[aj3]

Initial vulnerability is OOB read, but it can be leveraged to gain arbitrary r/w.

EDIT: source: https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/

[quenix]

Thanks for the write up.