# DF-2687 round 2 — alias probes (guest snapshot #1, 2026-10-16)
# The finding's proposed escalation route ("recycled-session hijack": a new
# setsid() session lands on the freed chunk and the orphan aliases it,
# ctty hijack / cross-session TIOCSPGRP / TIOCGSID oracle).  Under the pin
# model this can never happen: the chunk is not free while the orphan is
# held, and after the close the t_session is already NULLed.

$ /tmp/df2687x alias 5   (as maxx, run twice)
ALIAS: 0/128 candidates aliased the orphan
ALIAS: orphan closed rc=0 errno=0
ALIAS_RC=0
ALIAS: 0/128 candidates aliased the orphan
ALIAS: orphan closed rc=0 errno=0

# RESULT: 0/256 candidates aliased.  No candidate session ever observed
# the orphan as its controlling terminal (TIOCGSID never matched), which
# is exactly what the pin model predicts and what the round-1 pack's own
# run.log also showed (no "ALIAS CONFIRMED" line in its 40-round
# transcript).  The recycled-session-hijack route is structurally closed
# on stock configuration.