Pre-auth RCE in screensharingd — SRP frame-length validation returns success on oversized frames, bypassing authentication entirely. Root file read/write → code execution via /etc/sudoers.d + /etc/zshenv (SIP-compatible). No user interaction required.