Working on a different project, we stumbled across some NFS bugs, then realized that the BSD implementations were less than robust to put it mildly. Digging deeper more bugs were found (not memory corruption bugs…) and that pretty much every implementation we could find was vulnerable. These bugs are super trivial to exploit and present pretty much everywhere NFS is (take FreeBSD for the earliest version we managed to install in a VM to the latest is vulnerable).