fwh: SPRAY +60 x 160 bytes (idx 24..83, slab size-class zone, canary tagged) fwh: SPRAYFREE chunk 50 (160 bytes) freed send.pay_len > maxrec Fatal user address access from kernel mode from poc_2296 at ffffffff80c18de2 Fatal trap 12: page fault while in kernel mode cpuid = 2; lapic id = 2 fault virtual address = 0xffff800004800000 fault code = supervisor read data, page not present instruction pointer = 0x8:0xffffffff80c18de2 stack pointer = 0x10:0xfffff80117ce7690 frame pointer = 0x10:0xfffff80117ce76c8 code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, long 0, def32 0, gran 1 processor eflags = interrupt enabled, resume, IOPL = 0 current process = 889 current thread = pri 6 trap number = 12 panic: page fault cpuid = 2 Trace beginning at frame 0xfffff80117ce7488 trap_fatal() at trap_fatal+0x301 0xffffffff80bd5da1