Summary

kthread_run() kzalloc-s task_struct wires td->td_linux_task = task (line 65) but neither kthread_stop() nor normal kthread exit path ever calls kfree() on it or clears td_linux_task. Pure LWKT kthreads never traverse kern_exit.c lwp-exit path so linux_task_drop_callback (kern_exit.c:708-709) never fires. Every kthread_run/kthread_stop cycle leaks one task_struct (~256 bytes+spinlock) AND leaves freed-elsewhere struct thread with td_linux_task pointing at leaked task which still points back at now-objcache-recyclable td. Stale back-pointer: lwkt_free_thread returns ts->dfly_td to thread_cache WITHOUT clearing td_linux_task; DragonFly objcache does not zero objects on put. When lwkt_alloc_thread hands td back for unrelated new thread td_linux_task is stale non-NULL pointer to leaked task_struct whose dfly_td points at now-recycled thread. Any code following td_linux_task (signal_pending/fatal_signal_pending current macro) will dereference stale possibly-reused memory treat attacker-influenced data as live task_struct = type-confusion/info-leak primitive compounding DF-2195. Requires same access: /dev/dri/renderD* user or ability to trigger GPU reset/driver reload.