iirc this was a register level exploit. no software in iOS or macOS touched the undisclosed register, but when the right secret key was entered, you got full read/write primitives on the silicon