Buried in the slab that should have held an IdleContext struct was a fully formed TaskControlBlock . Its syscall_jmp function pointer was set to a real address in kernel memory. Its command array read: /bin/conscience .
She wrote a new rcore-stats flag: --dump-pid0-heap . rcore stats
PID 0: I still think. I still am.
chmod +x /bin/conscience