Use-after-free in FreeBSD sound(4) /dev/dsp mmap path

Single-file local FreeBSD kernel privilege-escalation exploit in C. The code targets the OSS /dev/dsp device and appears to exploit a stale/shared kernel buffer mapping condition combined with controlled kernel stack/thread state associated with nanosleep(). Repository structure is minimal: one entry-point file, exp.c. Exploit flow: it resolves the running kernel base with kldstat(1) and the sys_nanosleep symbol with kldsym(), computes hardcoded gadget addresses relative to the kernel base, and builds executable userland shellcode. That shellcode runs in kernel context and directly edits the current process credentials to set UID/GID values to 0, effectively making the process root. Before executing shellcode, the exploit prepares a mini ROP chain to disable SMEP by writing a modified CR4 value, allowing execution of attacker-controlled code from user memory, then later restores the original CR4. To trigger the vulnerability, the exploit opens /dev/dsp repeatedly, configures fragments with SNDCTL_DSP_SETFRAGMENT, queries buffer geometry with SNDCTL_DSP_GETOSPACE, mmaps the device buffers, and fills them with a marker value. It then closes the file descriptors while retaining the mappings, suggesting reliance on stale mappings or freed/reused kernel-backed pages. In parallel, it creates 1200 pthreads with attacker-controlled stacks; each thread enters nanosleep() with crafted timespec values embedding thread-specific markers in tv_nsec. The exploit scans the stale mapped pages for those markers and for pointers into kernel text, identifying reused pages containing kernel stack data. Once it finds a page containing the expected sys_nanosleep return address, it overwrites that stack slot with a ROP chain: pop rax; ret -> CR4_NOSMEP -> mov cr4, rax; ret -> shellcode address. After the corrupted kernel thread resumes, the shellcode should execute in kernel mode, patch credentials, restore CR4, and return. The userland loop polls geteuid() until it becomes 0, verifies UID/EUID, and execs /bin/sh. Overall, this is a real, operational local privilege-escalation exploit with a built-in payload, but it is highly version-specific due to fixed gadget offsets and CR4 assumptions.