\begin{figure}[H]
    \centering

\begin{tikzpicture}[scale=0.145]
\tikzstyle{every node}+=[inner sep=0pt]
\draw [black] (9.6,-11.8) circle (4.4);
\draw (9.6,-11.8) node {wait};
\draw [black] (28.9,-27.9) circle (4.4);
\draw (28.9,-27.9) node {replay};
\draw [black] (9.6,-27.9) circle (4.4);
\draw (9.6,-27.9) node {end};
\draw [black] (28.9,-11.8) circle (4.4);
\draw (28.9,-11.8) node {\small{consume}};
\draw [black] (7.66,-7.87) arc (234:-54:3.3);
\draw (9.6,-1.4) node [above] {\textit{pass} \texttt{msg} on \texttt{chan}};
\fill [black] (11.54,-7.87) -- (12.41,-7.52) -- (11.61,-6.93);
\draw [black] (0.2,-11.8) -- (5.2,-11.8);
\fill [black] (5.2,-11.8) -- (4.4,-11.3) -- (4.4,-12.3);
\draw [black] (24.5,-27.9) -- (14,-27.9);
\fill [black] (14,-27.9) -- (14.8,-28.4) -- (14.8,-27.4);
\draw (19.25,-28.4) node [below] {\small{\texttt{buf} empty}};
\draw [black] (32.83,-25.96) arc (144:-144:3.3);
\draw (39.3,-27.9) node [right, align=center] {\textit{consume} \texttt{msg} from \texttt{buf} \\ \textit{send} \texttt{msg} to \texttt{chan}};
\fill [black] (32.83,-29.84) -- (33.18,-30.71) -- (33.77,-29.91);
\draw [black] (28.9,-16.2) -- (28.9,-23.5);
\fill [black] (28.9,-23.5) -- (29.4,-22.7) -- (28.4,-22.7);
\draw (29.4,-19.85) node [right] {\texttt{lim=0}};
\draw [black] (14,-11.8) -- (24.5,-11.8);
\fill [black] (24.5,-11.8) -- (23.7,-11.3) -- (23.7,-12.3);
\draw [black] (32.83,-9.86) arc (144:-144:3.3);
\draw (39.3,-11.8) node [right, align=center] {\textit{consume} \texttt{msg} from \texttt{chan} \\ \textit{add} \texttt{msg} to \texttt{buf} \\ \texttt{lim-=1}};
\fill [black] (32.83,-13.74) -- (33.18,-14.61) -- (33.77,-13.81);
\end{tikzpicture}

\caption{High-level state machine diagram of the \textit{reorder} attacker gadget, attacking a channel \texttt{chan}. A natural number \texttt{lim} is pre-defined. \texttt{buf} is a simple FIFO buffer of length \texttt{lim}.}
  \label{fig:reorder}

\end{figure}