| HID module does not validate the index values in [[HID_Shared_Memory|sharedmem]](just changes index to 0 when index == maxval when updating), therefore large values will result in HID module writing HID data to arbitrary addresses.
+
| ROP under HID module, but this is *very* unlikely to be exploitable since the data written is HID data.