FTA: But to simplify my first security experiment with Fuchsia, I decided to disable SMAP and SMEP in the script starting QEMU and create the fake vtable in my exploit in the userspace

I don’t see them re-enabling it later, so yes, they found security problems, but they didn’t show a complete attack, either.