untrusted comment: signature from openbsd 6.0 base secret key
RWSho3oKSqgLQ7o+A63mXBBV1+V3puGKZ3Z68XY9NHGgRnxKcN7ghQcxfRRpvyqg1SapN+0vWxkNJ1D+qGivFx3yp54JJpdRKwg=

OpenBSD 6.0 errata 037, August 3, 2017:

An integer overflow in wsdisplay_cfg_ioctl() may result in
an out-of-bounds read.

Apply by doing:
   signify -Vep /etc/signify/openbsd-60-base.pub -x 037_wsdisplay.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   cd /usr/src/sys/arch/`machine`/conf
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   config $KK
   cd ../compile/$KK
   make
   make install

Index: sys/dev/wscons/wsdisplay.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsdisplay.c,v
--- sys/dev/wscons/wsdisplay.c  8 Sep 2015 11:13:20 -0000       1.124
+++ sys/dev/wscons/wsdisplay.c  2 Aug 2017 16:44:07 -0000
@@ -1305,6 +1305,10 @@ wsdisplay_cfg_ioctl(struct wsdisplay_sof
#define d ((struct wsdisplay_font *)data)
               if (!sc->sc_accessops->load_font)
                       return (EINVAL);
+               if (d->fontheight > 64 || d->stride > 8) /* 64x64 pixels */
+                       return (EINVAL);
+               if (d->numchars > 65536) /* unicode plane */
+                       return (EINVAL);
               fontsz = d->fontheight * d->stride * d->numchars;
               if (fontsz > WSDISPLAY_MAXFONTSZ)
                       return (EINVAL);