Recent HSM patches seem to blindly trust incoming network data.
Examples include mdt_hsm_action handling of the action list where we blindly trust number of items supplied without testing against provided buffer sizes, also allocating buffers not using OBD_ALLOC_LARGE which provides somewaht easy DoS avenue.
Another example is mdt_hsm_request handling of hr_itemcount.
I suspect there are more cases like this in other patches.

Additionally sanity max values for all those item counts should be added in client side ioctl handlers to avoid easy local DoS avenues.