BootROM → root → lock-screen PIN. We enter BROM mode, load a patched preloader, gain root, extract the lock credential, recover the 6-digit PIN offline, and use it to unlock the phone. Full PoC ↓ (CertiK)