>> building harness (buggy): cc -O0  -Wall -o df3460_harness df3460_harness.c
>> built df3460_harness (rc=0)
attach          : iv_rs=0x8004902c0 interval=500
read (alive)    : reader gets 500  (ok)
deinit          : iv_rs freed, pointer now 0x8004902c0 (dangling)
window          : chunk reused by poison obj at 0x8004902c0
read (window)   : unprivileged reader gets 0xdeadbeef from FREED chunk
  -> UAF READ confirmed: reader saw the replacement object's bytes (4-byte kernel-heap info leak)
write (window)  : poison.marker2 (offset 8, = interval) now 0x0000012c (was 0xDEADBEEF)
  -> UAF WRITE confirmed: root sysctl write landed in the replacement object
RESULT: BUG REPRODUCED — sysctl handler dereferences freed iv_rs across vap teardown
rc=0