Android Kernel LPE Classes, at Invariant Level, Plus a Userspace TOCTOU Lab
Futex, perf_event, and get_user-era Android kernel LPE classes as broken invariants. No kernel exploit code. A toy C file-TOCTOU analog, a planted strcpy, ASAN output.
Kernel
Dirty Pipe Class Analysis for Defenders
Toy splice/pipe lab on a temp file we own, uname -r vs CVE-2022-0847, SIGSEGV on a PROT_READ map — not a setuid hijack.
Linux LKM and Syscall Hooking Concepts for Defenders
Lab LKM that logs openat on a VM, insmod/rmmod, dmesg artifacts — module does not hide files or hook the table for concealment.