Fitting a general DELEGATECALL forwarder into a 36-byte jump-free bytecode whitelist, then abusing a validated arbitrary storage write in a reversed vault
Stacking a Move market-key confusion, a caller-controlled price, and a primitive-type witness to drain an incentive vault on Sui
Chaining an arbitrary file write, a Sage/PPL segfault, and cysignals unsafe gdb auto-load into a CAP_SYS_PTRACE read of a setgid-only flag
