vfs_register() walks sysctl__vfs_children without SYSCTL_XLOCK while unlinking/relinking the iterated oid mid-loop

Summary

The sysctl renumber loop iterates the parent oid list with a naked SLIST_FOREACH while the loop body calls sysctl_unregister_oid()/ sysctl_register_oid() (each taking SYSCTL_XLOCK internally) on the very node being iterated — the iterator's SLIST_NEXT is read from the re-linked node after sorted reinsertion, so entries between the old and new position are skipped; and the unlocked traversal races any concurrent module's sysctl registration under _vfs, allowing traversal onto a node whose owning module is being torn down (UAF read). Benign in practice today because oid names are unique (at most one match exists) and the concurrent actor must be a root-driven module load/unload; hardening-grade. Fix: hold SYSCTL_XLOCK across the whole traversal using the internal register/unregister variants.

Timeline

• 2026-09-02 Discovered during pass-2 audit of vfs_init.c (GLM 5.3).