v67

Hack.lu 2026

Task: V67L's x86-64 JIT adds instruction_count to Function offset 0 (jit_entry) instead of offset 8 (fuel), drifting the entry pointer every native call. Solution: make a hot function's instruction_count match the byte offset of its first Const imm64 (23), chain shellcode in the immediates with eb 09, and native call #2 runs execve('/bin/sh').