diff
< 	cmd_buf = memdup_user(buf, count);
---
> 	size_t safe_count = min(count, sizeof(user_val));
> 	cmd_buf = memdup_user(buf, safe_count);
