So I just solved this - it was my first ever heap exploit.
A really great challenge that taught me heaps!
From the flag, it seems I did it an unintended (and I think easier) way. I was going along the intended route previously, but then had a eureka moment and saw an easier option…
I’d be really interested to hear how other people solved this.
My exploit is maybe 95% reliable, and I don’t think I can do any better than that.
Anyone’s welcome to DM, especially to maybe get a fresh set of eyes on a problem!