Safe Kernel Extensions Without Run-Time Checking