df2132_user: mode c (pid 964 uid 65534)
usched_set(cpu 0) failed rc=-1 (continuing; reclaim may be nondeterministic)
export      : dmabuf fd=4 fp=0xfffff80116daf700 (f_count=2: falloc-ref + fd-table-ref)
import       fd= 4 fcount 3->2 rel=0 slot_valid=0 slot_is_saved=0 fp=0x0 (saved 0x0)
import       fd= 4 fcount 2->1 rel=0 slot_valid=0 slot_is_saved=0 fp=0x0 (saved 0x0)
import       fd= 4 fcount 1->0 rel=0 slot_valid=0 slot_is_saved=0 fp=0x0 (saved 0x0)
info         fd= 4 fcount 0->0 rel=1 slot_valid=1 slot_is_saved=1 fp=0x0 (saved 0xfffff80116daf700)
PREMATURE FREE CONFIRMED (freed fp 0xfffff80116daf700, dangling fd 4)
phase-1: dummy file fd=952 REOCCUPIED the freed chunk after ~960 allocations
phase-2: /dev/null fd=952 LANDED ON the freed chunk (fp=0xfffff80116daf700)
read(dangling fd=4) = 0  <== UAF read through freed-then-reclaimed struct file
closing aliased fd 952 (silent steal: frees object while dangling fd still references it)
mode c: parking 300s with dangling fd 4 held open (exit would close it and panic)