Mark the FPM profiles as contributor-reported and environment-specific

Author: devploit

README.md

@@ -57,8 +57,11 @@ not match the profile.
 | PHP 8.2.0 aarch64 | `php:8.2.0-apache` | — (offsets only) | n/a | n/a | no | no heap profile |
 
 **21 profiles (13 Apache/mod_php + 8 PHP-FPM), 13 with verified RCE. Offsets
-extracted for 12 Apache builds.** The PHP-FPM profiles have no Apache leak
-stages: the chain abuses the stale `BG(unserialize)` struct instead.
+extracted for 12 Apache builds.** The PHP-FPM profiles are
+**contributor-reported** and environment-specific (the compile-time prefix
+shifts the heap); re-run `calibrate` on the host that will run the exploit
+instead of trusting the shipped geometry. They have no Apache leak stages: the
+chain abuses the stale `BG(unserialize)` struct instead.
 `no-oracle` is fully remote — it leaks the chunk and php-fpm PIE bases over
 HTTP from a stale-session string OOB read (or takes them from `--chunk`/
 `--pie`) and fires without touching `/proc/<pid>/mem`; the lab-only `endgame`

profiles/7.4.33-fpm.json

@@ -89,7 +89,7 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7fc2f2800000 and the PIE base 0x557c5d600000 (leak+0x19808 -> 0x480b93); the primitive at 0x7f000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib7433).",
+  "status": "contributor-reported — RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7fc2f2800000 and the PIE base 0x557c5d600000 (leak+0x19808 -> 0x480b93); the primitive at 0x7f000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib7433).",
   "oom_mb": 4,
   "layout": {
     "unserialize_data": {

profiles/8.0.30-fpm.json

@@ -90,7 +90,7 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7fd3b8a00000 and the PIE base 0x557729200000 (leak+0x177c8 -> 0x47425d); the primitive at 0x7f000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
+  "status": "contributor-reported — RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7fd3b8a00000 and the PIE base 0x557729200000 (leak+0x177c8 -> 0x47425d); the primitive at 0x7f000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
   "oom_mb": 4,
   "layout": {
     "unserialize_data": {

profiles/8.1.33-fpm.json

@@ -61,7 +61,7 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7fc72c400000 and the PIE base 0x5593cb200000 (leak+0x157e8 -> 0x48d033); the primitive at 0x7f000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib8133).",
+  "status": "contributor-reported — RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7fc72c400000 and the PIE base 0x5593cb200000 (leak+0x157e8 -> 0x48d033); the primitive at 0x7f000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib8133).",
   "oom_mb": 4,
   "layout": {
     "unserialize_data": {

profiles/8.2.34-fpm.json

@@ -61,7 +61,7 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7fb258000000 and the PIE base 0x5572fba00000 (leak+0x157e8 -> 0x4a2c85); the primitive at 0x80000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
+  "status": "contributor-reported — RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7fb258000000 and the PIE base 0x5572fba00000 (leak+0x157e8 -> 0x4a2c85); the primitive at 0x80000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
   "oom_mb": 4,
   "layout": {
     "unserialize_data": {

profiles/8.3.35-fpm.json

@@ -61,7 +61,7 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f1c11400000 and the PIE base 0x564b85200000 (leak+0x157e8 -> 0x4b24f6); the primitive at 0x80000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
+  "status": "contributor-reported — RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f1c11400000 and the PIE base 0x564b85200000 (leak+0x157e8 -> 0x4b24f6); the primitive at 0x80000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
   "oom_mb": 4,
   "layout": {
     "unserialize_data": {

profiles/8.4.0-fpm.json

@@ -61,7 +61,7 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f576fe00000 and the PIE base 0x558029e00000 (leak+0x157e8 -> 0x4e4467); the primitive at 0x7f000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
+  "status": "contributor-reported — RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f576fe00000 and the PIE base 0x558029e00000 (leak+0x157e8 -> 0x4e4467); the primitive at 0x7f000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
   "oom_mb": 4,
   "layout": {
     "unserialize_data": {

profiles/8.4.25-fpm.json

@@ -92,7 +92,7 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f8247e00000 and the PIE base 0x55d33ce00000 (leak+0x17668 -> 0x4e80aa); the primitive at 0x81000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib8425).",
+  "status": "contributor-reported — RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f8247e00000 and the PIE base 0x55d33ce00000 (leak+0x17668 -> 0x4e80aa); the primitive at 0x81000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib8425).",
   "oom_mb": 4,
   "layout": {
     "unserialize_data": {

profiles/8.4.26-fpm.json

@@ -92,7 +92,7 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f59a8600000 and the PIE base 0x55c648000000 (leak+0x17668 -> 0x4e886a); the primitive at 0x81000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
+  "status": "contributor-reported — RCE verified over HTTP only (no /proc access): the stale-string leak recovered chunk=0x7f59a8600000 and the PIE base 0x55c648000000 (leak+0x17668 -> 0x4e886a); the primitive at 0x81000/0xfe8 was observable through app.php and the forged HashTable destructor executed zif_system (proof: out/out/calib).",
   "oom_mb": 4,
   "layout": {
     "unserialize_data": {