Example 1: A security hole in the FreeBSD kernel.

File: sys/compat/linprocfs/linprocfs.c
Function: linprocfs_doproccmdline

Call to function "copyin" TAINTS argument "pstr"
793 error = copyin((void *)p->p_sysent->sv_psstrings, &pstr,
794                sizeof(pstr));
795 if (error)
796     return (error);
TAINTED user-pointer "(pstr).ps_argvstr" dereferenced
797 for (i = 0; i < pstr.ps_nargvstr; i++) {
798     sbuf_copyin(sb, pstr.ps_argvstr[i], 0);
799     sbuf_printf(sb, "%c", '\0');
800 }