launderrvictim source realm

ApplyHook dispatches a caller-supplied callback on gImm. The callback's parameter type is /r/launderrvictim-declared, so /p/ packages can't supply this hook — only /r/ realms can.

CallPDeferApply: multi-level defer chain. Victim invokes a /p/-method (DeferApply) on a victim-owned *launderpkg.Immutable; the /p/-method defers the attacker callback. Three frames at callback time: attacker.main → victim.CallPDeferApply → /p/.DeferApply (deferred fn dispatches here).

CallThenPanic invokes h synchronously and then panics. If h is attacker-supplied and writes via captured pointer, this is just a re-shape of ApplyHook.

DeferApplyHook defers an ApplyHook call. The deferred ApplyHook itself runs borrow rule #1 to /r/launderrvictim, and inside the callback runs as borrow rule #1 of the attacker's realm — the standard known-open Apply pattern, but now triggered via defer.

DeferCallback installs h as a defer inside an /r/launderrvictim frame, then returns. h runs at frame pop. The question: at the time h is invoked, m.Realm has just been restored to caller's realm by PopFrameAndReturn — but wait, defers run BEFORE PopFrameAndReturn. So m.Realm should still be victim's. Does the deferred h then run under victim authority?

MakeApplyTrampoline returns a closure that captures &gImm.Field indirectly: it captures *Immutable, and dispatches a caller-supplied callback fn on it. /r/-victim-declared body → borrow rule #1 → m.Realm = /r/-victim. If `fn` is /p/-declared (e.g. EvilWrite), it inherits victim authority. This is "victim returns a closure that's itself an Apply-style trampoline" — a packaged Apply.

MakeWriterClosure constructs a /r/-victim-declared closure that captures gImm and writes through it. The closure body is /r/-victim- declared, so borrow rule #1 fires at invocation → m.Realm = /r/-victim → write commits with victim authority. Returning this closure to an attacker is "consenting to write" by the victim.

PanicAfterPushDefer pushes a defer and then panics, so the defer runs as part of panic unwinding. Tests that m.Realm is correctly borrowed when the defer body invokes a foreign function.

ReadImm reads the current field for after-attack verification.

RecoverAndRetry: inside a victim method, defer a recover, write something to gImm, then panic. After the recover, the function returns normally. Tests that internal panic/recover doesn't leak state.

UseAnyMutator boxes gImm as any and dispatches a /p/-declared AnyMutator. This is the dangerous shape from Attack L: victim boxes its own /r/-declared data through a /p/-defined interface that the attacker can implement.

GetImm hands out a pointer to gImm. Standard "victim exposes a pointer to its state" antipattern — but with /r/-declared data, the attacker should still be unable to write through it.

Immutable is /r/-declared (the key difference from /r/laundervictim, which uses /p/launderpkg.Immutable).

WithEmbed embeds launderpkg.Immutable by VALUE (method promotion gives WithEmbed an .Apply method).

WithPtr has a POINTER FIELD to launderpkg.Immutable.

WithVal has a VALUE FIELD of launderpkg.Immutable (not embedded; the field is named, no method promotion — but the value is still addressable through c.Inner).