diff --git a/docs/SPTM-MIE-27.2.md b/docs/SPTM-MIE-27.2.md index 337eed0..f92f4a0 100644 --- a/docs/SPTM-MIE-27.2.md +++ b/docs/SPTM-MIE-27.2.md @@ -216,6 +216,15 @@ skipped. ### What this means +- Reachability on the final 27.2 v6x-pandia build is confirmed: the + `IOGPUFamily` kext still exports `IOGPUDeviceUserClient::s_new_resource`, + `s_submit_command_buffers`, `s_create_io_command_queue`, + `s_destroy_io_command_queue`, `s_perform_io`, `s_group_add_resources`, + `s_group_remove_resources`, `s_create_vniodesc`; the kernel still contains + `IOUAT doUnmap/queueUnmap/commitUnmaps/prepareFWUnmap`, + `uat_get_root_table_paddr`, `pmap_iommu_ioctl_internal` and + `sptm_check_sapt_is_writable`. So the user path from IOGPU to the SPTM UAT + unmap exists unchanged. - On iPhone19,7, the GMMU TLBI completion window is **not closed by 27.2**. The UAT unmap → data page freed → GMMU stale translation race remains. - The fix is a code change plus a per-device DeviceTree gate; the gate is absent