[throwaway290]

Perhaps the kext with the overflow may not necessarily look malicious? It can serve as an actually useful kext and pass review.

[aenis]

These days all kexts look malicious.

[ntauthority]

Yeah. The bundled ones in the main OS image are the worst. Who the hell knows what nefarious acts lie behind IOPCIFamily.kext?!

/s, though not entirely, moving more stuff to unprivileged contexts would be nice

[shp0ngle]

yeah but if you can trick the user to do that, you can already trick him to do more