_kvm_bitmap_next may perform an out-of-bounds access on bm->map array.
It seems the right is to divide *idx by CHAR_BIT, instead of multiplying it.
Another thing that looks strange to me is the function returning when it finds a bit that is not set. Shouldn't it be the opposite?