Robert Johnson David Wagner Finding User/Kernel Pointer Bugs with Type Inference. 119-134 2004 conf/uss/2004 USENIX Security Symposium http://www.usenix.org/publications/library/proceedings/sec04/tech/johnson.html db/conf/uss/uss2004.html#JohnsonW04