Because this vulnerability requires one specific allocation to fail and one to succeed, it doesn't work every time (it won't panic if it doesn't work). It's not really a race condition, it's just because it's tough to guess the vm state without privileges, so I try to brute force the right combination of allocations with lots of paths. Maybe print a message like "it's safe to try again"?