Two Bytes to RCE: How a Heap Over-Read and an 18-Year-Old Overflow was Chained into an ASL