@bapt this driver has some exploitable bugs, and it's accessible to unprivileged users (in the video group, but still). Many of them are the result of insufficient locking, e.g., multiple threads can race to call uvideo_streamoff() and trigger a double free. There is another problem with uvideo_mmap(): it maps a driver-allocated buffer which gets freed when the device file is closed, so the mapping can be used to access freed memory, same bug as the one fixed by 1b775b9ea4c1f4eb375c4309f8d6e90edb269844. (In fact I cannot see how OpenBSD handles this either.)

Do you have some time to help fix these problems?