Stumbled upon this while reading. Not sure about the internals of
struct componentname in namei.h, but I think kern_unveil.c does not
need to call strlen. Note that cn_namelen in struct componentname
is of type long and namesize in struct unvname is of type size_t.
Not sure this is an issue.


Index: sys/kern/kern_unveil.c
===================================================================
RCS file: /cvs/src/sys/kern/kern_unveil.c,v
diff -u -p -u -r1.55 kern_unveil.c
--- sys/kern/kern_unveil.c	5 Dec 2022 23:18:37 -0000	1.55
+++ sys/kern/kern_unveil.c	18 Nov 2025 02:27:31 -0000
@@ -111,11 +111,12 @@ unveil_delete_names(struct unveil *uv)
 }
 
 int
-unveil_add_name_unlocked(struct unveil *uv, char *name, u_char flags)
+unveil_add_name_unlocked(struct unveil *uv, char *name, size_t namelen,
+	    u_char flags)
 {
 	struct unvname *unvn;
 
-	unvn = unvname_new(name, strlen(name) + 1, flags);
+	unvn = unvname_new(name, namelen + 1, flags);
 	if (RBT_INSERT(unvname_rbt, &uv->uv_names, unvn) != NULL) {
 		/* Name already present. */
 		unvname_delete(unvn);
@@ -127,18 +128,19 @@ unveil_add_name_unlocked(struct unveil *
 }
 
 int
-unveil_add_name(struct unveil *uv, char *name, u_char flags)
+unveil_add_name(struct unveil *uv, char *name, size_t namelen,
+	    u_char flags)
 {
 	int ret;
 
 	rw_enter_write(&uv->uv_lock);
-	ret = unveil_add_name_unlocked(uv, name, flags);
+	ret = unveil_add_name_unlocked(uv, name, namelen, flags);
 	rw_exit_write(&uv->uv_lock);
 	return ret;
 }
 
 struct unvname *
-unveil_namelookup(struct unveil *uv, char *name)
+unveil_namelookup(struct unveil *uv, char *name, size_t namelen)
 {
 	struct unvname n, *ret = NULL;
 
@@ -150,7 +152,7 @@ unveil_namelookup(struct unveil *uv, cha
 	KASSERT(uv->uv_vp != NULL);
 
 	n.un_name = name;
-	n.un_namesize = strlen(name) + 1;
+	n.un_namesize = namelen + 1;
 
 	ret = RBT_FIND(unvname_rbt, &uv->uv_names, &n);
 
@@ -221,7 +223,8 @@ unveil_copy(struct process *parent, stru
 		rw_enter_read(&from->uv_lock);
 		RBT_FOREACH_SAFE(unvn, unvname_rbt, &from->uv_names, next) {
 			if (unveil_add_name_unlocked(&child->ps_uvpaths[i],
-				    unvn->un_name, unvn->un_flags))
+				    unvn->un_name, unvn->un_namesize - 1,
+				    unvn->un_flags))
 				child->ps_uvncount++;
 		}
 		rw_exit_read(&from->uv_lock);
@@ -473,7 +476,8 @@ unveil_add(struct proc *p, struct nameid
 		if (!directory_add) {
 			struct unvname *tname;
 			if ((tname = unveil_namelookup(uv,
-			    ndp->ni_cnd.cn_nameptr)) != NULL) {
+			    ndp->ni_cnd.cn_nameptr,
+			    ndp->ni_cnd.cn_namelen)) != NULL) {
 				DPRINTF("unveil: %s(%d): changing flags for %s"
 				    "in vnode %p, uvcount %d\n",
 				    pr->ps_comm, pr->ps_pid, tname->un_name, vp,
@@ -511,7 +515,8 @@ unveil_add(struct proc *p, struct nameid
 		goto done;
 	}
 
-	if (unveil_add_name(uv, ndp->ni_cnd.cn_nameptr, flags))
+	if (unveil_add_name(uv, ndp->ni_cnd.cn_nameptr, ndp->ni_cnd.cn_namelen,
+		    flags))
 		pr->ps_uvncount++;
 	ret = 0;
 
@@ -716,7 +721,8 @@ unveil_check_final(struct proc *p, struc
 
 		goto done;
 	}
-	if ((tname = unveil_namelookup(uv, ni->ni_cnd.cn_nameptr)) == NULL) {
+	if ((tname = unveil_namelookup(uv, ni->ni_cnd.cn_nameptr,
+		    ni->ni_cnd.cn_namelen)) == NULL) {
 		DPRINTF("unveil: %s(%d) no match for terminal '%s' in "
 		    "directory vnode %p\n",
 		    pr->ps_comm, pr->ps_pid,