copyout(9) family.
The addresses are user-controllable, and if the process ABI allows
mapping at zero, then the zero address is meaningful, contradicting
the definition of _Nonnull. In any case, it does not require any
special code to handle NULL udaddr.
It is not clear if __restrict makes sense as well, since kaddr and
udaddr point to different address spaces, so equal numeric values of
the pointers do not imply aliasing and a legitimate. But leave it for
later.
copyinstr(9) does not have its user address argument annotated.
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
7e79c3c15f