OS X Coreaudiod Calls Uninitialized Function Pointer
com.apple.audio.coreaudiod is reachable from various sandboxes...
iOS / OS X Kernel IOHDIXControllUserClient:clientClose UAF / Double Free
iOS / OS X kernels suffer...