A one-bit Postgres oracle with stacked queries, an input lowercaser that silently folds payload literals, and a pg_read_file grant that pg_has_role denies
A hand-rolled printf with an undocumented %w specifier that writes one vararg to the address in another, turned into a GOT overwrite on strcspn
A flag scattered into dead stack as thirteen chunks, read back four bytes at a time through an uninitialised int that a failed parse never writes
