diff --git a/docs/IOS27.2-KERNEL-DIFF.md b/docs/IOS27.2-KERNEL-DIFF.md
index 9422d22..a46eb7b 100644
--- a/docs/IOS27.2-KERNEL-DIFF.md
+++ b/docs/IOS27.2-KERNEL-DIFF.md
@@ -20,11 +20,15 @@ analysis did not wait for the full 26 GB. The container is IM4P; the payload is
 | Build | Kernelcache (decoded) | SHA-256 (first 16) |
 |---|---|---|
 | 27.0.1 | 78,315,520 B | `dec73956a9a443c5` |
-| 27.2 | 79,167,488 B | `9a6efbc4be67319a` |
+| 27.2 (v6x-pandia) | 78,675,968 B | `1aaf47dbc73650e3` |
 
-Both are `MH_FILESET` images with a `__DATA_SPTM` segment, carrying 303 (27.0.1) and
-305 (27.2) fileset entries. Two kexts are new: `com.apple.driver.ApplePencilDriver`,
-`com.apple.iokit.AppleSecurityResearch`; none were removed.
+Both are `MH_FILESET` images with a `__DATA_SPTM` segment, carrying 303 (27.0.1)
+and 304 (27.2) fileset entries. One kext is new: `com.apple.driver.ApplePencilDriver`;
+none were removed.
+
+27.2 ships three kernelcaches (`v63`, `v64`, `v6x-pandia`); iPhone19,7 uses
+`v6x-pandia` (member SHA-256 `0777eb09…`). The numbers and addresses below are
+from that member, not from the first kernelcache in the ZIP.
 
 ## Reading the diff
 
@@ -36,7 +40,7 @@ code is unchanged. The diff therefore keys on:
 2. `__cstring` / `__oslogstring` set difference (new checks usually add a message),
 3. `llvm-objdump` instruction diff for the kexts that survive both filters.
 
-93 of 303 common kexts changed text size. The largest are the ones the advisory
+93 of 303 common kexts changed text size (v6x-pandia). The largest are the ones the advisory
 points at:
 
 | Delta | Kext | Advisory component |
@@ -154,10 +158,10 @@ so treat the CVE attribution as an inference.
 
 | New string | Function (27.2) | Likely area |
 |---|---|---|
-| `size <= sdl->sdl_alen` | `0xfffffe000af62474` (assert at `0xfffffe000af6274c`) | sockaddr_dl / ifaddr bounds (info leak candidate, cf. 112665) |
-| `Failed mbuf validity check` | `0xfffffe000af238ac`, `0xfffffe000af42e70`, `0xfffffe000b08a1bc`, `0xfffffe000b1357a0` | mbuf length vs off+len (OOB read/write candidate) |
-| `VM entry %p lock shared lock overflow` | `0xfffffe000b52ed74` | vm_map shared-lock state (COW / 112576 candidate) |
-| `Page modified after framebank withdraw %p` | `0xfffffe000adf71b8` | pmap page lifecycle (UAF candidate) |
+| `size <= sdl->sdl_alen` | `0xfffffe000aeee474` (assert at `0xfffffe000aeee74c`) | sockaddr_dl / ifaddr bounds (info leak candidate, cf. 112665) |
+| `Failed mbuf validity check` | `0xfffffe000aeaf8ac`, `0xfffffe000aecee70`, `0xfffffe000b0161bc`, `0xfffffe000b0c17a0` | mbuf length vs off+len (OOB read/write candidate) |
+| `VM entry %p lock shared lock overflow` | `0xfffffe000b4bad74` | vm_map shared-lock state (COW / 112576 candidate) |
+| `Page modified after framebank withdraw %p` | `0xfffffe000ad831b8` | pmap page lifecycle (UAF candidate) |
 
 The `sdl` site is the most user-reachable of the four: it is on the network
 interface/address path and the string is an assertion added in 27.2. The mbuf