Nonsense. This is trivial stuff.

-sigh-

Suppose there is a process which is supposed to watch a log and take certain actions (maybe alter a firewall rule) depending on what it sees in the logs. Now suppose there's a bug in that program, all the bug enables me (the attacker) to do is force it to call the read syscall with the log fd, a buf value of my choosing (maybe from bytes in the log) and count of zero.

On the face of it, this seems useless for me as an attacker.

Suppose I find a way to get read() to Oops if the buf value is N-1 for a particular magic value N, regardless of the value of count.

On the face of it, this too seems useless. A real security "expert" from the Internet has just assured us that it's not security relevant. But..

Combine them, and I've disabled the firewall tweaking log file reader. This was defending against brute force attacks on a network service, which I promptly break into.