IO buffer allocation fix
Commit 2788f039 introduced an RMA memory leak. After more rigorous examination of the problem the commit was trying to address, it was determined that the buffers allocated for some file descriptors in modules (particularly notably stdin) had a lifetime shorter than that of the file descriptors themselves, resulting in memory corruption errors which the commit avoided in most (but possibly not all) situations. This MR presents an alternative fix, which is to allocate such buffers from the RMA instead.
As a separate commit in this MR, I am also making the C library fault any attempts from a privileged processor mode to free a block from the application heap. Had such a check been in place previously, I suspect the buffer lifetime bug would have been detected many years earlier.
This obsoletes !36 (closed) and !37 (closed).