Local privilege escalation via mailbox type confusion

Type confusion in the mailbox component on affected MediaTek chipsets allows local users to escalate privileges through an out-of-bounds write. The mailbox component accesses a resource as an incompatible type and performs an out-of-bounds write, but MediaTek has not disclosed the specific code path or input. Exploitation requires existing System execution privileges, needs no user interaction, and results in local privilege escalation on affected Android or Yocto devices.