EIP-2026-100022

This is a technical writeup detailing a privilege escalation vulnerability in the Android One (sprout) wireless driver due to an unsafe copy_from_user operation in the IOCTL_GET_STRUCT handler. The analysis includes kernel crash logs and references a PoC (hello-jni.tar.gz) that redirects execution to 0x40404040, demonstrating arbitrary code execution.