Protected-memory compromise via shared-buffer permission race

A TOCTOU race in Qualcomm Snapdragon HLOS Invoke Call handling allows local users to alter permissions on secure-kernel shared buffers. While HLOS waits for a callback or listener response, a non-secure client can change permissions on shared memory already selected for a secure-kernel invocation. Low-privilege local access and successful race timing are required; exploitation enables protected-memory reads, writes, or interruption of secure processing.