Protected map modification via skipped verifier write checks

Improper input validation in the Linux BPF verifier allows local users to modify read-only maps through a variable-size helper buffer. In check_mem_size_reg(), a nonconstant size clears metadata, and the overloaded MEM_UNINIT meaning causes a write to be checked as a read. Exploitation requires local low-privilege BPF access; boundary checks remain, but supposedly immutable map contents can be altered.