An off-by-one that lands the frame CRC byte on a capacity field, stretching the dump command until it spills the canary and a PIE pointer
A ROP chain limited to three bytes per call, used to speak to a seccomped child process over its socketpair and hand it a negative vault index
