rcu_expand() performs a blocking GFP_KERNEL (M_WAITOK) allocation inside crit_enter() — sleeping allocation in a critical section under memory pressure

Summary

GFP_KERNEL maps to M_WAITOK which can sleep (vm_wait/tsleep) while td_critcount>0 - breaks the crit serialization the ring relies on (latent today: state consistent mid-expand) and would be outright illegal if any irq-context caller queued a callback. GFP_NOWAIT or restructure-outside-crit fix.