How can it be surprising that a software made from 40+ million lines of memory-unsafe code has hundreds of critical bugs?
Funny how OpenBSD is "memory-unsafe" yet doesn't have these issues. Could it be that the programmer might have something to do with it?
More than half of those lines are from drivers, drivers which wouldn't be relevant to a VM environment. Core kernel code for any particular architecture is less than 10 million, but some of that is filesystems or subsystems not in use or available to an unprivileged user on a typical server, so possibly maybe 5 million or less. And the article says they only targeted 2.8 million SLoC.