112507 reachability closed: notification registration refused (-300)

- New kern.ipc.lifecycle module: dead-name registration, dead-name send,
  notification receive, name reuse — single-threaded, safe on device
- Device receipt (iPhone19,7, iOS 27.0.1, ad-hoc signed): request DEAD_NAME
  returns -300 (MIG_TYPE_ERROR); send -> MACH_SEND_INVALID_DEST; receive
  times out; 0/12,288 registrations armed in kern.ipc
- macOS 27 sweep: 13 notification-type/right combinations, all -300
- kern.ipc now counts armed registrations and retracts the old 'survived'
  verdict when armed == 0; the request table is never armed
- docs/KERNEL-RW-ASSESSMENT.md: 112507 marked closed for this app
- app 2.2 build 5; 57 modules

Sources/Catalog4.swift

@@ -234,6 +234,45 @@ extension Catalog {
                                      evidence: [tl("27.2 在 encodeNextFrame 比较帧尺寸"), tl("崩溃版应留下 processDied")])
             }),
 
+
+        // ── CVE-2026-112507 · port lifecycle baseline ───────────────────────
+        ExploitModule(
+            id: "kern.ipc.lifecycle",
+            titleZh: "Mach 端口死名通知与名字复用基线（112507 前置）",
+            cve: "CVE-2026-112507",
+            component: "XNU · ipc_port request table",
+            primitive: .probe,
+            reach: .kernel,
+            tier: 3,
+            summaryZh: """
+            单线程走一遍 112507 竞态必须保持正确的生命周期：申请 receive right → 插入 send right → 注册 dead-name 通知 → 丢弃 receive right（send right 变成死名）→ 向死名发送（应为 MACH_SEND_INVALID_DEST）→ 从通知端口收 dead-name 消息 → 释放死名并观察同一数字名是否被下一次分配复用。它不制造竞态，也不释放活着的请求表项。
+            """,
+            notesZh: """
+            这是竞态模块的前置基线，不会打崩内核。两项观测决定 112507 的结论是否成立：dead-name 通知是否真的送达、名字是否会被复用。若这里就异常，先查平台语义，不要把它当成 UAF 证据。真机上通知注册应返回 KERN_SUCCESS；模拟器上可能出现注册被拒。
+            """,
+            run: { ctx in
+                ctx.arm("kern.ipc.lifecycle", "dead-name lifecycle")
+                let r = KernelIPC.lifecycle()
+                ctx.disarm("kern.ipc.lifecycle",
+                           "dead=\(r.deadName) reuse=\(r.reused) | " + r.lines.joined(separator: " | "))
+                let head: String
+                if r.requestKR != KERN_SUCCESS {
+                    head = tl("通知注册被拒") + " (\(r.requestKR))" + tl(" — 112507 路径无法武装")
+                } else if r.deadName && r.reused {
+                    head = tl("dead-name 送达 · 名字被复用")
+                } else if r.deadName {
+                    head = tl("dead-name 送达 · 名字未复用")
+                } else {
+                    head = tl("通知已注册但 dead-name 未送达 —— 查通知顺序")
+                }
+                return ModuleOutcome(
+                    headline: head,
+                    detail: r.lines.joined(separator: "\n"),
+                    evidence: [tl("send to dead name 应为 MACH_SEND_INVALID_DEST"),
+                               tl("dead-name 消息 id = 0x40000002"),
+                               tl("复用只记录，不构成本身结论")])
+            }),
+
         // ── CVE-2026-84636 · SCDynamicStore without wifi-info ───────────────
         ExploitModule(
             id: "sc.dynamicstore",