Line-accurate confirmation (benign today: unique oid names -> at
most one match; concurrent actor is root-driven module load/unload;
forcing the race would need a custom teardown module - not run):
sys/kern/vfs_init.c:338-343 SLIST_FOREACH over sysctl__vfs_children
   with NO SYSCTL_XLOCK while the body calls
   sysctl_unregister_oid(oidp)/sysctl_register_oid(oidp) (each takes
   SYSCTL_XLOCK internally) on the iterated node - iterator reads
   SLIST_NEXT from the re-linked node, and the unlocked traversal
   can race another module's registration/teardown onto a node whose
   owner is going away (UAF read).