After weeks of reverse engineering MediaTek's DA2 with @shomy.bsky.social, we finally figured out how the V6 exploit works.
We decided to call it heapb8 ("heapbait")!
Technical writeup: blog.r0rt1z2.com/posts/exploi...
PoC: github.com/shomykohai/p...
blog.r0rt1z2.com