drivers/char/diag/diag_dci.c in the Qualcomm components in Android before 2016-08-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application that sends short DCI request packets, aka Android internal bug 28767589 and Qualcomm internal bug CR483310.
https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=b77c694b88a994d077316c157168c710696f8805