ATTENTION !!! This exploit writes more 3 bytes with zero. But it is enough to install ptmx.fsync handler and modify uevent_helper string.