All of these theories can be tested by simply connecting to Hijack's webserver during the fsck, with and without the player running, and then using HTTP to examine /proc/slabinfo, /proc/meminfo, and perhaps a few other /proc entries..

Cheers