Saar Amar, who works at MSRC, wrote a writeup & POC for what he says is the same bug: https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/ He says he found it independently.