In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds...

In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds read and write when formatting firmware log notifications due to an incorrect bounds check. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.