# DF-0246 PoC — eventhandler dispatch UAF

## Build
```
cc -o eh_uaf eh_uaf.c
```

## Run
```
./eh_uaf
```

## Expected
Code-path confirmation harness documenting the tokenless traverse in
EVENTHANDLER_INVOKE vs tokened deregister. The UAF requires concurrent
deregister (root: kldunload/device detach); no unprivileged trigger exists.