SPTM: record IOGPU handler addresses and selector-recovery blocker

docs/SPTM-MIE-27.2.md

@@ -225,6 +225,13 @@ skipped.
   `uat_get_root_table_paddr`, `pmap_iommu_ioctl_internal` and
   `sptm_check_sapt_is_writable`. So the user path from IOGPU to the SPTM UAT
   unmap exists unchanged.
+- Method handler addresses in the final v6x kext:
+  `IOGPUDeviceUserClient::s_new_resource` = `0xfffffe000a176094`,
+  `s_submit_command_buffers` = `0xfffffe000a176424`. Selector recovery is still
+  blocked: there is no direct `bl` to either handler and no raw/chained pointer
+  in the kext or the kernelcache; the dispatch is indirect and the table is
+  relocated at boot. Recovering the selector numbers needs a decompiler
+  (Ghidra/IDA/Hopper) or a live kernel view, neither of which is available here.
 - On iPhone19,7, the GMMU TLBI completion window is **not closed by 27.2**.
   The UAT unmap → data page freed → GMMU stale translation race remains.
 - The fix is a code change plus a per-device DeviceTree gate; the gate is absent