Don't forget that the use-after-free used was also artificial - ie. OP didn't discover one, he added a UAF bug to go exploit.

The fact he got KASAN working and talks about fuzzing suggests he looked for one, but couldn't find one, which is a good sign.