We drop the keg lock when we go to actually allocate the slab, allowing
other threads to advance the cursor. This can in principle cause us to
exit the round-robin loop before having attempted allocations from all
domains.
Suppose one domain, N, is depleted and its page daemon cannot reclaim
any memory (e.g., because virtually all of the memory in the domain is
wired). Suppose keg_fetch_slab() attempts to allocate from that domain
first, and fails, and that while the keg lock was dropped a different
thread advanced the cursor to N - 1. Upon re-acquiring the keg lock, we
will then set domain = N and retry the loop, resulting in a blocking
allocation which will never return.