Utilize msg_msg to arb read and arb write in non 4k slabs. Then find current task walking the linked list of tasks and overwrite cred of current process with zeroes.