What to Inject
Part 6: Negative number with least significant bit 0 (0xfffffff0)
Part 7: Negative 4 (0xfffffffc)
This will become the size byte of the second chunk, saying essentially that the third chunk starts 4 bytes earlier. Since the LSB is 0, the second chunk is free and needs to be unlinked