I found a potentially better route: reuse the TLS wrapper’s non-SOL_TLS dispatch to call arbitrary kernel function pointers with controllable register arguments. I’m now checking whether a simple register-shuffle gadget chain exists to call commit_creds(init_cred) without needing a full stack pivot.