kernel diff: candidate fix-site functions for sdl/mbuf/vm_map/framebank checks

docs/IOS27.2-KERNEL-DIFF.md

@@ -146,6 +146,24 @@ GAPF race, hibernation handoff, SK tag-page aliasing, dangling tag storage) are
 27.2 changes add checks, and the candidate paths need a reachable primitive that
 the diff does not contain.
 
+## Kernel fix-site candidates (27.2, address in the final 24B119 kernelcache)
+
+These are the functions that reference the new 27.2 strings. They are candidate
+fix sites for the 15 Kernel CVEs; the advisory does not map a CVE to a function,
+so treat the CVE attribution as an inference.
+
+| New string | Function (27.2) | Likely area |
+|---|---|---|
+| `size <= sdl->sdl_alen` | `0xfffffe000af62474` (assert at `0xfffffe000af6274c`) | sockaddr_dl / ifaddr bounds (info leak candidate, cf. 112665) |
+| `Failed mbuf validity check` | `0xfffffe000af238ac`, `0xfffffe000af42e70`, `0xfffffe000b08a1bc`, `0xfffffe000b1357a0` | mbuf length vs off+len (OOB read/write candidate) |
+| `VM entry %p lock shared lock overflow` | `0xfffffe000b52ed74` | vm_map shared-lock state (COW / 112576 candidate) |
+| `Page modified after framebank withdraw %p` | `0xfffffe000adf71b8` | pmap page lifecycle (UAF candidate) |
+
+The `sdl` site is the most user-reachable of the four: it is on the network
+interface/address path and the string is an assertion added in 27.2. The mbuf
+site is next. Neither has a trigger or a demonstrated R/W effect; they are the
+next functions to audit with a device.
+
 ## What can be turned into a PoC
 
 | CVE | Primitive | PoC status |