Local privilege escalation via vring_size integer overflow

An out-of-bounds write in Trusty on Google Pixel devices allows local users to elevate privileges through an integer overflow in vring_size. The vring_size function computes a virtqueue ring length with unchecked unsigned arithmetic; overflow causes a subsequent write outside the calculated bounds. Local reachability requires no additional execution privileges or user interaction, and successful exploitation grants elevated privileges.