map_user_memory is selector 0x100 of userclient type 0x8 of IntelAccelerator
The field at offset 0x510 is a pointer to the task struct from which a vm_map_t is read.
By just opening the userclient and calling selector 0x100 with the right number of arguments the field at 0x510 is NULL meaning that the code will try to read a field of a task struct on the NULL page.
This PoC maps the NULL page to show control of a vm_map_t. Presumably bad things can be done with this.
tested on: MacBookAir5,2 w/ 10.10.1 (14B25)
