CVE-2018-4087 PoC: Escaping the sandbox by misleading bluetoothd

This blog post discloses two vulnerabilities in Apple's bluetoothd IPC that allowed a sandboxed app to brute-force session tokens (mach_port_t) and register callbacks on other system clients—enabling mach port leakage and potential sandbox escape; the author provides PoC code, lists affected clients, assigned CVEs (CVE-2018-4087, CVE-2018-4095), and notes Apple patched the issue by randomizing session tokens in iOS/watchOS/tvOS updates.