Safe kernel extensions without run-time checking