static int sysctl_dumpentry(struct radix_node *rn, void *vw) {
  if (w->w_op != NET_RT_DUMP2) {
    int size = rt_msg2(RTM_GET, &info, NULL, w, credp); 
    if (w->w_req != NULL && w->w_tmem != NULL) {
      struct rt_msghdr *rtm =
          (struct rt_msghdr *)(void *)w->w_tmem; // memory not init

      rtm->rtm_flags = rt->rt_flags;
      rtm->rtm_use = rt->rt_use;
      rt_getmetrics(rt, &rtm->rtm_rmx);
      rtm->rtm_index = rt->rt_ifp->if_index;
      rtm->rtm_pid = 0;
      rtm->rtm_seq = 0;
      rtm->rtm_errno = 0;
      rtm->rtm_addrs = info.rti_addrs;
      // rtm->rtm_inits not init
      error = SYSCTL_OUT(w->w_req, (caddr_t)rtm, size); // leak to the userland
    }
  }
}

static int rt_msg2(/* ... */ struct walkarg *w) {
  //...
  // Allocation of `w_tmem` but no initialisation
  rw->w_tmem = _MALLOC(len, M_RTABLE, M_WAITOK); 
  //...
}