# Buggy code
def find_fake_fast(addr, size=None):
    """Find candidate fake fast chunks overlapping the specified address."""
    psize = pwndbg.arch.ptrsize
    allocator = pwndbg.heap.current
    align = allocator.malloc_alignment
    min_fast = allocator.min_chunk_size
    max_fast = allocator.global_max_fast
    max_fastbin = allocator.fastbin_index(max_fast)
    start = int(addr) - max_fast + psize
    mem = pwndbg.memory.read(start, max_fast - psize, partial=True)

    fmt = {"little": "<", "big": ">"}[pwndbg.arch.endian] + {4: "I", 8: "Q"}[psize]

    if size is None:
        sizes = range(min_fast, max_fast + 1, align)
    else:
        sizes = [int(size)]

    print(C.banner("FAKE CHUNKS"))
    for size in sizes:
        fastbin = allocator.fastbin_index(size)
        for offset in range((max_fastbin - fastbin) * align, max_fast - align + 1):
            candidate = mem[offset : offset + psize]
            if len(candidate) == psize:
                value = struct.unpack(fmt, candidate)[0]
                if allocator.fastbin_index(value) == fastbin:
                    malloc_chunk(start + offset - psize, fake=True)


# Traceback (gdb.MemoryError)
pwndbg> find_fake_fast &amp;__malloc_hook
FAKE CHUNKS
Traceback (most recent call last):
File "/home/ubuntu/pwndbg/pwndbg/commands/__init__.py", line 136, in __call__
return self.function(*args, **kwargs)
File "/home/ubuntu/pwndbg/pwndbg/commands/__init__.py", line 227, in _OnlyWhenRunning
return function(*a, **kw)
File "/home/ubuntu/pwndbg/pwndbg/commands/__init__.py", line 265, in _OnlyWithLibcDebugSyms
return function(*a, **kw)
File "/home/ubuntu/pwndbg/pwndbg/commands/__init__.py", line 245, in _OnlyWhenHeapIsInitialized
return function(*a, **kw)
File "/home/ubuntu/pwndbg/pwndbg/commands/heap.py", line 279, in malloc_chunk
if cursor == top_chunk:
gdb.MemoryError: Cannot access memory at address 0x30d7080900003131

# Fixed code
def find_fake_fast(addr, size=None):
    """Find candidate fake fast chunks overlapping the specified address."""
    psize = pwndbg.arch.ptrsize
    allocator = pwndbg.heap.current
    align = allocator.malloc_alignment
    min_fast = allocator.min_chunk_size
    max_fast = allocator.global_max_fast
    max_fastbin = allocator.fastbin_index(max_fast)
    start = int(addr) - max_fast + psize
    if start < 0:
        print(
            message.warn(
                "addr - global_max_fast is negative, if the max_fast is not corrupted, you gave wrong address"
            )
        )
        start = 0  # TODO, maybe some better way to handle case when global_max_fast is overwritten with something large
    mem = pwndbg.memory.read(start, max_fast - psize, partial=True)

    fmt = {"little": "<", "big": ">"}[pwndbg.arch.endian] + {4: "I", 8: "Q"}[psize]

    if size is None:
        sizes = range(min_fast, max_fast + 1, align)
    else:
        sizes = [int(size)]

    print(C.banner("FAKE CHUNKS"))
    for size in sizes:
        fastbin = allocator.fastbin_index(size)
        for offset in range((max_fastbin - fastbin) * align, max_fast - align + 1):
            candidate = mem[offset : offset + psize]
            if len(candidate) == psize:
                value = struct.unpack(fmt, candidate)[0]
                if allocator.fastbin_index(value) == fastbin:
                    malloc_chunk(start + offset - psize, fake=True)