target=/tmp/fliptarget (unpriv, loops exec of setuid-root /tmp/flip which drops back)
tracer: unpriv ktrace(2) hammer:
[!!] ATTACH GRANTED while target euid=0 ruid=1001 - ktrcanset raced the cred swap!   (x8 events)
[*] attempts=4633 attaches_ok=1813 ok_while_root=8 root_phase_samples=2822
NOTE: target spends ~61% of wall time at euid=0; post-attach euid sampling cannot
distinguish a genuine stale-cred check from a cred transition between the check and
the sample.  No persistent privileged-phase tracing demonstrated -> inconclusive.