Local privilege escalation via unchecked parameter types

Type confusion in MediaTek keyinstall on affected Android 11.0 through 13.0 devices allows local users to escalate privileges. The trusted application's command handler treats two parameters as shared-memory pointers without validating paramTypes, allowing query_drmkey_impl to write attacker-controlled data to an arbitrary address. System execution privileges are required and no user interaction is needed; exploitation can overwrite a return address and execute code in the trusted application.