DF-4026 mmap-vs-resizebuf UAF: pid 953 rounds=3000 bdelay=3
round 0... (rc=-1 mapped=1 size=-1)
round 9: HIT — shrink ok (size now 256), stale 128K mapping held over freed buffer
spraying 16 fresh 128K channels...
sprayed: 15 grown, 14 mmapped
stale baseline: byte 0x62, longest run 1 @0x0
RESULT: HIT (stale mapping over freed block held) but no spray channel reclaimed that exact block
EXIT=2
DF-4026 mmap-vs-resizebuf UAF: pid 954 rounds=3000 bdelay=1
round 0... (rc=-1 mapped=1 size=-1)
round 2: HIT — shrink ok (size now 256), stale 128K mapping held over freed buffer
spraying 16 fresh 128K channels...
sprayed: 15 grown, 14 mmapped
stale baseline: byte 0x53, longest run 1 @0x0
RESULT: HIT (stale mapping over freed block held) but no spray channel reclaimed that exact block
EXIT2=2