• User clients are inter-connected • For example • If a IGAccelSurface user client is created, it will be added to IntelAccelerator::IOAccelSurfaceList • Each IGAccelSurface has a unique surface ID, there are system created IGAccelSurface (with Surface ID 1, 2, 0xffffffe0) • User created IGAccelSurface ranges its surface ID from 0x3 – 0xffffffff • Can be obtained by calling IOAccelDevice2::get_surface_info to brute force enumerate the IDs • These IDs can be used to fuzz interfaces in other userclients (such as IOAccel2DContext2::set_surface) • Creating a lot of user clients with such rules built, will increase the effectiveness a lot.