In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write...

In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.