while I am waiting for my OpenEmbedded to finish compiling, I just looked over some patches in the packages directory:

From packages/busybox/busybox-1.00/rmmod.patch

@@ -109,7 +120,10 @@
for (n = optind; n < argc; n++) {
char module_name[strlen(argv[n]) + 1];
- filename2modname(module_name, argv[n]);
+ if (k_version != 4)
+ filename2modname(module_name, argv[n]);
+ else
+ strcpy(module_name, argv[n]);
#define module_name argv[n]

I am not sure whether the char declaration itself is exploitable using very large command line arguments, but with the strcpy it get worse since now you can inject code if the line argument exceeds the stack size. If busybox run suid... (well, this only gets interesting if the root-password isn't just empty ;-)

Ciao, Imi.