SELFFREE: SUMMARY freed=8 reclaimed=8 uaf_running_write=8 uaf_worker_null_write=8
SELFFREE: VERDICT UAF-WRITE REPRODUCED - process_all_work touched the freed work item after func() returned (see linux_workqueue.c:92-98)
SELFFREE: loaded; use sysctl debug.selffree=1
SELFFREE: struct work_struct size=32 worker=16 on_queue=24 running=25 canceled=26; selffree size=96
SELFFREE[0]: freed+reclaimed @0xfffff801172f1880; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[1]: freed+reclaimed @0xfffff801172f18e0; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[2]: freed+reclaimed @0xfffff801172f1940; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[3]: freed+reclaimed @0xfffff801172f19a0; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[4]: freed+reclaimed @0xfffff801172f1a00; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[5]: freed+reclaimed @0xfffff801172f1a60; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[6]: freed+reclaimed @0xfffff801172f1ac0; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE[7]: freed+reclaimed @0xfffff801172f1b20; running byte=00 (poison=41) worker qword=0000000000000000 (poison=4141414141414141)  <== UAF WRITE running=false  <== UAF WRITE worker=NULL
SELFFREE: SUMMARY freed=8 reclaimed=8 uaf_running_write=8 uaf_worker_null_write=8
SELFFREE: VERDICT UAF-WRITE REPRODUCED - process_all_work touched the freed work item after func() returned