You don't have to pwn the kernel to solve kernel pwn chellenges ;)

Full writeup here: https://saarsec.rocks/2019/12/20/xmasctf-photonos.html