Most v4 hook bugs are self-inflicted, and Trail of Bits catalogs the usual callback/auth/accounting footguns from audits and exploits.