in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through use after free.