The code in IOMXNodeInstance.cpp that handles enableNativeBuffers uses port_index without validation, leading to writing the dword value 0 or 1 at an attacker controlled offset from the IOMXNodeInstance structure.
72e3f04c0dccca9d11b30c786b9e44b6ad70abc4202d48d377b62972e3b859af