It'd be nice to see some write-ups on SLUB / SLAB exploitation. It should be relatively easy to rip out the allocator and turn it into a user-space library a la `LD_PRELOAD`.