MOAT: Towards Safe BPF Kernel Extension