Heap grooming on musl: a practical tcache-free primitive

Notes on turning an off-by-one in a mallocng-backed allocator into a reliable arbitrary write on modern Alpine builds.

#binary-exploitation

#musl

#heap

Why musl is different

Most public heap research targets glibc. Alpine containers use musl, and its mallocng allocator keeps metadata out of band. Many familiar assumptions simply do not apply.

That design removes a whole family of classic corruption paths, but it does not make small memory errors harmless. It just moves the interesting state somewhere else.

What changed in practice

Reliability came from understanding allocation groups and predicting layout, not from any single trick. Most of the work was careful measurement across builds.

Takeaways for defenders

Treat off-by-one bugs as serious on every allocator. Keep Alpine base images patched, and fuzz against the libc you actually ship.