Local privilege escalation via unchecked threshold write

Out-of-bounds write in Google Android kernel ACPM code allows local users to escalate privileges without user interaction. The tmu_set_tr_num_thresholds function in tmu.c writes beyond an array because it fails to enforce bounds before storing threshold data. Exploitation requires local low-privileged code on an affected Pixel device; successful exploitation grants higher privileges and can compromise kernel-managed data or availability.