Remove the traces our own unloading leaves behind

[JingMatrix]

clean_linker_trace() in run_modules_post asked for jit-cache-zygisk. The daemon creates the module memfd as zygisk-module, and has done since 5e43a06 renamed it back from the former; b4d31ab caught the same stale name in spoof_virtual_maps and fixed that call site, but this one was never opened. So for every process where a module declines to unload — 25 of them in one boot here, roughly one in six, system_server among them — the linker kept an soinfo record whose realpath reads /memfd:zygisk-module (deleted). spoof_virtual_maps hides the mapping, so nothing shows in /proc/<pid>/maps; the record is visible to anyone who walks the linker's list, which is exactly what Demo's solist scan does.

Releasing an soinfo hands its block back to the linker's slab allocator, which is strictly LIFO: free() pushes at the head and alloc() pops it, so the block released last is reissued first. Releasing our records front to back therefore hands them back to the next loads in reverse, and dl_iterate_phdr enumerates in solist order, which is allocation order — an object landing on a lower block than the one before it is a step backwards that a process which never unloaded anything cannot show. Release highest block first, in dropSoPath and in the module loop, and the reuse stays ascending. Measured: the step is gone, three runs.

dropSoPath collects before releasing now. soinfo_free memsets the block, and soinfo::next lives past the free-list pointers threaded through its first sixteen bytes, so walking the list while releasing read a zeroed next and stopped after the first hit — with several matching records only one ever went.

The self-unmap was short by the .bss. The ptracer measures us by summing the mappings that carry our pathname, and bionic maps the tail of the last PT_LOAD as an anonymous zeromap with no file behind it (ElfReader::LoadSegments): 8192 bytes on arm64, one page on the 32-bit ABIs, stranded in every process we inject into. dropSoPath now reports the reservation the linker recorded in soinfo::size, and hook_entry prefers it once its base agrees with the range the ptracer handed over.

That sum also keyed on a pathname substring. It identifies the library by name once and collects by device and inode after, so a (deleted) suffix or a second mapping sharing the basename cannot widen the range we later unmap.

Carry the whole .llvm suffix. Android 17 ships a twenty-digit hash, twenty-six characters with the prefix, which exactly filled the old buffer and left it without a terminator for snprintf to run off; solinker then failed to resolve and the solist path degraded silently.

Spoofed regions are named dalvik-DEX data rather than left anonymous. Note this only defeats a scan that reads the label — PR_SET_VMA_ANON_NAME lets any process name its own anonymous memory, so the name is not evidence either way.