The bpf ioctl BIOCSBLEN allows userspace to set the bpf buffer length. If an interface is attached, the length cannot be changed. However, by creating and attaching to a bridge interface, the length can be changed and the buffer size will be out of sync with the actual allocated buffer size, leading to heap corruption when packets are received on the target interface.