Double-free containment in _kfree_obj is INVARIANTS-only: the compiled-in KMALLOC_CHECK_DOUBLE_FREE bitmap and all ring-sanity checks are no-ops in production kernels, so a double free silently duplicates or drops free-ring pointers

Summary

sys/_malloc.h:58 compiles KMALLOC_CHECK_DOUBLE_FREE in by default "for safety", but every enforcement point is a KKASSERT (compiled out without INVARIANTS). In production builds: (a) the common double-free case (destination ring slot empty) is fully SILENT — the duplicate pointer is stored, putting the same kernel address into the free ring twice so two subsequent kmalloc_obj callers receive the same object (cross-subsystem aliasing → UAF-class corruption); (b) when the destination slot is occupied, the code prints and then unconditionally overwrites the slot anyway, silently dropping a live free-object pointer. The guard exists precisely to catch caller bugs — and catches them only on INVARIANTS/debug kernels. Amplifier only (requires a pre-existing kernel double-free; none known in-tree).

Recommended fix

Make detection unconditional and fail-safe: on finding the bit already clear (or the slot occupied), do NOT store into the ring — panic unconditionally or refuse the free + rate-limited kprintf (row diff).

Timeline

• 2026-08-31 Discovered during pass-2 audit of kern_kmalloc.c (GLM 5.3).