One final update - did some IR on an impacted device, it looks like CVE-2022-40684 based on artefacts left behind.