I have device powered by Qualcomm MSM8974AC Snapdragon 801 cpu and running Cyanogenmod 13 (6.0.1 android) rom with unlocked bootloader and TWRP (3.0) recovery. ROM has security patch level December 2016. Device is encrypted by FDE (Full-disk encryption) and using same PIN for lock-screen and booting.
Let's say attacker has full psyhical access to this device. The point of attack is decrypt data. Attacker has unlimited tries of entering password:
devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java: DEF_MAXIMUM_FAILED_PASSWORDS_FOR_WIPE = 0
Based on that article if am understanding correctly the only possible way is exploiting TrustZone or Keymaster vulnerability and then just bruteforce psyhical dump on powerful machine.
But thats seems like got patched in January 2016 and May 2016 security bulletin (CVE-2015-6639 CVE-2015-6647 CVE-2016-2431 CVE-2016-2432)
So the question is it still possible without OEM help of course?