Add the house of mud attack

[fern89]

I have come up with a new house which is similar to house of botcake, also aiming to bypass the restriction preventing naive tcache dup introduced in https://sourceware.org/git/?p=glibc.git;a=commit;h=bcdaad21d4635931d1bd3b54a7894276925d081d.

Instead of unsorted bin used in botcake, this technique uses of fastbin reversal into the tcache to bypass double free protections, and allocate a chunk at an arbitrary address that is 0x10 aligned. I have tested it on all versions from 2.34 to 2.42, both inclusive, on x86_64 architectures, but the code allowing it to work is present as far back as 2.26, at https://elixir.bootlin.com/glibc/glibc-2.26/source/malloc/malloc.c#L3644.

This aims to serve as a complement to house of botcake, with the added advantage of not requiring differing allocation sizes, which makes it ideal for some more restrictive challenges.

I have also wrote up a simple blog post at https://fern89.github.io/2025/09/20/doublefree/.