AVE27 — standalone POC app for CVE-2026-112705

Standalone iOS app for CVE-2026-112705 — AppleAVE2 kernel out-of-bounds write via NumberOfTemporalLayers (VideoToolbox). Original discovery: Calif / Chollima team; this app ports the reproduction from MchinaMd57764/AVETemporalPoC-CVE-2026-112705 into a self-contained, interactive harness and extends it with exploration stages.

• Component: com.apple.driver.AppleAVE2 (kernel)
• Type: kernel OOB write, fixed-offset constant fill — panic/DoS, no read/write primitive
• Affected: iOS 27.0 – 27.1 (24A446 line)
• Fixed: iOS 27.2 — NTL returns -12900 at SetProperty, no panic
• Highest supported target: iOS 27.1

What the app does

All nine original stages ported verbatim (props readback, encode trigger, property fuzz, multi-PPS, layer-ID probe, bitstream dump, NTL ladder, per-rung parameter-set capture, DPB-array overflow, UserDPB IOSurface table, H.264 slice-count decode, MVHEVC ID validation, sandbox-extension probe), plus three new exploration stages:

Stage	What it maps
stage9	the panic trigger: EncoderUsage=1 + RCMode=20 + NTL=16463 → first encode panics AppleAVE2 (kernel data abort, far=0x59 x19=0x1); 16462 survives
stage13	NTL threshold sweep, bottom-up, one session per rung — finds the exact landing rung; panic journal arms per rung
stage14	EncoderUsage × RCMode acceptance matrix at a safe layer count — which private mode selectors the driver honours from a stock app
stage15	private-key audit: 23 non-public VideoToolbox keys set from an unentitled sandboxed app; the accepted set is the privilege surface reaching AppleAVE2
SBE	sandbox-extension issuance probe — can a third-party app issue read/write extensions for paths outside its container
panic journal	armed before every panic-capable encode; on next launch, an unfinished journal + changed kern.boottime = that run ended in a kernel panic, in-app, no console needed

Interactive UI: stage buttons, NTL field, live monospaced console, report share sheet. Launch-argument mode keeps full parity with the original repo (--stage9 16463, --stage13, --fuzz, --sbext, …). Report lands in Documents/ave_report.txt, live oracle in Documents/live.txt — the last line before a panic is stage9(...) encode[0].

Building

bash scripts/build-device.sh     # → dist/AVE27-unsigned.ipa (arm64, iOS 17.0+, unsigned)
python3 scripts/gen_icon.py      # regenerates the app icon (no image library needed)

Unsigned IPA — sign with your own certificate + provisioning profile, then sideload. The simulator has no hardware encode path; panic stages need a real device on 27.0/27.1.

Panic evidence workflow

1. Launch → tap stage9 panic (or --stage9 16463). Device reboots.
2. Relaunch. The header still says PANIC-CAPABLE; the console opens with the journal verdict: which stage, which rung, which boot — and points at Settings → Privacy → Analytics for the matching .ips.
3. Export ave_report.txt / live.txt from Files → AVE27.

Credits & scope

Original discovery and panic evidence: Calif / Chollima team, independent reproduction by MchinaMd57764. This app reproduces a public, already-patched CVE for verification and research on devices you own. It contains no exploitation code — the defect is a fixed-offset constant fill with no read/write capability.