pre 2.30 the count in the metadatastruct was a char

Author: Liikt

glibc_2.27/tcache_metadata_poisoning.c

@@ -17,7 +17,7 @@
 
 // This is the `tcache_perthread_struct` (or the tcache metadata)
 struct tcache_metadata {
-  uint16_t counts[TCACHE_BINS];
+  char counts[TCACHE_BINS];
   void *entries[TCACHE_BINS];
 };