The AppleKeyStore userclient uses an IOCommandGate to serialize access to its userclient methods, however by racing two threads, one of which closes the userclient (which frees the IOCommandGate) and one of which tries to make an external method call we can cause a use-after-free of the IOCommandGate.
1db8ce601471ad3e19f7c84c23572709a3952990a28f5b5d130277dfb0f639dc
Apple Security Advisory 2016-03-21-3 - tvOS 9.2 is now available and addresses code execution, memory corruption, and various other vulnerabilities.
576bf88cd8411520d0b41a89dc0b71a608a7bbddb1b15581478a9131071d23ca
Apple Security Advisory 2016-03-21-1 - iOS 9.3 is now available and addresses code execution, memory corruption, and various other vulnerabilities.
d014002b8661b674441b269148e4a0b977e33ca0eab871429b9557c64d61cff3