There’s a really cool little mmap gadget that maps the same underlying memory region into two contiguous virtual memory address ranges. When you write past the end of the first mapped region, the remaining bytes end up in the second mapped region (and at…