Summary

clockmod_dom_sysctl_select is two-phase: L426 lwkt_serialize_enter; L428-429 read current duty; L430 lwkt_serialize_exit; L432 sysctl_handle_string SLEEPS on user copy; L436 lwkt_serialize_enter; L438 dom->dom_flags deref; L454 TAILQ_FOREACH dom->dom_list. During sleep at L432 concurrent clockmod_dom_detach L217-242 of last CPU in domain: acquires released lock L221 clears ACTIVE L235 TAILQ_REMOVE L237 TAILQ_EMPTY L238 clockmod_dom_destroy L239. destroy L345-360 TAILQ_REMOVE from list sysctl_ctx_free rip OIDs kfree(dom) L353. Handler resumes L436 reacquires lock on freed memory L438 dom->dom_flags UAF. sysctl_remove_oid_locked oid_running drain kern_sysctl.c:391-398 is dead code (oid_running never incremented in tree grep). Root trigger: sysctl write on machdep.clockmod_domN.select + devctl cpu detach race. Impact: kernel panic DoS; theoretical code-exec with heap grooming. Fix: hold lock across entire handler or refcount dom.