iOS 27.2 kernel differential + NTL fix-boundary sweep

- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
  CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
  assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
  NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
  code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
  extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
  now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7

docs/KERNEL-RW-ASSESSMENT.md

@@ -87,6 +87,10 @@ harness was measuring port churn, not the bug. The published fix shape (NULL che
 on `ipr` / `table`) is consistent with a denial or null-dereference path, not with a
 reclaimable object.
 
+**27.2 firmware confirmation (2026-10-31):** the 27.2 kernel adds `ipr != NULL` /
+`table != NULL` in `ipc_misc.c` — a NULL-check fix, not a reclaimable-object fix.
+The 27.0.1/27.2 kernelcache diff is in [IOS27.2-KERNEL-DIFF.md](IOS27.2-KERNEL-DIFF.md).
+
 **Verdict: closed for this app.** The remaining hypothetical is a platform process
 that is allowed to register notifications; that is outside Cinder27's reach.