EIP-2026-100043

The exploit demonstrates a heap overflow in the Adreno GPU driver's IOCTL_KGSL_PERFCOUNTER_QUERY ioctl command due to an incorrect signed type conversion, leading to a buffer overflow when a large 'count' value is provided. The PoC triggers the vulnerability by setting count to 0x80000001, causing an undersized allocation and subsequent overflow.