It was discovered that virtual address 0 is mappable via privileged write() to /proc/*/mem on Linux. Continue reading...