Kernel Use-After-Free: The Classic Pattern

A "babydev"-style vulnerable char driver (the shape of Lab 7):

• The driver keeps a single global pointer to one heap object, but lets the device be opened twice, sharing that object across two file descriptors.
• close (or a release handler) kfrees the object but does not clear the pointer — a dangling reference survives on the second fd.
• The attacker frees via fd#1, then reuses via fd#2, reading or writing through the stale pointer.
• In the gap, they spray a controllable object of the same size so it lands on top of the freed slot — overlapping attacker data with a security-critical struct.