Awesome

ATTENTION !!! This exploit writes more 3 bytes with zero.

But it is enough to install ptmx.fsync handler and modify uevent_helper string.