# AVE27 — standalone POC app for CVE-2026-112705

Standalone iOS app for **CVE-2026-112705** — AppleAVE2 kernel out-of-bounds write
via `NumberOfTemporalLayers` (VideoToolbox). Original discovery: Calif / Chollima
team; this app ports the reproduction from
[MchinaMd57764/AVETemporalPoC-CVE-2026-112705](https://github.com/MchinaMd57764/AVETemporalPoC-CVE-2026-112705)
into a self-contained, interactive harness and extends it with exploration stages.

- Component: `com.apple.driver.AppleAVE2` (kernel)
- Type: kernel OOB write, fixed-offset constant fill — panic/DoS, **no** read/write primitive
- Affected: iOS 27.0 – 27.1 (24A446 line)
- Fixed: iOS 27.2 — `NTL` returns `-12900` at SetProperty, no panic
- Highest supported target: **iOS 27.1**

## What the app does

All nine original stages ported verbatim (props readback, encode trigger, property
fuzz, multi-PPS, layer-ID probe, bitstream dump, NTL ladder, per-rung parameter-set
capture, DPB-array overflow, UserDPB IOSurface table, H.264 slice-count decode,
MVHEVC ID validation, sandbox-extension probe), plus three new exploration stages:

| Stage | What it maps |
|---|---|
| **stage9** | the panic trigger: `EncoderUsage=1` + `RCMode=20` + `NTL=16463` → first encode panics AppleAVE2 (kernel data abort, `far=0x59 x19=0x1`); 16462 survives |
| **stage13** | NTL threshold sweep, bottom-up, one session per rung — finds the exact landing rung; panic journal arms per rung |
| **stage14** | `EncoderUsage` × `RCMode` acceptance matrix at a safe layer count — which private mode selectors the driver honours from a stock app |
| **stage15** | private-key audit: 23 non-public VideoToolbox keys set from an unentitled sandboxed app; the accepted set is the privilege surface reaching AppleAVE2 |
| **SBE** | sandbox-extension issuance probe — can a third-party app issue read/write extensions for paths outside its container |
| panic journal | armed before every panic-capable encode; on next launch, an unfinished journal + changed `kern.boottime` = that run ended in a kernel panic, in-app, no console needed |

Interactive UI: stage buttons, NTL field, live monospaced console, report share
sheet. Launch-argument mode keeps full parity with the original repo
(`--stage9 16463`, `--stage13`, `--fuzz`, `--sbext`, …). Report lands in
`Documents/ave_report.txt`, live oracle in `Documents/live.txt` — the last line
before a panic is `stage9(...) encode[0]`.

## Building

```bash
bash scripts/build-device.sh     # → dist/AVE27-unsigned.ipa (arm64, iOS 17.0+, unsigned)
python3 scripts/gen_icon.py      # regenerates the app icon (no image library needed)
```

Unsigned IPA — sign with your own certificate + provisioning profile, then
sideload. The simulator has no hardware encode path; panic stages need a real
device on 27.0/27.1.

## Panic evidence workflow

1. Launch → tap **stage9 panic** (or `--stage9 16463`). Device reboots.
2. Relaunch. The header still says PANIC-CAPABLE; the console opens with the
   journal verdict: which stage, which rung, which boot — and points at
   Settings → Privacy → Analytics for the matching `.ips`.
3. Export `ave_report.txt` / `live.txt` from Files → AVE27.

## Credits & scope

Original discovery and panic evidence: **Calif / Chollima team**, independent
reproduction by MchinaMd57764. This app reproduces a public, already-patched CVE
for verification and research on devices you own. It contains no exploitation
code — the defect is a fixed-offset constant fill with no read/write capability.