untrusted comment: verify with openbsd-64-base.pub
RWQq6XmS4eDAcTJGw5eTtgnJ0uto5wJGSjUU3mC36uh90lyJQouPGxxjxLq+VunFWrUYnGvU1+xwfzlqVJdnLSVVQXGqEVLP3wA=

OpenBSD 6.4 errata 013, January 27, 2019:

The unveil() system call can leak memory.

Apply by doing:
   signify -Vep /etc/signify/openbsd-64-base.pub -x 013_unveil.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   cd /usr/src/sys/arch/`machine`/compile/$KK
   make obj
   make config
   make
   make install

Index: sys/kern/kern_unveil.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_unveil.c,v
retrieving revision 1.15
diff -u -p -r1.15 kern_unveil.c
--- sys/kern/kern_unveil.c      25 Sep 2018 19:24:17 -0000      1.15
+++ sys/kern/kern_unveil.c      22 Jan 2019 20:49:37 -0000
@@ -525,8 +525,6 @@ unveil_add(struct proc *p, struct nameid
 done:
       if (ret == 0)
               unveil_add_traversed_vnodes(p, ndp);
-       unveil_free_traversed_vnodes(ndp);
-       pool_put(&namei_pool, ndp->ni_cnd.cn_pnbuf);
       return ret;
}

Index: sys/kern/vfs_syscalls.c
===================================================================
RCS file: /cvs/src/sys/kern/vfs_syscalls.c,v
retrieving revision 1.307
diff -u -p -r1.307 vfs_syscalls.c
--- sys/kern/vfs_syscalls.c     26 Sep 2018 14:51:44 -0000      1.307
+++ sys/kern/vfs_syscalls.c     22 Jan 2019 20:49:37 -0000
@@ -92,6 +92,7 @@ int dofutimens(struct proc *, int, struc
int dounmount_leaf(struct mount *, int, struct proc *);
int unveil_add(struct proc *, struct nameidata *, const char *);
void unveil_removevnode(struct vnode *vp);
+void unveil_free_traversed_vnodes(struct nameidata *);

/*
 * Virtual File System System Calls
@@ -912,7 +913,7 @@ sys_unveil(struct proc *p, void *v, regi

       nd.ni_pledge = PLEDGE_UNVEIL;
       if ((error = namei(&nd)) != 0)
-               return (error);
+               goto end;

       /*
        * XXX Any access to the file or directory will allow us to
@@ -922,9 +923,10 @@ sys_unveil(struct proc *p, void *v, regi
           (VOP_ACCESS(nd.ni_vp, VREAD, p->p_ucred, p) == 0 ||
           VOP_ACCESS(nd.ni_vp, VWRITE, p->p_ucred, p) == 0 ||
           VOP_ACCESS(nd.ni_vp, VEXEC, p->p_ucred, p) == 0)) ||
-           VOP_ACCESS(nd.ni_dvp, VREAD, p->p_ucred, p) == 0 ||
+           (nd.ni_dvp &&
+           (VOP_ACCESS(nd.ni_dvp, VREAD, p->p_ucred, p) == 0 ||
           VOP_ACCESS(nd.ni_dvp, VWRITE, p->p_ucred, p) == 0 ||
-           VOP_ACCESS(nd.ni_dvp, VEXEC, p->p_ucred, p) == 0)
+           VOP_ACCESS(nd.ni_dvp, VEXEC, p->p_ucred, p) == 0)))
               error = unveil_add(p, &nd, permissions);
       else
               error = EPERM;
@@ -934,6 +936,10 @@ sys_unveil(struct proc *p, void *v, regi
               vput(nd.ni_vp);
       if (nd.ni_dvp && nd.ni_dvp != nd.ni_vp)
               vput(nd.ni_dvp);
+       pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
+end:
+       unveil_free_traversed_vnodes(&nd);
+
       return (error);
}