Exploiting @nitayart's Broadpwn bug