TOCTOU: td_proc NULL check without holding kpsus_token

Summary

suspend_kproc(:190) checks td->td_proc==NULL BEFORE acquiring kpsus_token(:191). Token guards flags but not type-check guard. Safe for pure kernel threads (td_proc permanently NULL). Defense-in-depth.