Example: > If we can find a legitimate user client that provides an implementation of getTargetAndTrapForIndex() that returns a pointer to an IOExternalTrap re

Example: > If we can find a legitimate user client that provides an implementation of getTargetAndTrapForIndex() that returns a pointer to an IOExternalTrap residing in writable memory, then all we have to do is replace trap->func with a PACIZA'd function pointer (that is, a pointer signed under APIAKey with context 0). That means only a partial PAC bypass, such as the ability to forge just PACIZA pointers, would be sufficient. https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html https://googleprojectzero.blogspot.com/2019/02/examining-poi... How are you going to overwrite memory with CHERI? It cuts off a key primitive for bypassing PAC.