kcollect_register pins no caller-module lifetime; kcollect_unregister unenforced — latent UAF (indirect call + strlen) for loadable-module consumers

Summary

kcollect_register() stores the caller's raw 'const char *id' and raw kcallback_t function pointer into global arrays with no reference on the registering module, and nothing enforces kcollect_unregister() (zero in-tree callers) before a kld unload. After such an unload, the kcollect thread indirect-calls through the dangling kcollect_callback[n] every 10 seconds and the sysctl strlen()s the dangling kcollect_slots[i] — a use-after-free control-flow primitive and a UAF read. Not reachable on a stock system: all five in-tree registrants are compiled-in, and triggering requires a third-party kld (i.e. root). Filed as hardening/defense-in-depth for the exported kernel API. Fix: copy the id string into fixed internal storage + make unregister a documented mandatory module-unload step.

Timeline

• 2026-09-02 Discovered during pass-2 audit of kern_collect.c (GLM 5.3).