FreeBSD was vulnerable to BadIRET. Oddly, they never seem to have published an advisory, but the fix was here:

https://reviews.freebsd.org/rS275833

I thought the handling of that issue was very strange. I notified CERT, who apparently coordinated with FreeBSD, but no one ever really responded. The closest thing to an advisory that I can find at all is my post:

http://www.openwall.com/lists/oss-security/2015/07/09/1

which contains a PoC that crashes the system. It's almost certainly possible to turn it into privilege escalation, though.

Go figure. I suspect that the security community just doesn't pay as much attention to FreeBSD as they do to Linux.