Over-the-air BadUSB can hack Katana V2X
https://blog.nns.ee/2026/06/03/katana-badusb/ i also find this one fascinating for similar reasons:
1. "trivial" vuln (BT connection has same privs as USB) with everything else supporting that in a great writeup
2. vendor doesn't give a hoot & wont respond