[JoshRob297]

The private material with the most value, published. Two documents and one transcript, both languages.

CHAIN-E — the FPM arm of the E-OOM primitive, documented at the level of bytes: the write arithmetic T2 = d + 0x110 + 16·N, the six offsets of the fake var_dtor_entries buffer, the requirement that the planted session be exactly 24 bytes in the shape C|i:<V>;AAAA (and the measured fact that hello|i:<V>; — also 24 bytes — breaks the layout with a SEGV in tmp_var), the post-exec ABI desynchronisation that turns every attempt into a 502 unless the payload decouples, and the five paths that did not work, each with the reason it was closed.

It is the only published description of hijacking sapi_module.ub_write rather than a destructor or a session file. LAB ONLY, and now closed from both sides.

RELIABILITY — the conditions that decide whether the Off + ASLR-on chain fires at all: 128M with one worker gives 3/3, 8M gives 0/3, and the failure at 8M is calibration, not the trigger (our older chain goes 8/8 at 8M with display_errors=On). It also settles the sentence that keeps circulating, that lowering memory_limit does not help: true for the mod_php cookie chain where the attacker sizes the body, false as a general claim, because the pure/ chain's constants are fixed for the 128M arena. Plus: our own compose does not reproduce the 10/10 because vuln-8426 loads no php.ini, and cold start is not characterised — 0/3 on a fresh target, 3/3 after a restart.

raw/chain-e-aslr-sweep-387.txt — we had a module described as a deterministic ASLR page sweep. It is not one: it sends {"page": N} with no forged body and no address arithmetic, and its success check matched "OK" in the body regardless of any marker. With the code's own criterion it reported success on page 0; with a strict criterion, 387 pages, 387 responses, 0 hits, 0 crashes, no payload ever built.

What stayed private, and why. The orchestrator is a fragment that cannot run without our harness, and its forge accepts a system_addr it never uses. Publishing it as a public chain would mean publishing something that does not run. The session dropper, the C2 and the evasion modules stay where they are. The pilot findings on our own infrastructure are not research material.