TLDR I independently found a heap out-of-bounds read/write in KVM’s SEV-SNP Page State Change handler. A malicious guest VM can corrupt host kernel heap memory and leak its layout, across the VM boundary, as many times as it wants. I reported it to security@kernel.org on May 9, 2026 and they told me someone else reported it a few weeks earlier. This post is the story of that bug, why my fix was wrong, why theirs was better, how bad this thing actually is, and what you can learn from all of it.