macOS Kernel - Use-After-Free Due to Lack of Locking in nvidia GeForce Driver

 nvDevice::SetAppSupportBits is external method 0x107 of the nvAccelerator IOService. 

 It calls task_deallocate without locking. Two threads can race calling this external method to drop 
 two task references when only one is held. 

 Note that the repro forks a child which give the nvAccelerator a different task otherwise 
 the repro is more likely to leak task references than panic. 
 */ 

 // ianbeer 

 #if 0 
 MacOS kernel UAF due to lack of locking in nvidia GeForce driver 

 nvDevice::SetAppSupportBits is external method 0x107 of the nvAccelerator IOService. 

 It calls task_deallocate without locking. Two threads can race calling this external method to drop 
 two task references when only one is held. 

 Note that the repro forks a child which give the nvAccelerator a different task otherwise 
 the repro is more likely to leak task references than panic.