untrusted comment: signature from openbsd 6.0 base secret key
RWSho3oKSqgLQ4cryj2ELe5IomTbKgPI18JZme4WueuBAnf/RdLPRg5Vj+pm63Jws8zy4u+6NuDYKZwoNVMYrQBTzpkqsiebGAo=

OpenBSD 6.0 errata 027, June 12, 2017:

Fix an integer overflow in two range checks of the sti(4) display driver.
This issue only affects the hppa architecture.

Apply by doing:
   signify -Vep /etc/signify/openbsd-60-base.pub -x 027_sti.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   cd /usr/src/sys/arch/`machine`/conf
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   config $KK
   cd ../compile/$KK
   make
   make install

Index: sys/dev/ic/sti.c
===================================================================
RCS file: /cvs/src/sys/dev/ic/sti.c,v
retrieving revision 1.77
diff -u -p -r1.77 sti.c
--- sys/dev/ic/sti.c    9 Sep 2015 18:23:39 -0000       1.77
+++ sys/dev/ic/sti.c    11 Jun 2017 02:32:04 -0000
@@ -1130,7 +1130,7 @@ sti_ioctl(void *v, u_long cmd, caddr_t d
               cmapp = (struct wsdisplay_cmap *)data;
               idx = cmapp->index;
               count = cmapp->count;
-               if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
+               if (idx >= STI_NCMAP || count > STI_NCMAP - idx)
                       return EINVAL;
               if ((ret = copyout(&scr->scr_rcmap[idx], cmapp->red, count)))
                       break;
@@ -1146,7 +1146,7 @@ sti_ioctl(void *v, u_long cmd, caddr_t d
               cmapp = (struct wsdisplay_cmap *)data;
               idx = cmapp->index;
               count = cmapp->count;
-               if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
+               if (idx >= STI_NCMAP || count > STI_NCMAP - idx)
                       return EINVAL;
               if ((ret = copyin(cmapp->red, &scr->scr_rcmap[idx], count)))
                       break;