Initial vulnerability is OOB read, but it can be leveraged to gain arbitrary r/w.

EDIT: source: https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/