How a missed x86 TLB shootdown became page-table control in Google kernelCTF.