osd_get_unlocked() reads an object's slot array without the OSD lock,
which is safe only while nothing else resizes or frees the array. The
callers that use it, such as mac_do reading its slot of curthread, rely
on being the only writer of that object's slots. osd_deregister()
breaks that: it deletes the departing slot from every object through
do_osd_del(), which shrinks an object's array with realloc() when the
slot was its last, and frees it when no other slot is set. A thread
reading another slot of the same array at that moment reads freed
memory.
Have osd_deregister() only run the destructor and clear the slot,
leaving each array to the operations on its own object, as it already
does for the destructor and method arrays since a76629cb0381.
osd_exit() now frees an array that holds only deregistered slots, which
it used to leave to osd_deregister(). osd_get_unlocked() no longer
asserts on osd_destructors, which osd_register() may reallocate;
osd_get() checks it under the lock instead.
Document osd_get_unlocked() and what its callers must guarantee.
Fixes: 56b274213024 ("Add function to OSD to get values without taking the lock.")
Sponsored by: Rubicon Communications, LLC ("Netgate")