As a result of checking the problem, double free doesn't work, and heap overflow doesn't seem to work... I confirmed that unassigned addresses can be double free, but due to the structure, it's not likely to go into free. UAF is possible, but it's impossible to write to a UAF chunk. I'm not sure about the approach, so I'm leaving a question. Can I get a little hint

...