What a great write-up. Thanks for sharing how you found this fascinating vulnerability and exploit.