Alexander Nasonov wrote: > I can examine data at 0x34 offset and it's indeed 0. Correction: $rdi+0x40 is the correct location. I also inspected low half of dev_t ($rbx+0x38) and its value was 0x1423 which corresponds to: brw-r----- 1 root operator 20, 35 Dec 13 2015 /dev/cgd2d Alex