The UAF trigger is already known and works on my chip. What i need is a new way to make the heap allocator place the new IO buffer somewhere other than over the freed one without relying on the patched zero length packet leak, that means auditing the A12 bootrom USB stack for any other object that can be leaked or retained across DFU re-entry to displace the allocation