I found a vulnerability that allowed me to unlock any @Google Pixel phone without knowing the passcode. This may be my most impactful bug so far.
Google fixed the issue in the November 5, 2022 security patch. Update your devices!
Managed to make it charge & shift into drive! -- Found a post from @jwardell with a 2018 raw CAN data recording and replayed it with a Raspberry Pi to the MCU:
Managed to connect the Raspberry Pi to the Tesla's CAN bus -- for some reason only seeing traffic on the "Chassis" bus, the other two (Vehicle, Party) are silent.