File: /sys/kern/kern_sysctl.c 

int
sysctl_handle_string(SYSCTL_HANDLER_ARGS)
{
        int error=0;
        char *tmparg;
        size_t outlen;

        /*
         * Attempt to get a coherent snapshot by copying to a
         * temporary kernel buffer.
         */
retry:
        outlen = strlen((char *)arg1)+1;
        tmparg = malloc(outlen, M_SYSCTLTMP, M_WAITOK);

        if (strlcpy(tmparg, (char *)arg1, outlen) >= outlen) {
                free(tmparg, M_SYSCTLTMP);
                goto retry;
        }

        error = SYSCTL_OUT(req, tmparg, outlen);
        free(tmparg, M_SYSCTLTMP);


When a device detaches strings can be left in freed memory, so 
"sysctl_handle_string" shouldn't try forever. Also the thread updating the 
string can sleep.

Fix: 

Should have a timeout count and something like:

u_int8_t to = 255;

if(to--)
goto retry;
else return EINVAL;