Rating:
The final reliable recovery path was:
Reverse driver.ko and identify where the flag lives in the loaded kernel module.
Use the unstable physical-page corruption exploit until it drops us into a root shell.
Do not execute another uploaded ELF after root, because the exploit has already damaged kernel/page-cache state.
Use BusyBox shell tools to read the loaded module memory through /proc/kcore.
Extract the string from the live flag symbol in driver.ko's .data section.
The important loaded-module fact is:
driver.ko:.data + 0x170 == flag
On the remote instance, /proc/kallsyms exposed the live flag [driver] address after root, and reading that address from /proc/kcore produced the flag.
