The article documents a zero-click-to-root exploit chain on Pixel 10: an updated Dolby decoder exploit (CVE-2025-54957) paired with a new VPU kernel driver flaw whose mmap handler maps unbounded physical memory, exposing the kernel image. The author credits Android's improved triage (High severity rating, 71-day fix) but argues the same vendor again shipped a shallow, easily found driver bug, so proactive driver security remains weak.
The author critiques mutational coverage-guided grammar fuzzing: coverage feedback misses semantic dependencies (e.g., bugs requiring chained function calls), and greedy corpus accumulation produces highly similar samples. The proposed fix is periodically restarting fuzz workers with empty corpora while syncing with a server holding accumulated coverage and samples, alternating independent generation with combined-corpus mutation. In week-long libxslt experiments this found more unique crashes faster than uninterrupted runs, though the optimal interval T was target-dependent.
The author presents MAccConc, tooling that traces kernel memory accesses via ASAN outline instrumentation fed through KCOV, and uses count-augmented stack traces to stably identify accesses across runs, enabling delay injection that forces specific thread interleavings. This supports confirming race-condition candidates, writing reliable regression tests, and eventually fuzzing. Tradeoffs include ASAN missing some stack/global accesses, coverage loss on kernel panics, and constraint-style orderings being less deterministic than fully-specified ones; kernel patches are not yet upstream.