DF-4013 kernel-pointer leak sample (STEP 5 UAF read, operator uid=2):

  READ uid=0x11111002 len=4096 ok: 4095/4096 nonzero bytes
  +000000: 00 d0 c7 16 01 f8 ff ff | a5 a5 a5 a5 ...

first 8 bytes = 0xfffff80116c7d000 little-endian: the slab allocator's
free-list link written into the chunk after kfree() — a live kernel virtual
address disclosed from freed memory through the verbatim
mps_diag_read_buffer() copyout at mps_user.c:1593-1595.