docs: netfilter_xtcompat (CVE-2021-22555) — empirical note on primitive difficulty

Attempted the most tractable kernel primitive to gauge the frontier. Kernel
confirmed vulnerable (focal GA 5.4.0-26 and a provisioned mainline 5.8.0, both
pre the 5.4.0-77/5.8.0-53 fix). But Andy Nguyen's well-regarded single-file
public exploit consistently fails at STAGE 1 ("could not corrupt any primary
message") on both — it is tuned for Ubuntu's exact 5.8.0-48-generic slab config
(freelist randomisation / memcg kmem accounting / SLUB merge), which mainline
kernels don't match, and Ubuntu's EOL 5.8.0-48 HWE debs aren't readily
sourceable. Recorded in docs/EXPLOITED.md: kernel primitives are
config-and-version-specific exploit-dev — even a reference exploit needs its
exact target kernel image + per-target tuning + a full port, a per-primitive
multi-session effort. No code change; documentation of the empirical result.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y

docs/EXPLOITED.md

@@ -239,6 +239,23 @@ Followed the full methodology (test → confirm kernel → pull PoC → diff):
   same shape — real trigger/groom scaffolds returning `EXPLOIT_FAIL` by design.
   The resolver fix unblocks feeding them offsets; each still needs its arb-write
   primitive completed against a matching vulnerable kernel.
+
+**`netfilter_xtcompat` (CVE-2021-22555) — empirical note on why the primitives are
+hard.** Attempted the corpus's *most tractable* primitive first: it has a clean,
+well-regarded single-file public exploit (Andy Nguyen / Google, the `IPT_SO_SET_
+REPLACE` heap-OOB → `msg_msg` cross-cache → cred overwrite). Kernel confirmed
+vulnerable (Ubuntu 20.04 GA 5.4.0-26, and a provisioned mainline 5.8.0 — both pre
+the 5.4.0-77 / 5.8.0-53 fix). **But the reference exploit consistently fails at
+STAGE 1 ("could not corrupt any primary message") on both**, because it is tuned
+for *Ubuntu's exact `5.8.0-48-generic` config* (the tested target). The slab
+behaviour that governs whether the OOB write lands next to a sprayed `msg_msg`
+(freelist randomisation, memcg kmem accounting, SLUB merge) differs between
+mainline and Ubuntu-patched kernels, and Ubuntu's EOL `5.8.0-48` HWE debs are no
+longer readily sourceable. Takeaway: kernel primitives are **config-and-version-
+specific exploit-dev** — even a "drop-in" reference exploit needs its exact target
+kernel image plus per-target slab tuning, and then a full port (~760 LOC here,
+~2000 for `nf_tables`/Notselwyn). This is a per-primitive, multi-session effort;
+it is NOT the "spot the bug and fix it" tier the userspace modules were.
 - **Structural userspace** (`sudoedit_editor`, `sudo_chwoot`, `sudo_host`):
   need specific sudo versions + sudoers config; likely tractable.
 - **2026 CVEs** (`copy_fail` ×5, `dirtydecrypt`, `fragnesia`, `cifswitch`,