• Use pending_mutex to synchronize several state flags. In particular, ensure that two threads can't race to open the device file at the same time.[1]
• Fix an off-by-one in hv_kvp_dev_daemon_read() that would result in a one-byte OOB read if the caller supplied a large enough read buffer.[2]
• Change the device permissions to 0600: hv_kvp_dev_daemon_read() returns an error until the owning process registers itself with a write, so there's no sense in providing read-only access.
• Use bool instead of boolean_t.
• Don't return negative error numbers to userspace.
• Call seldrain() when closing the device.

Reported by: pixelpop [1][2]