Perhaps the kext with the overflow may not necessarily look malicious? It can serve as an actually useful kext and pass review.