Local BPF JIT hardening bypass via unblinded immediates

Improper BPF JIT constant blinding in Linux Kernel 6.9 and later allows local users to retain attacker-chosen immediates in native code. In bpf_jit_blind_insn(), the switch handles BPF_ST|BPF_MEM but omits verifier-rewritten BPF_ST|BPF_PROBE_MEM32 stores, so their 32-bit values pass into JIT output without blinding. Reachability requires permission to load a qualifying BPF arena program with bpf_jit_harden set to at least 1; the published evidence establishes weakened JIT hardening but does not describe a standalone privilege gain or crash.