Borrowed Pages As Scratch

A subsystem performs fixed-size scratch writes into a destination buffer under an internal contract that it owns the memory. Another subsystem supplies that buffer with foreign-owned pages (page cache, mapped device, peer process). The contract is documentation; the legitimate scratch becomes a write primitive across a trust boundary nobody guards.