Fig 1Copy FailHover to scrub · arrows stepsocket(AF_ALG) · authencesn
authencesn scratch stylus: writes 4 bytes past the tagPage cache: the pages every read, mmap and execve of su sharesplice() passes the page cache's own pages of /usr/bin/su to the AF_ALG socket by reference. Since 2017 algif_aead runs in place (src = dst), so authencesn's scratch write past the tag lands on that cached page, at an offset and value the caller picks. The file on disk is never written. The fix goes back to out of place, so the scratch write lands in the caller's buffer.