I'm curious if there's a better way to work around this:
github.com/GrapheneOS/ker
It's a nice demonstration of how CFI gets much stricter with !CONFIG_MODULES due to the compiler being able to much more accurately figure out which functions cannot ever be indirectly called.