fix include sorting

Trust sc->req in set_epp and add () in KASSERT

Fix typos

Only skimmed over it, but seems good except for one typo.

In D54327#1241511, @imp wrote:

So a few words about why this is useful. Our KBI commitments on 15.x is fuzzy at best. What does this enable?

Don't have time to review this in detail, but overall you have my blessing as well. :-)

I'd put all new functions of sys/security/mac/mac_syscalls.c into sys/security/mac/mac_prison.c instead, as these are not really system calls, and export mac_label_copyin_string() from the former.

So a few words about why this is useful. Our KBI commitments on 15.x is fuzzy at best. What does this enable?

.

g_io_request will empty bio_error_compat as well.

There is an alloc/free mismatch, see inline comment. Else seems good.

In D53954#1239740, @kevans wrote:

Ok, thanks- to be clear, I'm still not against the idea of providing an abstraction layer to avoid some future headache for MAC modules when the core implementation changes. Did you have some sketch of what you're thinking in the area, by chance?

There's a compile error (missing parenthesis, see inline comment).

Feels much better like that. I have one more inline comment for a change in sysctl_epp_select_per_core(). With that, you can consider the changes reviewed!