Good Victim Objects

Attackers pick a replacement object whose contents give a useful

primitive when overlapped with the freed slot:

• 0: contains a pointer to a tty_operations table full of function pointers — a ready-made control-flow hijack when the driver later calls one.
• 0: overwrite uid/gid fields to 0 directly — a pure data-only escalation, no code execution required.
• 0 / 1 / msg objects: common spray targets that yield read, write, or call primitives.
• Choice depends on the bug's primitive (read vs write vs call) and on the object's size class matching the freed slot.