docs: kernel CVE table — advisory impact vs binary evidence vs R/W potential

docs/IOS27.2-KERNEL-DIFF.md

@@ -147,6 +147,37 @@ would have to come from a different bug, not from this update. The kernel CVEs w
 is a page-table / monitor bypass on its own, and exploiting one would still have to
 defeat SPTM/PPL/MIE at runtime.
 
+## The 15 Kernel CVEs — what the advisory claims vs. what the binary shows
+
+| CVE | Advisory impact | Description | Binary evidence | R/W potential |
+|---|---|---|---|---|
+| 2026-112474 | terminate or **write kernel memory** | UAF | vm_map / lock-overflow strings (candidate) | theoretical UAF→R/W, no trigger |
+| 2026-112476 | terminate | OOB read | kmalloc/zone paths, no unique string | read/DoS only |
+| 2026-112501 | terminate | race | — | DoS |
+| 2026-112507 | terminate or **write kernel memory** | OOB write | `ipr != NULL`, `table != NULL`, `ipc_misc.c` | **not reachable** from an unentitled app (-300) |
+| 2026-112514 | terminate or corrupt kernel memory | UAF | framebank / page-lifecycle strings (candidate) | theoretical |
+| 2026-112516 | terminate | UAF | — | DoS |
+| 2026-112517 | terminate or corrupt kernel memory | UAF | — | theoretical |
+| 2026-112576 | unexpected COW memory changes | memory integrity | `VM entry ... lock shared lock overflow` (candidate) | data-corruption primitive |
+| 2026-112606 | terminate | type confusion | — | theoretical |
+| 2026-112624 | bypass Privacy preferences | improved checks | new `com.apple.private.*` / TCC-adjacent strings (candidate) | privacy bypass, not kernel R/W |
+| 2026-112665 | determine kernel memory layout | info disclosure | `size <= sdl->sdl_alen` (candidate) | KASLR leak candidate |
+| 2026-112679 | terminate or corrupt kernel memory | UAF | — | theoretical |
+| 2026-112698 | terminate | memory handling | — | DoS |
+| 2026-65350 | terminate or corrupt kernel memory | UAF | — | theoretical |
+| 2026-84495 | terminate or **write kernel memory** | UAF | — | theoretical |
+
+"Advisory impact" is Apple's wording. "Binary evidence" is what the 27.2 kernel
+actually adds; where no unique string exists, the CVE cannot be pinned to a function
+from the image alone. "Theoretical" means the primitive class can lead to R/W, not
+that a working trigger is known. No trigger code for these 15 was recovered from the
+diff, and no PoC was fabricated.
+
+Note the discrepancy on 112507: Apple calls it an out-of-bounds write, while the
+27.2 fix is a NULL-check pair (`ipr`, `table`) plus a new `ipc_misc.c` string. A NULL
+dereference is a DoS, not a reclaimable out-of-bounds object; this matches the
+device result.
+
 ## What can be turned into a PoC
 
 | CVE | Primitive | PoC status |