> +ksiginfo_exithook(struct proc *p, void *v)

> +		for (;;) {
> +			pool_put(&ksiginfo_pool, ksi);
> +			if ((ksi = ksi->ksi_next) == hp[i])
> +				break;

don't use free'ed memory.

committed version is even worse. (ksi is not initialized)

YAMAMOTO Takashi