Another update to this. I have now fully pwned the system with root SSH shell and an early-boot persistence module that runs arbitrary code before the home screen even appears!
But now I feel like Bloat from Nemo... now what?
I DID IT! I have managed to get arbitrary root code execution and dump the encrypted file system on the latest version of my 2025 Kia CCNC head unit!
This took a few months and was a hell of a journey. I have learned so much. Next up... persistence.