C++ would also make it harder to get it wrong. Its type system is powerful enough to enforce rules like "you must call access_ok before writing through a pointe

C++ would also make it harder to get it wrong. Its type system is powerful enough to enforce rules like "you must call access_ok before writing through a pointer": you just have access_ok transform an inaccessible pointer token of some sort, passed in as a syscall parameter, into a different kind of object through which you can write into memory. The generated machine code would be identical to what's in the kernel today, but it'd be both safer and cleaner. C++ still has to get over the bad gang-of-four-1990s-era-object-goo reputation it has among systems people.