Summary

_free_safe_mem derives tail=user_mem+hdr->alloc_sz (safe_mem.c:117) and mem-=hdr->alloc_sz (:118) BEFORE checking alloc_sz!=0 (double-free at :125) or SAFEMEM signatures (:132-133). If header corrupted by neighbouring overflow hdr->alloc_sz may be attacker-influenced tail wild pointer subsequent memcmp(tail->sig) at :133 performs 8-byte OOB read. Double-free check at :125 fires AFTER alloc_sz already used twice. Userland original sidesteps by computing tail from mem+hdr->alloc_sz-sizeof(*tail). Proper fix: validate signature first derive tail from hdr->tail cached pointer not recomputation from possibly-corrupted size field. Requires pre-existing heap overflow into safe_mem header (from DF-2156 size-math bug or other adjacent corruption). Given precondition attacker scribbles controlled 8-byte value into hdr->alloc_sz converts next free_testcase_mem into arbitrary 8-byte kernel read (memcmp at :133) = KASLR defeat / leak adjacent heap objects. Root/testcase-module gated.