SPTM/MIE deep dive: sptm.t8160 820.22 -> 820.40.24 (+64 KiB)

- docs/SPTM-MIE-27.2.md: separate SPTM firmware changed (kernel __DATA_SPTM
  is not the monitor); new DART GAPF race, GMMU TLBI verification, iommu
  refcount, Dekker locks, hibernation handoff/latch checks; TXM build-only;
  Exclave +229 KB; MIE SK tag-page check unchanged (210 insns, relocated)
- candidate directions: DART unganged-GAPF race, hibernation handoff page
  count, SK tag-page aliasing, dangling tag storage; no working bypass
- correct the earlier claim that SPTM was unchanged
- tools: fw_diff, string_xref, func_string_diff

README.md

@@ -145,7 +145,7 @@ Kernel R/W feasibility for the high/critical entries is in [docs/KERNEL-RW-ASSES
 
 112507 reachability was re-measured on the target (iPhone19,7, iOS 27.0.1) with the new `kern.ipc.lifecycle` module and an `armed` counter in `kern.ipc`: `mach_port_request_notification` returns -300 (MIG_TYPE_ERROR) for every type/right combination tried, 0 armed out of 12,288 registrations. The request table is never armed, so the race is not reachable from an unentitled app; the earlier "survived the interleaving" line is retracted. Details in [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md).
 
-**iOS 27.2 firmware diff (27.0.1 vs 27.2, iPhone19,7):** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md). The update carries 162 advisory CVEs; 93 of 303 common kexts changed text size. Confirmed fix sites: 112705 clamps `NumberOfTemporalLayers` to 0…7 (`iNumberOfTemporalLayers <= 7` assertion), 113910 adds `chunk %u produced %lld of %lld expected bytes`, 112507 adds `ipr != NULL` / `table != NULL` in `ipc_misc.c`. `__DATA_SPTM` is byte-identical across both builds; the PPL/SPTM/MIE string and code surface is unchanged, so no bypass for those three is fixed in 27.2.
+**iOS 27.2 firmware diff (27.0.1 vs 27.2, iPhone19,7):** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md). The update carries 162 advisory CVEs; 93 of 303 common kexts changed text size. Confirmed fix sites: 112705 clamps `NumberOfTemporalLayers` to 0…7 (`iNumberOfTemporalLayers <= 7` assertion), 113910 adds `chunk %u produced %lld of %lld expected bytes`, 112507 adds `ipr != NULL` / `table != NULL` in `ipc_misc.c`. The kernel's `__DATA_SPTM` segment is byte-identical, but the separate `sptm.t8160` firmware changed from SPTM-820.0.22 to **820.40.24** (+64 KiB: DART/IOMMU, TLBI and hibernation hardening, not in the CVE list). MIE/MTE policy in SPTM/XNU is unchanged. See [docs/SPTM-MIE-27.2.md](docs/SPTM-MIE-27.2.md) for the deep dive and candidate bypass directions.
 
 ## Module semantics
 

README.zh-CN.md

@@ -144,7 +144,7 @@ armed 不是超时——是**死亡 oracle 命中**：负载触发进程崩溃
 
 112507 的可达性已在目标机（iPhone19,7 / iOS 27.0.1）上用新增的 `kern.ipc.lifecycle` 模块与 `kern.ipc` 的 `armed` 计数重测：`mach_port_request_notification` 在所有类型/权限组合上都返回 -300（MIG_TYPE_ERROR），12,288 次注册 0 次成功。请求表从未被武装，因此无特权 app 触达不到该竞态；此前“活过交错”的结论撤回。详见 [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md)。
 
-**iOS 27.2 固件 diff（27.0.1 vs 27.2，iPhone19,7）：** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md)。本次更新含 162 条公告 CVE；303 个共有 kext 中 93 个 `__TEXT_EXEC` 尺寸变化。已确认的修复点：112705 把 `NumberOfTemporalLayers` 收紧到 0…7（断言 `iNumberOfTemporalLayers <= 7`），113910 新增 `chunk %u produced %lld of %lld expected bytes`，112507 在 `ipc_misc.c` 新增 `ipr != NULL` / `table != NULL`。`__DATA_SPTM` 两版字节完全一致，PPL/SPTM/MIE 的字符串与代码面没有变化 —— 27.2 没有修这三个 bypass。
+**iOS 27.2 固件 diff（27.0.1 vs 27.2，iPhone19,7）：** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md)。本次更新含 162 条公告 CVE；303 个共有 kext 中 93 个 `__TEXT_EXEC` 尺寸变化。已确认的修复点：112705 把 `NumberOfTemporalLayers` 收紧到 0…7（断言 `iNumberOfTemporalLayers <= 7`），113910 新增 `chunk %u produced %lld of %lld expected bytes`，112507 在 `ipc_misc.c` 新增 `ipr != NULL` / `table != NULL`。kernel 里的 `__DATA_SPTM` 段两版字节一致，但独立的 `sptm.t8160` 固件从 SPTM-820.0.22 升到 **820.40.24**（+64 KiB：DART/IOMMU、TLBI 与休眠加固，不在 CVE 列表里）。SPTM/XNU 的 MIE/MTE 策略没有变化。深度分析与候选 bypass 方向见 [docs/SPTM-MIE-27.2.md](docs/SPTM-MIE-27.2.md)。
 
 ## 模块语义
 

docs/IOS27.2-KERNEL-DIFF.md

@@ -126,57 +126,25 @@ per-CVE signature.
 
 ## PPL / SPTM / MIE
 
-This is the part the request specifically asked to dig into.
+**Correction:** the kernel's `__DATA_SPTM` segment is byte-identical (311,296 B,
+same SHA), but SPTM is a separate firmware image and **did** change:
 
-- `__DATA_SPTM` is **byte-identical** in both builds: 311,296 bytes, SHA-256
-  `f4bc1e5e95f61af5…`. No SPTM code or data changed.
-- The PPL token strings (`UAT_PPL_IOCTL_*`, `PPL map operation failed`,
-  `PPL state object`) are unchanged; no new PPL checks or messages.
-- No MIE / Memory Integrity / mtag / page-protection strings were added or removed.
-- The only SPTM-related additions are boot-time memory-size validation:
-  `memsize=%u MB leaves no memory for XNU/SPTM to manage`, `Mismatch of
-  ARM_LARGE_MEMORY in SPTM/XNU`, and iBoot DRAM-size checks. These are
-  configuration checks, not a permission bypass.
-- The 27.2 advisory contains no component named PPL, SPTM, MIE, or Page Protection,
-  and no CVE description mentions them.
+- `Firmware/sptm.t8160`: SPTM-820.0.22 → **SPTM-820.40.24**, 1,261,600 → 1,327,136 B
+  (+64 KiB, all in `__LATE_CONST`); `__TEXT_EXEC` same size, different hash.
+- New checks: DART `VIOLATION_T8110_DART_UNGANG_GAPF_RACE`, GMMU TLBI
+  verification, IOMMU read-refcount validation, UAT Dekker lock timeouts,
+  `VIOLATION_NVME_ILLEGAL_HIBERNATION_QUEUE_LATCH`, hibernation handoff page count.
+- `txm.iphoneos`: same size, build-path/version only (Image4 374~7022 → 374~8637).
+- `exclavecore`: 33,259,754 → 33,489,130 B (+229,376) — separate domain.
+- MIE/MTE policy in SPTM is unchanged: the `MTE tag page containing SK tags`
+  check is a 210-instruction function in both builds (relocated, same shape), and
+  the kernel's MTE strings are identical. The Exclave image changed separately.
 
-**Verdict: no PPL, SPTM, or MIE bypass is fixed in iOS 27.2, and the firmware diff
-shows no change in the SPTM/PPL/MIE code paths.** A bypass PoC for any of the three
-would have to come from a different bug, not from this update. The kernel CVEs with
-"write kernel memory" impacts are ordinary kernel memory-safety bugs; none of them
-is a page-table / monitor bypass on its own, and exploiting one would still have to
-defeat SPTM/PPL/MIE at runtime.
-
-## The 15 Kernel CVEs — what the advisory claims vs. what the binary shows
-
-| CVE | Advisory impact | Description | Binary evidence | R/W potential |
-|---|---|---|---|---|
-| 2026-112474 | terminate or **write kernel memory** | UAF | vm_map / lock-overflow strings (candidate) | theoretical UAF→R/W, no trigger |
-| 2026-112476 | terminate | OOB read | kmalloc/zone paths, no unique string | read/DoS only |
-| 2026-112501 | terminate | race | — | DoS |
-| 2026-112507 | terminate or **write kernel memory** | OOB write | `ipr != NULL`, `table != NULL`, `ipc_misc.c` | **not reachable** from an unentitled app (-300) |
-| 2026-112514 | terminate or corrupt kernel memory | UAF | framebank / page-lifecycle strings (candidate) | theoretical |
-| 2026-112516 | terminate | UAF | — | DoS |
-| 2026-112517 | terminate or corrupt kernel memory | UAF | — | theoretical |
-| 2026-112576 | unexpected COW memory changes | memory integrity | `VM entry ... lock shared lock overflow` (candidate) | data-corruption primitive |
-| 2026-112606 | terminate | type confusion | — | theoretical |
-| 2026-112624 | bypass Privacy preferences | improved checks | new `com.apple.private.*` / TCC-adjacent strings (candidate) | privacy bypass, not kernel R/W |
-| 2026-112665 | determine kernel memory layout | info disclosure | `size <= sdl->sdl_alen` (candidate) | KASLR leak candidate |
-| 2026-112679 | terminate or corrupt kernel memory | UAF | — | theoretical |
-| 2026-112698 | terminate | memory handling | — | DoS |
-| 2026-65350 | terminate or corrupt kernel memory | UAF | — | theoretical |
-| 2026-84495 | terminate or **write kernel memory** | UAF | — | theoretical |
-
-"Advisory impact" is Apple's wording. "Binary evidence" is what the 27.2 kernel
-actually adds; where no unique string exists, the CVE cannot be pinned to a function
-from the image alone. "Theoretical" means the primitive class can lead to R/W, not
-that a working trigger is known. No trigger code for these 15 was recovered from the
-diff, and no PoC was fabricated.
-
-Note the discrepancy on 112507: Apple calls it an out-of-bounds write, while the
-27.2 fix is a NULL-check pair (`ipr`, `table`) plus a new `ipc_misc.c` string. A NULL
-dereference is a DoS, not a reclaimable out-of-bounds object; this matches the
-device result.
+The full analysis, function addresses, and candidate bypass directions (DART
+GAPF race, hibernation handoff, SK tag-page aliasing, dangling tag storage) are in
+[SPTM-MIE-27.2.md](SPTM-MIE-27.2.md). No working SPTM/MIE bypass was produced: the
+27.2 changes add checks, and the candidate paths need a reachable primitive that
+the diff does not contain.
 
 ## What can be turned into a PoC
 

docs/SPTM-MIE-27.2.md

@@ -0,0 +1,153 @@
+# SPTM / MIE deep dive — iOS 27.2 (24B119) vs 27.0.1 (24A446)
+
+This is the part that the kernelcache alone cannot answer. SPTM is a separate
+firmware image in the IPSW (`Firmware/sptm.t8160.release.im4p`), and it **did**
+change in 27.2. The earlier note that "SPTM is unchanged" was based only on the
+kernel's `__DATA_SPTM` segment and was wrong: that segment is identical, but the
+SPTM monitor itself is not.
+
+## Component inventory
+
+| Component | 27.0.1 | 27.2 | Change |
+|---|---|---|---|
+| `sptm.t8160` | 1,261,600 B · SPTM-820.0.22 | 1,327,136 B · SPTM-820.40.24 | **+65,536 B** |
+| `txm.iphoneos` | 557,088 B · Image4 374~7022 | 557,088 B · Image4 374~8637 | build-only |
+| `exclavecore.t8160` | 33,259,754 B | 33,489,130 B | +229,376 B |
+| kernel `__DATA_SPTM` | 311,296 B · sha f4bc1e5e… | 311,296 B · sha f4bc1e5e… | **identical** |
+| kernel MTE strings | `VM_KERN_MEMORY_MTAG`, taggable pages | same | unchanged |
+
+SPTM segment sizes:
+
+| Segment | 27.0.1 | 27.2 |
+|---|---|---|
+| `__TEXT_EXEC` | 425,984 | 425,984 |
+| `__LATE_CONST` | 524,288 | **589,824** (+65,536) |
+| `__TEXT` / `__DATA` / `__BOOTDATA` | 98,304 / 65,536 / 98,304 | same |
+
+The +64 KiB is entirely in `__LATE_CONST`; the executable text kept its size but
+its hash changed (`347aa218…` → `064c286f…`), so functions were edited/relocated.
+
+## What 27.2 adds to SPTM
+
+String diff (32 new, 7 removed) is dominated by IOMMU/DART and hibernation
+hardening — none of it is named in the 162-CVE advisory:
+
+- `VIOLATION_T8110_DART_UNGANG_GAPF_RACE`
+- `%s: %s: iommu_read_refcnt (0x%hhx) > read_refcnt(0x%x) for FTE %p`
+- `%s: Failed to verify TLBI`
+- `%s: The GMMU TLBI verification register should be 8B-aligned`
+- `gmmu-tlbi-verification-reg` / `gmmu-tlbi-verification-bit`
+- `%s: UAT Dekker gate acquisition timed out after %llu ns`
+- `%s: UAT Dekker lock acquisition timed out after %llu ns`
+- `%s: dart %p (%s:%u): relaxed_rw_protections and allow_pte_remap are not supported together`
+- `%s: dart %p (%s:%u): Inconsistent unganged clock protection configuration`
+- `VIOLATION_NVME_ILLEGAL_HIBERNATION_QUEUE_LATCH`
+- `hib_header_copy->handoffPageCount < HIB_HANDOFF_PAGECOUNT_LIMIT`
+- `sptm_allow_vm_isa_internal_guests`, `sptm_is_iuou_or_iuos_device`
+- `SPTM-820.40.24|2026-10-03:14:50:35`
+
+The TLBI string has five code xrefs in 27.2, at functions starting near
+`0xfffffff0270c7aac`, `0xfffffff0270c85f8`, `0xfffffff0270c987c`,
+`0xfffffff0270cacf4` and `0xfffffff027109940`. These are new/edited DART
+invalidation paths, not present in the 27.0.1 image.
+
+The DART violation names are not referenced by a direct `adr`/`adrp+add` — they
+are indexed through a violation table, so their exact raiser is a table lookup.
+The name itself is the evidence that 27.2 adds a check for the T8110 DART
+"ungang GAPF" race.
+
+## MIE / MTE surface
+
+MIE is not a single binary. The relevant pieces are:
+
+- **SPTM**: manages tag pages and checks `MTE tag page containing SK tags is
+  mapped`. The function is at `0xfffffff0270c6320` in 27.0.1 and
+  `0xfffffff0270d7028` in 27.2; both are exactly 210 instructions, same prologue
+  and same range-check shape (`subs` + `ccmp` against two globals). It was
+  relocated, not rewritten.
+- **Kernel**: the MTE page allocator (`VM_KERN_MEMORY_MTAG`, taggable pages, MTE
+  fill thread) has the same strings in both builds; no new MTE logic appears in
+  the 62 new kernel strings.
+- **Exclave core**: carries the PMM tag machinery (`pmmtag_l4_decode`,
+  `Conclave MTE tag check fault`, shared-memory tags), and grew by 229,376 B.
+  That is a separate firmware update; no CVE in the advisory names it.
+
+So the MIE *policy* surface in SPTM and XNU is unchanged in 27.2. The only
+MIE-adjacent code that changed is inside Exclave, which is a separate domain.
+
+Related SPTM strings that were already present in 27.0.1 and remain:
+
+- `%s: Dangling tag storage reference from previous mapping attempt`
+- `%s: Found SK-owned memory in non-wired memory`
+- `%s: dart %p (%s:%u): power down not permitted as SK still using the DART`
+
+The dangling-tag check is a real state machine: a previous tag-storage mapping
+attempt can leave a reference that SPTM detects later. It exists in both builds,
+so it is not a 27.2 fix; it is an audit target.
+
+## Why Titan does not transfer
+
+Titan (iOS 16.1–17.4b3, A14–A17) is not an SPTM logic bug. It uses:
+
+1. AGX coprocessor code execution to overwrite the AGX `power` thread state;
+2. the AGX hibernation context to restore a attacker-supplied `TTBR1_EL1` and a
+   second ROP stack (microPPL bypass);
+3. a self-referencing page-table entry to map and write any physical page,
+   defeating PPL/SPTM.
+
+Apple patched the AGX thread-state PAC in 18.1b4 and the TTBR restore in 17.4b4.
+The 27.2 SPTM diff is not a return of that bug: it is DART/hibernation hardening
+inside the monitor. A 27.2-era bypass would need a new primitive that can either
+(a) make SPTM map a page table it does not protect, or (b) corrupt the tag/SK
+metadata that SPTM trusts. There is no such primitive in the diff.
+
+## Candidate bypass directions (hypotheses, not PoCs)
+
+These are grounded in the 27.2 changes and the unchanged MIE checks. None is a
+working exploit; each needs a reachable primitive that the firmware diff does
+not supply.
+
+1. **DART unganged-GAPF race.** 27.2 adds a violation for a race between
+   unganging a DART and a page-table remap. On 27.0.1 the race can leave a stale
+   DART translation if a mapping is unganged while a PTE is remapped. A stale
+   IOMMU translation is a DMA read/write primitive to memory SPTM considers
+   protected. Reachability: a userclient that owns DART mappings (IOGPU, display,
+   NVMe, PCIe). This is the closest analogue to a "SPTM bypass", but it is an
+   IOMMU bypass, not a page-table permission bypass.
+2. **Hibernation handoff page count.** 27.2 adds
+   `hib_header_copy->handoffPageCount < HIB_HANDOFF_PAGECOUNT_LIMIT` and the
+   NVMe hibernation queue latch violation. On 27.0.1 a corrupted hibernation
+   header could make SPTM restore from a handoff page it did not size-check.
+   Reachability: modifying the hibernation image or the NVMe queue, not an app.
+3. **SK tag-page aliasing.** The SPTM check only rejects a tag page whose
+   physical address falls in the `[start,end)` range loaded from two globals. A
+   mapping that aliases the same physical tag page at a different PA, or a
+   remap that changes the range after the check, would let user-controlled tags
+   cover SK memory. That is an MIE bypass: forge the tag for an SK page, then
+   read/write it. Reachability: a kernel primitive that maps tag storage with a
+   user-influenced PA; not present in the 27.2 diff.
+4. **Dangling tag-storage reference.** SPTM already detects a dangling
+   reference from a previous mapping attempt. A race between unmap and remap of
+   tag storage could leave the stale reference usable; the freed tag page could
+   be reallocated as a user tag page. Same MIE impact as (3).
+
+## Verdict
+
+- SPTM **did** change: 820.0.22 → 820.40.24, +64 KiB, DART/TLBI/hibernation
+  hardening. The kernel-side `__DATA_SPTM` being identical is not evidence that
+  SPTM is unchanged.
+- No SPTM/MIE bypass is named in the 27.2 advisory, and no page-table permission
+  check was removed or weakened in the diff. The changes add checks.
+- MIE policy in SPTM/XNU is unchanged; Exclave changed separately.
+- A working bypass was **not** produced. The candidate paths above need a
+  reachable primitive (DART userclient, tag-storage mapping, or hibernation
+  image control) and a device session; writing one blind would be guesswork.
+
+## Reproduce
+
+```bash
+python3 tools/ipsw/remote_ipsw.py extract <url> sptm work/fw/27.2-sptm.im4p
+python3 tools/ipsw/ipswlib.py kernel ...          # IM4P/LZFSE decode
+python3 tools/string_xref.py work/fw/27.2-sptm.bin "Failed to verify TLBI"
+python3 tools/fw_diff.py work/fw/27.0.1-sptm.bin work/fw/27.2-sptm.bin
+```