Sensitive data disclosure via null pointer dereference

Information disclosure in the Qualcomm Avtimer driver on Google Pixel and Pixel XL allows local users to read sensitive kernel data. The AF_MSM_IPC socket accept path dereferences a null address and exposes memory outside the calling application's permission boundary. Exploitation requires a local malicious application and prior compromise of a privileged process; the reported impact is limited to confidentiality.