.
├── container
│   ├── container.md  # Container escape ideas
│   ├── expenv  # Container environment
│   │   ├── bin
│   │   │   ├── gscontainer
│   │   │   └── share
│   │   ├── Dockerfile
│   │   ├── run.sh
│   │   └── src
│   │       ├── gscontainer.c
│   │       └── share.c
│   ├── images
│   │   ├── container.png
│   │   ├── getshell.png
│   │   ├── host.png
│   │   ├── payload.png
│   │   └── share.png
│   ├── recode.bin  # Single-stage shellcode
│   └── stager
│       ├── shell.elf  # Staged shellcode embedded in the exploit
│       ├── stager1.bin
│       ├── stager2.bin
│       ├── stager3.bin
│       └── stager4.bin
├── doc
│   ├── cve-2026-31431.md  # xint.io analysis summary
│   └── shellcode.md  # Introduction to what shellcode is
├── exp.py # curl http://copy.fail/exp -o exp.py
├── README.md
├── success
│   ├── code.py  # Shellcode extracted from exp.py
│   └── exploit.c # C-based minimal exploit with native msf privilege escalation shellcode, needs its own bypass
└── test
    ├── exptest.c # Without comments
    └── test.c # Correct and with comments for easier understanding

splice(file → pipe → AF_ALG)
    ↓
af_alg_sendmsg: file page cache pages → TX SGL (zero-copy)
    ↓
_aead_recvmsg: in-place optimization
   ├─ memcpy_sglist: copy AAD+ciphertext to RX SGL
   ├─ sg_chain: chain tag page (still pointing to file page cache) into RX SGL
   └─ req->src = req->dst (= scatterlist containing file page cache pages)
    ↓
crypto_authenc_esn_decrypt: ESN reordering
   └─ scatterwalk_map_and_copy(tmp+1, dst, assoclen+cryptlen, 4, 1)
      ↓ traverse dst scatterlist to tag position
      ↓ kmap_local_page() maps file page cache page
      ↓ memcpy: writes seqno_lo into file page cache page
    ↓
HMAC verification fails → returns -EBADMSG
    ↓
File page cache page modified, kernel does not mark page dirty, disk file unchanged

Before: aead_request_set_crypt(..., rsgl_src,
                                areq->first_rsgl.sgl.sgt.sgl, ...)
                                ^  src == dst  ^

After:  aead_request_set_crypt(..., tsgl_src,
                                areq->first_rsgl.sgl.sgt.sgl, ...)
                                ^  src ≠ dst  ^  (TX SGL for src, RX SGL for dst)

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
rmmod algif_aead