XNU vm_map_copy optimization which requires atomicity is not atomic. This violates the semantics of mach message OOL memory, and leads to TOCTOU issues which can lead to memory corruption.
b373ad17106c25ccfb2435934691e9a515824d6d61c83d2a4930737e86b27e33