kernel: add missing cache_hold in isstillinsandbox