Mᴏᴀᴛ: Towards Safe BPF Kernel Extension