Revisiting Userspace Reachability to Baseband Processors: A Forensic Analysis of MediaTek CCCI Interfaces on MT6765 Platforms

This paper presents a forensic analysis of the Cross-Core Communication Interface (CCCI) driver on MediaTek MT6765 platforms, focusing on userspace reachability of modem-facing interfaces.

Experimental observations demonstrate that structured payloads sent via ioctl to /dev/ccci_ioctl0 produce correlated kernel log responses consistent with modem interaction, even when the device is in airplane mode.

While no exploitable vulnerability is claimed, the findings highlight a potentially broader-than-expected attack surface and raise important questions about security boundary definitions between the application processor and baseband processor.

This work contributes to the understanding of modem interface exposure in modern mobile systems and complements prior research focused on baseband-to-kernel attack vectors.