DF2567[vuln]: smb_rq_done freed rqp; slot reoccupied with sr_flags=0x10; epilogue read rqp->sr_flags -> 0x10
DF2567: occupier==rqp? YES (same slot) ; RESULT=UAF READ: the restart decision was driven by bytes written to the freed slot AFTER the free
DF2567[ctl]: flags read before free -> 0x0
DF2567[fixed]: flags stashed before free -> 0x0