Eh, permission escalation? It was basically a memcpy into kernel space. And thats just the first suitable syscall they found. They fuzz tested a bunch of them

Eh, permission escalation? It was basically a memcpy into kernel space. And thats just the first suitable syscall they found. They fuzz tested a bunch of them and dozens produced crashes worth pursuing. Of 173 syscalls tested, 60 produced kernel panics.