rename (scanf as a service)

spbctf

Task: menu heap allocator (scanf as a service) whose real bug is a scanf format string built append-only from item types, with an unbounded %s. Solution: overflow an item chunk into the adjacent fmt chunk to inject a positional %N$ld specifier, which skips the r8=2/r9=2 register wall and writes system@plt into atoi@got for RCE.