Chrome for Testing Stable 127.0.6533.72, linux64 headless-shell
Renderer heap sentinel scan under GDB

SENTINEL_DATA=0x115100202e30
FIXED_DOUBLE_ARRAY=0x00202e29
JSARRAY_OBJECT=0x115100202e01
JSARRAY_PROPERTIES=0x00000725
CHROME_PACKED_DOUBLE_JSARRAY_MAP=0x00115199

The page retained four unique 64-bit double bit patterns. GDB searched the
renderer mappings for the sequence, walked backward to the FixedDoubleArray
header, found the referring JSArray, and read its map and properties fields.
The exploit independently validated both values through its arbitrary-read
primitive:

  carrier +0x00 = 0x00115199 0x00000725
