> Lastly, in the final blog post we’ll explore the iPhone’s host isolation mechanisms, research the ways in which the Wi-Fi chip interacts with the host, and develop a fully-fledged exploit allowing attackers to gain complete control over the iOS kernel over-the-air, requiring no user interaction.
Which is referring to this link: https://googleprojectzero.blogspot.com/2017/10/over-air-vol-...
That link is the one I am summarizing:
> Sufficient isolation for DMA-capable components can be achieved by partitioning the visible memory space available to the peripheral using a dedicated hardware component - an I/O Memory Management Unit (IOMMU).
Apple uses Qualcomm chips for cellular modems, and they use Broadcom for Wi-Fi.
edit: I might have linked the original post incorrectly, there are many volumes and parts
The ancient 2017 WiFi article - I see now; I thought you were referring to the OP's NSO group exploit.
Maybe you're thinking of the "Operation Triangulation" exploit chain, which used write access to a bizarre mapped area that seems to relate to cache debugging, in order to patch the page table.