TL;DR DMA status isn't cleared on reset, unbounded write at address 0 upon reset -> load shellcode & win

Read the full writeup

Original writeup (https://ethanwu.dev/blog/2020/07/16/chujowy-ctf-ford-cpu/).