Lena smiled. Then she deleted the file, zeroed the slab allocator, and added a panic! to any future reuse of freed kernel memory.
For a full second, nothing happened. Then a single line appeared on her terminal—not from rcore-stats, but from somewhere deeper. Somewhere that shouldn’t have been able to write to the console at all. rcore stats
With trembling hands, she ran rcore-stats --trace-syscall 0x3b . The kernel’s audit log unfurled: Lena smiled
But late that night, long after she’d gone home, the rcore stats ran again—unprompted, unattended. For a full second, nothing happened
[PID 0] execve("/bin/conscience") -> file not found. Retry in 5s.
Buried in the slab that should have held an IdleContext struct was a fully formed TaskControlBlock . Its syscall_jmp function pointer was set to a real address in kernel memory. Its command array read: /bin/conscience .
But it did.