112507 reachability closed: notification registration refused (-300)

- New kern.ipc.lifecycle module: dead-name registration, dead-name send,
  notification receive, name reuse — single-threaded, safe on device
- Device receipt (iPhone19,7, iOS 27.0.1, ad-hoc signed): request DEAD_NAME
  returns -300 (MIG_TYPE_ERROR); send -> MACH_SEND_INVALID_DEST; receive
  times out; 0/12,288 registrations armed in kern.ipc
- macOS 27 sweep: 13 notification-type/right combinations, all -300
- kern.ipc now counts armed registrations and retracts the old 'survived'
  verdict when armed == 0; the request table is never armed
- docs/KERNEL-RW-ASSESSMENT.md: 112507 marked closed for this app
- app 2.2 build 5; 57 modules

docs/KERNEL-RW-ASSESSMENT.md

@@ -29,7 +29,7 @@ the POCs.
 | 2026-112705 | AppleAVE2 `NumberOfTemporalLayers` | fixed-offset constant fill in the driver | no | fixed value, fixed offset | **DoS only.** No address control, no value control. The original write-up says explicitly: no arbitrary read/write capability. |
 | 2026-65385 | IOKit `IOHIDEventAppendEvent` | fixed-offset write into a short heap allocation | no | bounded, offset fixed | **Not reachable as a primitive here.** The POC stops at symbol resolution; the vendor-defined constructor is missing on the host. No leak, no reclaim, no gadget. |
 | 2026-112696 | AppleH16ANEInterface | kernel interface reachability | no | none observed | **No primitive.** The ANE kernel symbols are absent for a third-party process; the module is an honest negative. |
-| 2026-112507 | XNU `ipc_port.c` request-table race | stale index → UAF-shaped race | no | none direct | **The only theoretical UAF path.** The POC proves the interleaving survives; it does not produce a controlled free, a reclaim, or a leak. |
+| 2026-112507 | XNU `ipc_port.c` request-table race | stale index → UAF-shaped race | no | none direct | **Not reachable from the app.** Device receipt: 12,288 notification registrations, 0 armed, 12,288 refused with -300 (MIG_TYPE_ERROR). No request-table entry exists, so there is no stale index to consume. |
 | 2026-113910 | decmpfs chunked zlib | under-produced chunks expose uninitialised kernel heap through a file read | **yes** (bounded) | no | **Leak only.** Useful as a KASLR step; cannot write. |
 | 2026-112554 | GPT partition-name scan | 72-B scan over a 28-B field | **yes** (bounded, model) | no | **Leak only.** The C twin models the width; the real read runs in the storage kext. |
 
@@ -67,7 +67,30 @@ address. The only observable is a kernel data abort. Calling this "R/W" would
 require a second bug that turns the corrupted field into a pointer; nothing in the
 dossier provides one. The correct classification is a reliable kernel DoS.
 
-### CVE-2026-112507 — the UAF-shaped race
+### CVE-2026-112507 — reachability closed on the device (2026-10-31)
+
+The staged lifecycle harness was run on the target device (iPhone19,7, iOS 27.0.1)
+with an ad-hoc signed build, and the race module was re-run with an `armed` counter:
+
+- `mach_port_request_notification(DEAD_NAME)` → **-300** (MIG_TYPE_ERROR), `prev = 0`.
+- Send to the dead name → `MACH_SEND_INVALID_DEST`; receive → `MACH_RCV_TIMED_OUT`.
+- `kern.ipc`: 12,288 registration attempts, **0 armed, 12,288 refused**.
+- On macOS 27 the same call was swept over 13 combinations of notification type
+  (SEND_POSSIBLE / PORT_DESTROYED / NO_SENDERS / DEAD_NAME) and right layout
+  (receive-only, send+receive, send-only; notify port receive or send). Every
+  combination returned -300.
+
+The kernel refuses to arm a request-table entry for this process. With no entry,
+the stale-index consumers in `ipc_port.c` have nothing to consume: the race cannot
+be driven from an unentitled third-party app, and the "survived" line from the old
+harness was measuring port churn, not the bug. The published fix shape (NULL checks
+on `ipr` / `table`) is consistent with a denial or null-dereference path, not with a
+reclaimable object.
+
+**Verdict: closed for this app.** The remaining hypothetical is a platform process
+that is allowed to register notifications; that is outside Cinder27's reach.
+
+### CVE-2026-112507 — the race itself
 
 The ring allocates receive rights, arms two notification kinds per port, tears down
 half the ring, then sends to the survivors. The request-table index consumers are
@@ -120,7 +143,9 @@ on the host.
 ## Bottom line
 
 Arbitrary kernel R/W without a panic is **not achievable from these six entries as
-shipped**. The maximum safe capability the lab now demonstrates is:
+shipped**, and the one entry that had a theoretical UAF path (112507) is now closed
+by device evidence: notification registration is refused, so the request table is
+never armed. The maximum safe capability the lab demonstrates is:
 
 - a repeatable kernel heap **leak** with pointer classification (113910);
 - a read-width model for the GPT scan (112554);