--- xnu/xnu-12377.101.15/iokit/Kernel/IOStatistics.cpp
+++ xnu/xnu-7195.141.2/iokit/Kernel/IOStatistics.cpp
@@ -204,7 +204,7 @@
 		return;
 	}
 
-	nextWorkLoopDependency = kalloc_type(IOWorkLoopDependency, Z_WAITOK);
+	nextWorkLoopDependency = (IOWorkLoopDependency*)kalloc(sizeof(IOWorkLoopDependency));
 	if (!nextWorkLoopDependency) {
 		return;
 	}
@@ -226,10 +226,12 @@
 	LOG(1, "IOStatistics::onKextLoad: %s, tag %d, address 0x%llx, address end 0x%llx\n",
 	    kext->getIdentifierCString(), kmod_info->id, (uint64_t)kmod_info->address, (uint64_t)(kmod_info->address + kmod_info->size));
 
-	ke = kalloc_type(KextNode, (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
+	ke = (KextNode *)kalloc(sizeof(KextNode));
 	if (!ke) {
 		return;
 	}
+
+	memset(ke, 0, sizeof(KextNode));
 
 	ke->kext = kext;
 	ke->loadTag = kmod_info->id;
@@ -281,7 +283,7 @@
 		/* Free up the user client list */
 		while ((uce = TAILQ_FIRST(&found->userClientCallList))) {
 			TAILQ_REMOVE(&found->userClientCallList, uce, link);
-			kfree_type(IOUserClientProcessEntry, uce);
+			kfree(uce, sizeof(IOUserClientProcessEntry));
 		}
 
 		/* Remove from kext trees */
@@ -297,7 +299,7 @@
 		}
 
 		/* Finally, free the class node */
-		kfree_type(KextNode, found);
+		kfree(found, sizeof(KextNode));
 
 		sequenceID++;
 		loadedKexts--;
@@ -322,10 +324,12 @@
 
 	LOG(1, "IOStatistics::onClassAdded: %s\n", metaClass->getClassName());
 
-	ce = kalloc_type(ClassNode, (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
+	ce = (ClassNode *)kalloc(sizeof(ClassNode));
 	if (!ce) {
 		return;
 	}
+
+	memset(ce, 0, sizeof(ClassNode));
 
 	IORWLockWrite(lock);
 
@@ -396,13 +400,13 @@
 		/* Free up the list of counters */
 		while ((esc = SLIST_FIRST(&found->counterList))) {
 			SLIST_REMOVE_HEAD(&found->counterList, link);
-			kfree_type(IOEventSourceCounter, esc);
+			kfree(esc, sizeof(IOEventSourceCounter));
 		}
 
 		/* Free up the user client list */
 		while ((ucc = SLIST_FIRST(&found->userClientList))) {
 			SLIST_REMOVE_HEAD(&found->userClientList, link);
-			kfree_type(IOUserClientCounter, ucc);
+			kfree(ucc, sizeof(IOUserClientCounter));
 		}
 
 		/* Remove from class tree */
@@ -412,7 +416,7 @@
 		SLIST_REMOVE(&found->parentKext->classList, found, ClassNode, lLink);
 
 		/* Finally, free the class node */
-		kfree_type(ClassNode, found);
+		kfree(found, sizeof(ClassNode));
 
 		sequenceID++;
 		registeredClasses--;
@@ -436,10 +440,12 @@
 		return NULL;
 	}
 
-	counter = kalloc_type(IOEventSourceCounter, (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
+	counter = (IOEventSourceCounter*)kalloc(sizeof(IOEventSourceCounter));
 	if (!counter) {
 		return NULL;
 	}
+
+	memset(counter, 0, sizeof(IOEventSourceCounter));
 
 	IORWLockWrite(lock);
 
@@ -482,7 +488,7 @@
 		SLIST_REMOVE(&counter->parentClass->counterList, counter, IOEventSourceCounter, link);
 		registeredCounters--;
 	}
-	kfree_type(IOEventSourceCounter, counter);
+	kfree(counter, sizeof(IOEventSourceCounter));
 
 	IORWLockUnlock(lock);
 }
@@ -499,10 +505,12 @@
 		return NULL;
 	}
 
-	counter = kalloc_type(IOWorkLoopCounter, (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
+	counter = (IOWorkLoopCounter*)kalloc(sizeof(IOWorkLoopCounter));
 	if (!counter) {
 		return NULL;
 	}
+
+	memset(counter, 0, sizeof(IOWorkLoopCounter));
 
 	found = getKextNodeFromBacktrace(TRUE);
 	if (!found) {
@@ -531,7 +539,7 @@
 	if (counter->parentKext) {
 		SLIST_REMOVE(&counter->parentKext->workLoopList, counter, IOWorkLoopCounter, link);
 	}
-	kfree_type(IOWorkLoopCounter, counter);
+	kfree(counter, sizeof(IOWorkLoopCounter));
 	registeredWorkloops--;
 
 	IORWLockUnlock(lock);
@@ -549,10 +557,12 @@
 		return NULL;
 	}
 
-	counter = kalloc_type(IOUserClientCounter, (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
+	counter = (IOUserClientCounter*)kalloc(sizeof(IOUserClientCounter));
 	if (!counter) {
 		return NULL;
 	}
+
+	memset(counter, 0, sizeof(IOUserClientCounter));
 
 	IORWLockWrite(lock);
 
@@ -581,7 +591,7 @@
 	IORWLockWrite(lock);
 
 	SLIST_REMOVE(&counter->parentClass->userClientList, counter, IOUserClientCounter, link);
-	kfree_type(IOUserClientCounter, counter);
+	kfree(counter, sizeof(IOUserClientCounter));
 
 	IORWLockUnlock(lock);
 }
@@ -605,7 +615,7 @@
 	/* Track the kext dependency */
 	nextWorkLoopDependency->loadTag = esc->parentClass->parentKext->loadTag;
 	if (NULL == RB_INSERT(IOWorkLoopCounter::DependencyTree, &wlc->dependencyHead, nextWorkLoopDependency)) {
-		nextWorkLoopDependency = kalloc_type(IOWorkLoopDependency, Z_WAITOK);
+		nextWorkLoopDependency = (IOWorkLoopDependency*)kalloc(sizeof(IOWorkLoopDependency));
 	}
 
 	IORWLockUnlock(lock);
@@ -630,7 +640,7 @@
 	found = RB_FIND(IOWorkLoopCounter::DependencyTree, &wlc->dependencyHead, &sought);
 	if (found) {
 		RB_REMOVE(IOWorkLoopCounter::DependencyTree, &wlc->dependencyHead, found);
-		kfree_type(IOWorkLoopDependency, found);
+		kfree(found, sizeof(IOWorkLoopDependency));
 	}
 
 	IORWLockUnlock(lock);
@@ -670,7 +680,8 @@
 		goto exit;
 	}
 
-	buffer = (char*)kalloc_data(calculatedSize, (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
+	buffer = (char*)kheap_alloc(KHEAP_TEMP, calculatedSize,
+	    (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
 	if (!buffer) {
 		error = ENOMEM;
 		goto exit;
@@ -729,7 +740,7 @@
 
 	error = SYSCTL_OUT(req, buffer, calculatedSize);
 
-	kfree_data(buffer, calculatedSize);
+	kheap_free(KHEAP_TEMP, buffer, calculatedSize);
 
 exit:
 	IORWLockUnlock(IOStatistics::lock);
@@ -764,7 +775,8 @@
 		goto exit;
 	}
 
-	buffer = (char*)kalloc_data(calculatedSize, (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
+	buffer = (char*)kheap_alloc(KHEAP_TEMP, calculatedSize,
+	    (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
 	if (!buffer) {
 		error = ENOMEM;
 		goto exit;
@@ -786,7 +798,7 @@
 
 	error = SYSCTL_OUT(req, buffer, size);
 
-	kfree_data(buffer, calculatedSize);
+	kheap_free(KHEAP_TEMP, buffer, calculatedSize);
 
 exit:
 	IORWLockUnlock(IOStatistics::lock);
@@ -829,7 +841,8 @@
 
 	LOG(2, "IOStatistics::getUserClientStatistics - requesting kext w/load tag: %d\n", requestedLoadTag);
 
-	buffer = (char*)kalloc_data(calculatedSize, (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
+	buffer = (char*)kheap_alloc(KHEAP_TEMP, calculatedSize,
+	    (zalloc_flags_t)(Z_WAITOK | Z_ZERO));
 	if (!buffer) {
 		error = ENOMEM;
 		goto exit;
@@ -853,7 +866,7 @@
 		error = EINVAL;
 	}
 
-	kfree_data(buffer, calculatedSize);
+	kheap_free(KHEAP_TEMP, buffer, calculatedSize);
 
 exit:
 	IORWLockUnlock(IOStatistics::lock);
@@ -1179,9 +1192,10 @@
 			TAILQ_REMOVE(&parentKext->userClientCallList, entry, link);
 		} else {
 			/* Otherwise, allocate a new entry */
-			entry = kalloc_type(IOUserClientProcessEntry, Z_WAITOK);
+			entry = (IOUserClientProcessEntry*)kalloc(sizeof(IOUserClientProcessEntry));
 			if (!entry) {
-				goto err_unlock;
+				IORWLockUnlock(lock);
+				return;
 			}
 		}
 
@@ -1246,7 +1260,7 @@
 	 * overhead. OSBacktrace does many safety checks that
 	 * are not needed in this situation.
 	 */
-	btCount = backtrace((uintptr_t*)bt, btCount, NULL, NULL);
+	btCount = backtrace((uintptr_t*)bt, btCount, NULL);
 
 	if (write) {
 		IORWLockWrite(lock);