as an aside we should really add memset_explicit to libc and libkern

You made me have a look; grep -r HAVE_EXPLICIT_BZERO seems to be a pattern which reveals a few more implementations in the tree; we should probably make sure if we migrate this into more general code to make sure we set the appropriate #defines for the various kernel code bits to switch to the one common implementation then; I'll leave it for someone who can better drive this at this point.