Perform a glibc 2.32 poison null byte attack without a heap leak by massaging unsorted and large bins, a tcache stash unlink attack to overwrite `mp_.tcache_bins`, and a tcache poison for controlled arb write to escape seccomp with a COP gadget involving rdi and rdx for the flag.