Local file disclosure via trusted bundle path

Improper authorization in NoSleep 1.5.1 allows local users to expose root-owned files via crafted XPC messages to its privileged helper. The helper's Mach service reads command and NSBundlePath directly from each dictionary, derives a kext path from the supplied bundle path, and then recursively applies root ownership and permissive modes to that tree without validating the sender or constraining symlinked paths. Exploitation requires local code execution and access to the service, and the reachable effect is disclosure of attacker-selected files plus limited permission tampering on files reachable under a crafted bundle path.