A transfer that frees a ledger and then copies the dangling pointer into the destination, turned into tcache poisoning, a forged wallet struct and a GOT overwrite
Reversing a custom key exchange and stream cipher to get on the wire, then a refcounted free that leaves a live pointer, ending in House of Apple on _IO_2_1_stdout_
Escaping a Lua 5.5 bytecode sandbox by writing registers past the end of the stack, hijacking a table array pointer, and swapping global_State.frealloc for system
