In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (except βkeystoreβ) by issuing the βfastboot oem dump <partition>β fastboot command.