This is one of rare cases when a Python code can trigger a SystemError. But these functions are as unsafe as ctypes, so I think that it is appropriate use of SystemError.

fcntl() and ioctl() take an argument which can be a pointer to a buffer of unspecified length, depending on operation.

Do you have examples?

Before you, nobody requested this feature, so I'm a little surprised that this feature is really needed.

The third argument of fcntl() and ioctl() is either void (ignored), int, or a pointer. For example, F_SETLK, F_SETLKW, and F_GETLK operations in fcntl() need a pointer to struct flock. struct flock should have some fields (l_type, l_whence, etc), but the size of the structure, and even the order of the fields are different on different OS. If you pass a bytes object of wrong size to fcntl.fcntl(), F_GETLK will return a truncated data of wrong size, and F_SETLK, F_SETLKW can read and use unitialized memory from a buffer variable on stack. F_KINFO on FreeBSD needs a pointer to a structure whose layout changed several times between the OS versions.

We cannot do anything with this. Unlike getsockopt()/setsockopt() we cannot specify the size of the buffer, so the OS cannot check it and fail if it is not enough. It will just read/write past the end of the buffer. But I hope that we can make the error more loud in some cases (either by raising SystemError after buffer overflow happened or by making a crash more reproducible).

See also #95380. It is more dangerous when the size exceeds 1024 and we read/write directly from/to the bytes-like object, but I hope that the user will be more accurate there.