Allocated vs. Free Chunk Layout

• When a chunk is freed, malloc overwrites the first bytes of the old user data with list pointers (fd/bk).
• Those pointers form the free lists (bins). Controlling them means controlling where malloc allocates next.