In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a user supplies a value too large, then an out-of-bounds read occurs.
No PoCs from references.
- https://github.com/ntonnaett/hammerhead_wip