Mac OS / iOS kernels suffer from a use-after-free due to a failure to take reference in IOService::matchPassive. Continue reading...