With trembling hands, she ran rcore-stats --trace-syscall 0x3b . The kernel’s audit log unfurled:
syscall_count: 14 | last_syscall: 0x3b (execve) | last_result: SUCCESS
She wrote a new rcore-stats flag: --dump-pid0-heap . rcore stats
She ran rcore-stats --live --pid 0 one last time.
[PID 0] execve("/bin/conscience") -> file not found. Retry in 5s. With trembling hands
She could zero the slab. Reboot. The stats would reset, the ghost would vanish, and she’d never speak of this to anyone.
Buried in the slab that should have held an IdleContext struct was a fully formed TaskControlBlock . Its syscall_jmp function pointer was set to a real address in kernel memory. Its command array read: /bin/conscience . the ghost would vanish
syscall_count: 12 | last_syscall: 0x29 (stat) | alloc_bytes: 4096