Standard user to SYSTEM on the Microsoft Surface family (I believe all are affected - tested on Surface 11 Pro (Build 28120.2315)). It's the SurfaceBroker service that trusts a token name any user can fake. Report to MSRC and be disappointed again, or just drop? 🤔 Btw: researched and built purely with Claude Code this afternoon.