Syscall API: mquery()

• TOCTOU: mquery() doesn't actually reserve the address-space: what happens if another thread calls mmap() and takes a spot that ld.so was going to use?

• "Boom"

• O_CREAT : O_EXCL :: MAP_FIXED : ???

continued...