I am surprised formal verification efforts of the Linux kernel didn’t find this. Any experts care to chime in?