Negative IOCTL paramter value allows read access to kernel memory.
vulners.com/securityvulns/securityvulns:doc:15085
vulners.com/securityvulns/securityvulns:doc:15316