Local privilege escalation via wmt_dbg out-of-bounds writes

Out-of-bounds writes in Google's Android wmt_dbg driver allow local users with System privileges to gain elevated execution. The /proc/driver/wmt_dbg interface performs several writes beyond buffer boundaries, but Google has not disclosed the controlling input or affected write sites. Exploitation requires existing System execution privileges and no user interaction, and successful corruption grants higher local privileges.