Local privilege escalation via unchecked thermal thresholds

Out-of-bounds write in Google Pixel's Android kernel allows local users to elevate privileges through the ACPM thermal driver. The tmu_set_tr_thresholds function in tmu.c writes thermal threshold data outside its intended buffer because it performs no bounds check before the write. Exploitation requires local code execution on affected Pixel hardware, needs no additional execution privileges or user interaction, and can compromise the device kernel.