In the macOS kernel, the XNU function
wait_for_namespace_event() in bsd/vfs/vfs_syscalls.c releases a
file descriptor for use by userspace but may then subsequently
destroy that file descriptor using fp_free(), which unconditionally
frees the fileproc and fileglob. This opens up a race window during
which the process could manipulate those objects while they're
being freed. Exploitation requires root privileges.
