If "user" code generated by MIG sends a request to a server and gets back a reply that does not match the RPC definition, then it returns an error but does not destroy the reply message.  So if the reply carried any rights to ports, then those rights will remain in the task.  This could perhaps be used for denial of service, if a long-lived process calls a less-trusted one.

The attached reply-leak.tar.gz demonstrates this bug.  In it, a program first forks and the child process then does an RPC to the parent once per second, but the parent process replies with a message that has an unexpected msgh_id and carries ten receive rights instead of the required data.  In the child process, MIG-generated code detects this mismatch and returns an error, which the child process logs.  The child process then checks how many port names it has, and logs that value, which increases by ten per second.  It should not increase.