Apply by doing
cd /usr/src
patch -p0 <022_userltd.patch
And then rebuild your kernel.
Index: sys/arch/i386/i386/sys_machdep.c
===================================================================
RCS file: /cvs/src/sys/arch/i386/i386/sys_machdep.c,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- sys/arch/i386/i386/sys_machdep.c 2000/06/23 02:14:36 1.8
+++ sys/arch/i386/i386/sys_machdep.c 2001/01/19 18:31:30 1.9
@@ -240,6 +240,17 @@
break;
case SDT_SYS286CGT:
case SDT_SYS386CGT:
+ /*
+ * Only allow call gates targeting a segment
+ * in the LDT or a user segment in the fixed
+ * part of the gdt. Segments in the LDT are
+ * constrained (below) to be user segments.
+ */
+ if (desc.gd.gd_p != 0 && !ISLDT(desc.gd.gd_selector) &&
+ ((IDXSEL(desc.gd.gd_selector) >= NGDT) ||
+ (gdt[IDXSEL(desc.gd.gd_selector)].sd.sd_dpl !=
+ SEL_UPL)))
+ return (EACCES);
/* Can't replace in use descriptor with gate. */
if (n == fsslot || n == gsslot)
return (EBUSY);