Comment by saidnooneever
2 days ago
?? it seems pretty well documented code? sure a bunch refers to internals of what the exploit is touching, that might be tricky to follow but you cant expect comments to go and explain all touched subsystems etc. that documentation is in the software being targeted.... openBSD has really good docs..
Do you really consider "The SHM attachment-counter wrap and detach race publish NEW with a freed UAO." a valid sentence? It has hints of what it does, but is otherwise nearly undecipherable.
Later on, there's "Three additional children compensate for banking 127 rather than 128 records per vmspace and still cross the signed 16-bit boundary." which at first glance appears to be something about bank-switching, but isn't.