Browser stage uses JSC info leaks and a structured clone object pool mismatch to corrupt a typedarray. The kernel stage combines an address leak with an aio_multi_wait UAF race to establish kernel R/W ...