Memory corruption via FIFO notification registration rollback

Use-after-free in Linux pipe_fasync() allows local users to access freed kernel memory via concurrent FIFO notification enables. A failed writer allocation removes an existing reader registration and clears FASYNC, leaving a writer registration that bypasses close-time cleanup and later dereferences a freed file in send_sigio(). Triggering requires concurrent enables on an O_RDWR FIFO and memory pressure; the documented result is a kernel use-after-free, not demonstrated privilege escalation.