vmsplice(): the making of a local root exploit

I agree with everything you said, except...

> you're expected to recognise that (bytes >> 9) converts from a byte count to a sector count

Then why not define BYTES_TO_SECTORS(n) ((n)>>9)?  Putting this bare shift into code
introduces an informal lingo that, as it builds up, can really get in the way for new
maintainers.  True, one instance is no big deal, but trying to get up to speed on code that
has more than five or ten undocumented idioms like this is a real drag.

Even if you understand the lingo, you will likely start to think, "Ah, those are now sectors"
whenever you see >>9 in the code.  That's bad too.