From the home page: " For our demo, we add our own bug to the kernel using a kext. In a real world attack, you would just find an existing kernel bug."

This is attacking a memory safety exploitation mitigation tech, there needs to be a memory safety bug. Otherwise there's no need for PAC in the first place.