That's the second vulnerability that would need to be found. Maybe it's locked down and we're okay. Or maybe the code in OSX that reads the battery's health and capacity has a buffer waiting to be overflowed.
My impression is that the "second vulnerability" Charlie is talking about is the remote->kernel transit needed to allow you to talk to the battery in the first place.
