A race condition was found in the TTY subsystem, which may cause an out of bounds read in VT as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE).