fix: kext: sysfs_vfsops: stop advertising MNT_RDONLY

Mounting sysfs put coreservicesd into a crash loop, which is the real
cause of the long-standing "system gradually stops responding" symptom:
typing stalls, applications refusing to launch, an unresponsive Dock,
and eventually nothing opening at all.

CoreServices aborts while registering the mount in its volume universe:

    _CSAbortWithMessage <- FSNode_VolumeMounted
                        <- FSNodeServer_SyncSystemUniverseInternal
                        <- FileIDTreeServerGetVRefNumForDeviceInternal

coreservicesd relaunches, re-syncs, hits the mount again and re-aborts,
taking Launch Services down with it. loginwindow's black screen at login
is the same abort reached earlier in boot, so mounting after login only
moved the symptom.

None of this was visible from the kernel side, which is why it resisted
diagnosis for so long: the abort is in userspace, provoked by the mount
merely existing. A full system spindump taken while /sys was mounted
contained zero sysfs frames, and the vnop/vfs counters stayed flat across
hangs. With /sys unmounted, no new coreservicesd crash reports appear.

MNT_RDONLY is isolated as the offender by the two synthetic filesystems
that never trigger the abort: procfs mounts MNT_LOCAL without it, devfs
mounts MNT_LOCAL|MNT_DONTBROWSE without it. MNT_DONTBROWSE is kept - it
is safe, and it is still needed to keep Spotlight from indexing the live
IORegistry tree under /sys/devices.

Read-only behaviour is unchanged. This filesystem registers no write,
create, mkdir or setattr vnop, so every mutating operation already falls
through to sysfs_vnop_default() and returns ENOTSUP; MNT_RDONLY only
asked VFS to reject those same operations one layer earlier.

Author: somestupidgirl

kext/sysfs_vfsops.c

@@ -165,10 +165,35 @@ sysfs_mount(struct mount *mp, __unused vnode_t devvp, user_addr_t data, __unused
 
         /*
          * Install sysfs-specific flags and augment the generic mount flags.
-         * sysfs is a read-only synthetic view (as Linux /sys's root is) - it has
-         * no writable nodes yet, so MNT_RDONLY is appropriate. It is revisited
-         * when writable attributes arrive (the VFS layer rejects writes on a
-         * read-only mount before they can reach vnop_write).
+         *
+         * NOT MNT_RDONLY, deliberately. Advertising a read-only *synthetic local*
+         * volume makes CoreServices abort while registering the mount:
+         *
+         *     _CSAbortWithMessage <- FSNode_VolumeMounted
+         *                         <- FSNodeServer_SyncSystemUniverseInternal
+         *                         <- FileIDTreeServerGetVRefNumForDeviceInternal
+         *
+         * coreservicesd then relaunches, re-syncs its volume universe, hits the
+         * mount again and re-aborts - a crash loop that takes Launch Services
+         * down with it. That is the true cause of the long-standing "system
+         * gradually stops responding" symptom (typing stalls, apps refusing to
+         * launch, an unresponsive Dock) and of loginwindow's black screen at
+         * login, which is the same abort reached earlier in boot. None of it is
+         * visible from the kernel side: the abort is in userspace, provoked by
+         * the mount merely existing, so a full system spindump taken while /sys
+         * was mounted contained zero sysfs frames.
+         *
+         * The flag bought nothing. This filesystem registers no write, create,
+         * mkdir or setattr vnop, so every mutating operation already falls
+         * through to sysfs_vnop_default() and returns ENOTSUP; MNT_RDONLY only
+         * asked VFS to reject those same operations one layer earlier. Read-only
+         * behaviour is unchanged by its removal.
+         *
+         * The two synthetic filesystems that do not trigger the abort bracket
+         * the flag set and isolate MNT_RDONLY as the offender: procfs mounts
+         * MNT_LOCAL without it, and devfs mounts MNT_LOCAL|MNT_DONTBROWSE
+         * without it. MNT_DONTBROWSE is therefore kept - it is safe, and it is
+         * needed for the reason below.
          *
          * MNT_DONTBROWSE is essential, not cosmetic: without it the volume is
          * presented as a browsable local disk, so Finder/DiskArbitration and -
@@ -181,7 +206,7 @@ sysfs_mount(struct mount *mp, __unused vnode_t devvp, user_addr_t data, __unused
          * /proc and /sys are never indexed. (The procfs sibling gets away without
          * it only because /proc is shallow and cheap to walk.)
          */
-        vfs_setflags(mp, MNT_RDONLY|MNT_NOSUID|MNT_NOEXEC|MNT_NODEV|MNT_NOATIME|MNT_LOCAL|MNT_DONTBROWSE);
+        vfs_setflags(mp, MNT_NOSUID|MNT_NOEXEC|MNT_NODEV|MNT_NOATIME|MNT_LOCAL|MNT_DONTBROWSE);
 
         /*
          * Increment the mounted instance count so that each mount of the file system

kext/sysfs_vnops.c

@@ -176,8 +176,11 @@ int64_t sysfs_stat_vnops = 0;
  * registered as a file system and a pointer to that vector is stored in
  * sysfs_vnodeop_p.
  *
- * The file system is read-only (the mount is MNT_RDONLY), so there is no write /
- * setattr entry; those arrive with the first writable attribute.
+ * The file system is read-only, so there is no write / setattr entry; those
+ * arrive with the first writable attribute. Read-only-ness is enforced here
+ * rather than by the mount: every mutating vnop is absent from this table and
+ * so lands in sysfs_vnop_default(), which returns ENOTSUP. The mount is
+ * deliberately not MNT_RDONLY - see the flag discussion in sysfs_vfsops.c.
  */
 struct vnodeopv_entry_desc sysfs_vnodeop_entries[] = {
     { .opve_op = &vnop_default_desc,            .opve_impl = (VOPFUNC) sysfs_vnop_default },            /* default */