Note: This is purely the output of the chat conversation and does not contain any raw data, codebase snippets, etc. used to generate the output.
msgctl in bsd/kern/sysv_msg.c, when handling IPC_SET, calls SYSV_MSG_SUBSYS_UNLOCK to drop the lock before running copyin. Why is this unsafe?
Grep searched codebase