The nbdkit server had an off-by-one error when processing block status results from plugins on behalf of an NBD client. If a client requests block status for the maximum 32-bit length, and the plugin reports a larger length as a single extent, then nbdkit hits an assertion failure. A compliant client could use this to cause a denial-of-service attack against the server to prevent it from serving other clients.