Line-accurate confirmation (triggering requires a third-party KLD
that registers and unloads - i.e. root; all five in-tree registrants
re-verified compiled-in this session):
sys/kern/kern_collect.c:97 kcollect_register stores the caller RAW
   'const char *id'; :98 the raw kcallback_t pointer; no module
   lifetime reference
sys/kern/kern_collect.c:107-115 kcollect_unregister has zero
   in-tree callers - nothing enforces it before kldunload
After unload: kcollect thread indirect-calls the dangling callback
(:161-164, every 10s) and the sysctl strlen()s the dangling id
(:225-227) - UAF control-flow + UAF read.
Fix copies the id into fixed internal storage; unregister remains
the documented mandatory step.