sys_varsym_set replace is a non-atomic remove-then-insert: concurrent same-name sets create duplicate shadowed varsym entries; invalid level values silently return success

Summary

A 'set' operation is two independent lock cycles — varsymmake(level, name, NULL) to remove, then varsymmake(level, name, buf) to insert — with no atomicity between them. Two threads (or two processes sharing a USER-level set) setting the same name concurrently can both pass the remove step and both insert, leaving duplicate entries for one name in the TAILQ. Lookup/list return the first entry; each unset removes only one copy, so a duplicate survives as a shadowing 'zombie' value. Accounting stays symmetric, so NOT memory corruption. Separately, switch(level) has no default case, so level values outside 1..4 return 0 (success) while doing nothing — silent API misuse instead of EINVAL. Same-credential confusion only. Fix: atomic replace inside varsymmake (single lock cycle) + default: EINVAL.

Timeline

• 2026-09-02 Discovered during pass-2 audit of kern_varsym.c (GLM 5.3).