The current code has a placeholder code to export credentials and replies on clients properly calling a function to release credentials. Otherwise they are leaked within the process.

This needs to be changed to a ring buffer where we keep track of credentials in a FIFO fashion.
This way if clients neglect to free them we eventually get to forcefully free them when they fall off the ring. This is especially important when the kernel is the client, because it may drop a connection at any time due to timeouts and in general the kernel does not want to be bothered keeping track of this.

The API should be built so that we can easily keep around multiple rings. We want to be able to have classes of programs (eg trusted vs untrusted) use different rings so that a less trusted app cannot try to DoS the kernel (trusted) by causing a common ring buffer to quickly rotate out stuff.