(alias+write proof session, stock sound.ko, 2026-09-17 16:0x UTC — verbatim)
BUILD_OK
DF-4026 mmap-vs-resizebuf UAF: pid 1161 attempts=3000
round 0: HIT — shrink ok (size now 256), stale 128K mapping held over freed kernel buffer
stale baseline byte: 0x53
READ-after-free (alias): spray channel 0's live kernel buffer == stale mapping
WRITE-after-free: 0xDF marker via stale mapping visible in victim's live kernel buffer
RESULT: UAF READ+WRITE over freed M_DEVBUF kernel heap CONFIRMED (alias proof)
EXIT=0