--- xnu/xnu-12377.101.15/iokit/Kernel/IOHistogramReporter.cpp
+++ xnu/xnu-6153.141.1/iokit/Kernel/IOHistogramReporter.cpp
@@ -26,14 +26,11 @@
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 
-#define IOKIT_ENABLE_SHARED_PTR
-
 #define __STDC_LIMIT_MACROS     // what are the C++ equivalents?
 #include <stdint.h>
 
 #include <IOKit/IOKernelReportStructs.h>
 #include <IOKit/IOKernelReporters.h>
-#include <os/overflow.h>
 #include "IOReporterDefs.h"
 
 
@@ -41,7 +38,7 @@
 OSDefineMetaClassAndStructors(IOHistogramReporter, IOReporter);
 
 /* static */
-OSSharedPtr<IOHistogramReporter>
+IOHistogramReporter*
 IOHistogramReporter::with(IOService *reportingService,
     IOReportCategories categories,
     uint64_t channelID,
@@ -50,8 +47,9 @@
     int nSegments,
     IOHistogramSegmentConfig *config)
 {
-	OSSharedPtr<IOHistogramReporter> reporter = OSMakeShared<IOHistogramReporter>();
-	OSSharedPtr<const OSSymbol> tmpChannelName;
+	IOHistogramReporter *reporter = new IOHistogramReporter;
+
+	const OSSymbol *tmpChannelName = NULL;
 
 	if (reporter) {
 		if (channelName) {
@@ -59,13 +57,15 @@
 		}
 
 		if (reporter->initWith(reportingService, categories,
-		    channelID, tmpChannelName.get(),
+		    channelID, tmpChannelName,
 		    unit, nSegments, config)) {
 			return reporter;
 		}
 	}
-
-	return nullptr;
+	OSSafeReleaseNULL(reporter);
+	OSSafeReleaseNULL(tmpChannelName);
+
+	return NULL;
 }
 
 
@@ -121,7 +121,7 @@
 
 	PREFL_MEMOP_FAIL(_segmentCount, IOHistogramSegmentConfig);
 	configSize = (size_t)_segmentCount * sizeof(IOHistogramSegmentConfig);
-	_histogramSegmentsConfig = (IOHistogramSegmentConfig*)IOMallocData(configSize);
+	_histogramSegmentsConfig = (IOHistogramSegmentConfig*)IOMalloc(configSize);
 	if (!_histogramSegmentsConfig) {
 		goto finish;
 	}
@@ -156,18 +156,20 @@
 	// Allocate memory for the array of report elements
 	PREFL_MEMOP_FAIL(_nElements, IOReportElement);
 	elementsSize = (size_t)_nElements * sizeof(IOReportElement);
-	_elements = (IOReportElement *)IOMallocZeroData(elementsSize);
+	_elements = (IOReportElement *)IOMalloc(elementsSize);
 	if (!_elements) {
 		goto finish;
 	}
+	memset(_elements, 0, elementsSize);
 
 	// Allocate memory for the array of element watch count
 	PREFL_MEMOP_FAIL(_nElements, int);
 	eCountsSize = (size_t)_nChannels * sizeof(int);
-	_enableCounts = (int *)IOMallocZeroData(eCountsSize);
+	_enableCounts = (int *)IOMalloc(eCountsSize);
 	if (!_enableCounts) {
 		goto finish;
 	}
+	memset(_enableCounts, 0, eCountsSize);
 
 	lockReporter();
 	for (cnt2 = 0; cnt2 < _channelDimension; cnt2++) {
@@ -190,7 +192,7 @@
 
 		// Setup IOReporter's channel type
 		_elements[cnt2].channel_type = _channelType;
-		_elements[cnt2].channel_type.element_idx = ((int16_t) cnt2);
+		_elements[cnt2].channel_type.element_idx = cnt2;
 
 		//IOREPORTER_DEBUG_ELEMENT(cnt2);
 	}
@@ -199,10 +201,11 @@
 	// Allocate memory for the bucket upper bounds
 	PREFL_MEMOP_FAIL(_nElements, uint64_t);
 	boundsSize = (size_t)_nElements * sizeof(uint64_t);
-	_bucketBounds = (int64_t*)IOMallocZeroData(boundsSize);
+	_bucketBounds = (int64_t*)IOMalloc(boundsSize);
 	if (!_bucketBounds) {
 		goto finish;
 	}
+	memset(_bucketBounds, 0, boundsSize);
 	_bucketCount = _nElements;
 
 	for (cnt = 0; cnt < _segmentCount; cnt++) {
@@ -218,6 +221,7 @@
 			}
 
 			if (_histogramSegmentsConfig[cnt].scale_flag) {
+				// FIXME: Could use pow() but not sure how to include math.h
 				int64_t power = 1;
 				int exponent = cnt2 + 1;
 				while (exponent) {
@@ -257,11 +261,11 @@
 {
 	if (_bucketBounds) {
 		PREFL_MEMOP_PANIC(_nElements, int64_t);
-		IOFreeData(_bucketBounds, (size_t)_nElements * sizeof(int64_t));
+		IOFree(_bucketBounds, (size_t)_nElements * sizeof(int64_t));
 	}
 	if (_histogramSegmentsConfig) {
 		PREFL_MEMOP_PANIC(_segmentCount, IOHistogramSegmentConfig);
-		IOFreeData(_histogramSegmentsConfig,
+		IOFree(_histogramSegmentsConfig,
 		    (size_t)_segmentCount * sizeof(IOHistogramSegmentConfig));
 	}
 
@@ -269,16 +273,16 @@
 }
 
 
-OSSharedPtr<IOReportLegendEntry>
+IOReportLegendEntry*
 IOHistogramReporter::handleCreateLegend(void)
 {
-	OSSharedPtr<IOReportLegendEntry>        legendEntry;
-	OSSharedPtr<OSData>                     tmpConfigData;
-	OSDictionary                            *tmpDict;   // no refcount
+	IOReportLegendEntry     *rval = NULL, *legendEntry = NULL;
+	OSData                  *tmpConfigData = NULL;
+	OSDictionary            *tmpDict;   // no refcount
 
 	legendEntry = super::handleCreateLegend();
 	if (!legendEntry) {
-		return nullptr;
+		goto finish;
 	}
 
 	PREFL_MEMOP_PANIC(_segmentCount, IOHistogramSegmentConfig);
@@ -286,18 +290,29 @@
 	    (unsigned)_segmentCount *
 	    sizeof(IOHistogramSegmentConfig));
 	if (!tmpConfigData) {
-		return nullptr;
+		goto finish;
 	}
 
 	tmpDict = OSDynamicCast(OSDictionary,
 	    legendEntry->getObject(kIOReportLegendInfoKey));
 	if (!tmpDict) {
-		return nullptr;
-	}
-
-	tmpDict->setObject(kIOReportLegendConfigKey, tmpConfigData.get());
-
-	return legendEntry;
+		goto finish;
+	}
+
+	tmpDict->setObject(kIOReportLegendConfigKey, tmpConfigData);
+
+	// success
+	rval = legendEntry;
+
+finish:
+	if (tmpConfigData) {
+		tmpConfigData->release();
+	}
+	if (!rval && legendEntry) {
+		legendEntry->release();
+	}
+
+	return rval;
 }
 
 IOReturn
@@ -332,7 +347,6 @@
 {
 	int result = -1;
 	int cnt = 0, element_index = 0;
-	int64_t sum = 0;
 	IOHistogramReportValues hist_values;
 
 	lockReporter();
@@ -362,11 +376,7 @@
 	} else if (value > hist_values.bucket_max) {
 		hist_values.bucket_max = value;
 	}
-	if (os_add_overflow(hist_values.bucket_sum, value, &sum)) {
-		hist_values.bucket_sum = INT64_MAX;
-	} else {
-		hist_values.bucket_sum = sum;
-	}
+	hist_values.bucket_sum += value;
 	hist_values.bucket_hits++;
 
 	if (setElementValues(element_index, (IOReportElementValues *)&hist_values)
@@ -381,51 +391,3 @@
 	unlockReporter();
 	return result;
 }
-
-/* static */ OSPtr<IOReportLegendEntry>
-IOHistogramReporter::createLegend(uint64_t channelID,
-    const char *channelName,
-    int segmentCount,
-    IOHistogramSegmentConfig *config,
-    IOReportCategories categories,
-    IOReportUnit unit)
-{
-	OSSharedPtr<IOReportLegendEntry>        legendEntry;
-	OSSharedPtr<OSData>                     tmpConfigData;
-	OSDictionary                            *tmpDict;   // no refcount
-	int                                                                     cnt;
-
-	IOReportChannelType channelType = {
-		.categories = categories,
-		.report_format = kIOReportFormatHistogram,
-		.nelements = 0,
-		.element_idx = 0
-	};
-
-	for (cnt = 0; cnt < segmentCount; cnt++) {
-		channelType.nelements += config[cnt].segment_bucket_count;
-	}
-
-	legendEntry = IOReporter::legendWith(&channelID, &channelName, 1, channelType, unit);
-	if (!legendEntry) {
-		return nullptr;
-	}
-
-	PREFL_MEMOP_PANIC(segmentCount, IOHistogramSegmentConfig);
-	tmpConfigData = OSData::withBytes(config,
-	    (unsigned)segmentCount *
-	    sizeof(IOHistogramSegmentConfig));
-	if (!tmpConfigData) {
-		return nullptr;
-	}
-
-	tmpDict = OSDynamicCast(OSDictionary,
-	    legendEntry->getObject(kIOReportLegendInfoKey));
-	if (!tmpDict) {
-		return nullptr;
-	}
-
-	tmpDict->setObject(kIOReportLegendConfigKey, tmpConfigData.get());
-
-	return legendEntry;
-}