A story of three kernel vulnerabilities

There is far far far more than that when it comes to complex interfaces. Aside from the arbitrariness of ioctl there is bpf and GPU command validation as well as iptables and who knows what else that is passing complex data structures into the kernel.