AVE27 — standalone POC app for CVE-2026-112705 (AppleAVE2 NTL OOB write)

- All stages ported from MchinaMd57764/AVETemporalPoC (orig. Calif/Chollima):
  stage1-12, 20, 21, fuzz, SBE — launch-arg parity kept
- New: stage13 NTL threshold sweep, stage14 usage×rc acceptance matrix,
  stage15 private-key entitlement audit (23 keys)
- Panic journal: kern.boottime-based in-app panic evidence after reboot
- Interactive SwiftUI console + NTL field + report share; header shows
  PANIC-CAPABLE on iOS 27.0-27.1, FIXED BUILD on 27.2+
- App icon: temporal-layer stack, top layer displaced past the stack edge
- scripts/build-device.sh → unsigned arm64 IPA (iOS 17.0+)

README.md

@@ -0,0 +1,61 @@
+# AVE27 — standalone POC app for CVE-2026-112705
+
+Standalone iOS app for **CVE-2026-112705** — AppleAVE2 kernel out-of-bounds write
+via `NumberOfTemporalLayers` (VideoToolbox). Original discovery: Calif / Chollima
+team; this app ports the reproduction from
+[MchinaMd57764/AVETemporalPoC-CVE-2026-112705](https://github.com/MchinaMd57764/AVETemporalPoC-CVE-2026-112705)
+into a self-contained, interactive harness and extends it with exploration stages.
+
+- Component: `com.apple.driver.AppleAVE2` (kernel)
+- Type: kernel OOB write, fixed-offset constant fill — panic/DoS, **no** read/write primitive
+- Affected: iOS 27.0 – 27.1 (24A446 line)
+- Fixed: iOS 27.2 — `NTL` returns `-12900` at SetProperty, no panic
+- Highest supported target: **iOS 27.1**
+
+## What the app does
+
+All nine original stages ported verbatim (props readback, encode trigger, property
+fuzz, multi-PPS, layer-ID probe, bitstream dump, NTL ladder, per-rung parameter-set
+capture, DPB-array overflow, UserDPB IOSurface table, H.264 slice-count decode,
+MVHEVC ID validation, sandbox-extension probe), plus three new exploration stages:
+
+| Stage | What it maps |
+|---|---|
+| **stage9** | the panic trigger: `EncoderUsage=1` + `RCMode=20` + `NTL=16463` → first encode panics AppleAVE2 (kernel data abort, `far=0x59 x19=0x1`); 16462 survives |
+| **stage13** | NTL threshold sweep, bottom-up, one session per rung — finds the exact landing rung; panic journal arms per rung |
+| **stage14** | `EncoderUsage` × `RCMode` acceptance matrix at a safe layer count — which private mode selectors the driver honours from a stock app |
+| **stage15** | private-key audit: 23 non-public VideoToolbox keys set from an unentitled sandboxed app; the accepted set is the privilege surface reaching AppleAVE2 |
+| **SBE** | sandbox-extension issuance probe — can a third-party app issue read/write extensions for paths outside its container |
+| panic journal | armed before every panic-capable encode; on next launch, an unfinished journal + changed `kern.boottime` = that run ended in a kernel panic, in-app, no console needed |
+
+Interactive UI: stage buttons, NTL field, live monospaced console, report share
+sheet. Launch-argument mode keeps full parity with the original repo
+(`--stage9 16463`, `--stage13`, `--fuzz`, `--sbext`, …). Report lands in
+`Documents/ave_report.txt`, live oracle in `Documents/live.txt` — the last line
+before a panic is `stage9(...) encode[0]`.
+
+## Building
+
+```bash
+bash scripts/build-device.sh     # → dist/AVE27-unsigned.ipa (arm64, iOS 17.0+, unsigned)
+python3 scripts/gen_icon.py      # regenerates the app icon (no image library needed)
+```
+
+Unsigned IPA — sign with your own certificate + provisioning profile, then
+sideload. The simulator has no hardware encode path; panic stages need a real
+device on 27.0/27.1.
+
+## Panic evidence workflow
+
+1. Launch → tap **stage9 panic** (or `--stage9 16463`). Device reboots.
+2. Relaunch. The header still says PANIC-CAPABLE; the console opens with the
+   journal verdict: which stage, which rung, which boot — and points at
+   Settings → Privacy → Analytics for the matching `.ips`.
+3. Export `ave_report.txt` / `live.txt` from Files → AVE27.
+
+## Credits & scope
+
+Original discovery and panic evidence: **Calif / Chollima team**, independent
+reproduction by MchinaMd57764. This app reproduces a public, already-patched CVE
+for verification and research on devices you own. It contains no exploitation
+code — the defect is a fixed-offset constant fill with no read/write capability.