Sandbox Escape: Linux PI futex self-requeue bug

I hope I haven't messed something up... The issue exists when after blocking in futexwaitrequeuepi, q.rtwaiter is NULL but &rtwaiter on the stack has been added to various waiter lists by rtmutexstartproxylock. This is not supposed to be possible, because setting rtwaiter to NULL indicates atomic...