# cycle_oob_unit 5 (root; vmstat -m 'ptys' count taken before/between/after):
               ptys    1002    446K       0    390M     1002   (before)
               ptys    1002    446K       0    390M     1002   (during: 5 OOB cycles)
               ptys    1002    446K       0    390M     1002   (after)
holding 1000 ptys; cycling OOB unit 5 times
cycle 0: ptmx #1001 -> Operation not supported by device(19)
cycle 0: /dev/pts/1000 opened+closed
cycle 1: ptmx #1001 -> Operation not supported by device(19)
cycle 1: /dev/pts/1000 opened+closed
cycle 2: ptmx #1001 -> Operation not supported by device(19)
cycle 2: /dev/pts/1000 opened+closed
cycle 3: ptmx #1001 -> Operation not supported by device(19)
cycle 3: /dev/pts/1000 opened+closed
cycle 4: ptmx #1001 -> Operation not supported by device(19)
cycle 4: /dev/pts/1000 opened+closed
done; exiting (holds released)
# interpretation: M_PTY never grows past 1002 (ptis array + 1001 ptis) =>
# the unit-1000 pti was kmalloc'd ONCE (first OOB read returned NULL) and
# every later cycle reuses it => the ptis[1000] = pti OOB write persisted.