': /* HVP */
@@ -565,6 +565,7 @@ wsemul_vt100_handle_csi(struct wsemul_vt
 		break;
 	case 'd': /* VPA */
 		edp->crow = min(DEF1_ARG(0), edp->nrows) - 1;
+		CHECK_DW;
 		break;
 	case 'g': /* TBC */
 		if (edp->tabs != NULL)
@@ -738,6 +739,7 @@ wsemul_vt100_handle_csi(struct wsemul_vt
 		edp->crow = ((edp->flags & VTFL_DECOM) ?
 			     edp->scrreg_startrow : 0);
 		edp->ccol = 0;
+		CHECK_DW;
 		break;
 	case 's':
 		edp->flags |= VTFL_SAVEDCURS;
@@ -748,6 +750,7 @@ wsemul_vt100_handle_csi(struct wsemul_vt
 		if (edp->flags & VTFL_SAVEDCURS) {
 			edp->crow = edp->savedcursor_row;
 			edp->ccol = edp->savedcursor_col;
+			CHECK_DW;
 		}
 		break;
 	case 'y':