is privfree() broken? it appears it chains the slots together, but only the calling process will get a correct chain.
i think the logic in tprivalloc is what was intended.