Comment by leszczy

Interesting, can you give some more info? The best path forward I found was using https://github.com/9bie/php2shell-bypass-aslr-exp and figuring out how to shrink the B1 leak down to >1.21MiB