Looks like a buffer overrun in notify.c

If my analysis is correct, this should only happen when you have used ftp or web inteface to both remount drives rw and then ro. If you use serial/telnet to run rw, rwm, rwp, then an ftp/web ro command will be fine. And if you use ftp/web to set rw, then a serial/telnet ro will also work. And all paritions need to be rw for the site ro to fail, ie if you ftp/web site rw, then serial/telnet rom, then ftp/web site ro will be okay.

The reason for all of this is because hijack's ftp/web remount commands use some performance-enhancing flags, whereas the binary utilities don't. These flags increase the amount of data read into the buffer, as does the fact that we've added 2 partitions, and once that data hits >256 byte we're in trouble. This theory is supported by the charactor count of /proc/mounts after an ftp site rw, which returns 268 bytes.

So I'm currently building a modified HJ299 with a larger buffer to see if that fixes it.