Double Free

• A double-free frees the same chunk twice. In an unhardened tcache, the chunk ends up in the free list twice.
• Consequence: two later mallocs return the same address. Now two "different" objects alias the same memory — another route to type confusion and metadata control.
• The tcache key check (glibc 2.29+) catches the naive case: freeing a chunk already marked as cached triggers an abort.
• Attackers bypass this by clearing or corrupting the key, or by cycling the chunk through a different bin first.