Joseph Ravichandran walks through PACMAN II, moving from 16 bit pointer authentication guesses to speculative cache probes that can sort good PACs from bad ones without taking the crash first. The real kernel case is refreshingly awkward, with noisy BSD syscall gadgets, asynchronous accesses, and one panic among twelve trials, which is exactly where the paperwork gets interesting.