Task_t considered harmful(googleprojectzero.blogspot.com)

    1. Attacker creates process A and B
    2. B->A send task port Bt
    3. A->XNU request IOKit framebuffer client for Bt
    4. A ditches Bt, retains client
    5. Kill B; Bt in client now dangling
    6. Trigger creation of privileged C, unrelated to A & B
    7. C inherits memory once used by Bt
    8. A use retained framebuffer client to write C's memory

    1. Attacker creates process A and B
    2. B->XNU request IOKit framebuffer for Bt, Bc
    3. B->A send client Bc
    4. B execve /bin/su. B is now running as root.
    5. A use retained framebuffer client to write B's memory

    1. Attacker creates process A and B
    2. B->A send task port Bt
    3a. A->XNU task_threads(Bt), retrieving thread ports for Bt
    3b. (simultaneously) execve /bin/su. B is now running as root.
    4a. task_threads converts Bt to a task_t
    4b. execve modifies the same task_t to replace thread ports
    4c. task_threads retrieves the (now privileged) thread ports.
    5. A uses thread ports to overwrite registers and take control of B.

    1. Attacker creates process A and B
    2. B->A send task port Bt
    3a. A->XNU task_set_exception_port(Bt), wiring A to B's exceptions
    3b. (simultaneously) execve /bin/su with rlimited stack. B is now running as root, briefly.
    4a. task_set_exception_port converts Bt to a task_t
    4b. execve modifies the same task_t to replace thread ports
    4c. task_set_exception_port rewrites the exception port.
    5. stack access in B, running /bin/su as root, causes a SEGV
    6. XNU generates an exception message, passing with it the thread ports, to A    
    7. A uses thread ports to overwrite registers and take control of B.