Several places in arch/i386/kernel were still un-annotated - they didn't
trip copy_.._user(), so they stayed alive.  Caught and killed.

That's not all - there's a big cluster of them in vm86.c, but I haven't
looked into that code yet.