Keep PRIV_KMEM_READ permitted inside jails as it is on the outside.
Fix build with gcc. Move sf_buf_alloc()/sf_buf_free() declarations
to MD headers.