== DF-5327 stage B (vulnerable EVIL kernel, magazine-churn rig attempt) == [child1] open#1 done, fd OPEN, refcount=0 (*** 0: free-on-invalidate armed ***) [parent] pre-invalidate refcount=0 (fd open) [parent] invalidate done with the descriptor still open [parent] postmortem(freed): periph 0xfffff8008d640840 size=144 refcnt_off=88: 00000000 00000000 ffffffff 00000000 802c6e40 ffffffff 802c6b20 ffffffff 802c6f30 ffffffff 80c3ca44 ffffffff 8d6c11e0 fffff800 8fa6bc00 fffff800 | fake_built=0 uaf_hits=0 fakeref@hit=00000000 premortem_refcnt=00000000 [parent] postmortem(regroomed): periph 0xfffff8008d640840 size=144 ... (identical: chunk parked in full zalloc magazine, not yet recycled) [child1] close on (freed) periph: refcount=-1 [parent] done EXIT=0 (ch0:evilcd0:0:1:0): removing device entry [EVILCD] sprayfake: chunk 0xfffff8008d640840 NOT reused