Local privilege escalation via forged device pointers

Privilege escalation in Zephyr RTOS before 4.4.2 allows local users to execute kernel code via forged flash_copy() device pointers. In drivers/flash/flash_util.c, z_vrfy_flash_copy() checks only the caller's output buffer and forwards user-controlled src_dev and dst_dev pointers into z_impl_flash_copy(), which dereferences them and calls their driver API tables in supervisor mode. Exploitation requires CONFIG_USERSPACE and a local user-mode thread; a forged struct device can escape the userspace sandbox, while invalid pointers can instead crash the kernel or expose out-of-bounds reads.