[int0x29]

Its not writing to the partition though is it? It is polluting the cache page via a write with a buffer overrun in the kernel. I don't think buffer overruns follow permissions.

[zb3]

I assumed such memory would be mapped readonly (PROT_READ), without actually looking into it..