Building on my Crash PoC for the FiiO M6, this is a full local privesc exploit for the same bug. A full write-up can be found on my blog
