Target: ChromeOS-ARM Chromebook with ARM Mali GPU (e.g. MediaTek Kompanio
MT8195/MT8188) running the proprietary Mali Vulkan driver. On such devices the
dawn:1550 workaround toggle is not set (it is gated by a compile-time
Android-only predicate), so Dawn records a single VkRenderPass with multiple
pResolveAttachments — the driver path the workaround exists
to avoid. Dawn marks the never-cleared resolve targets as "initialized" before
the GPU runs; if the Mali driver silently skips a resolve write, the attacker
reads back stale GPU-heap bytes.
Expected on a correct driver: every readback is all-zero.
Bug fires: non-zero bytes appear in one or both resolve targets.