Rooting a locked Google Pixel: porting a kernel exploit

Porting CVE-2026-43499 to a bootloader-locked Pixel 7: kernel reconnaissance without root, device-specific offsets, race-condition debugging, and the limits of temporary root.