SPTM: 27.2 TLBI verification is DeviceTree-gated and the gate is absent on iPhone19,7

- parser at 0xfffffff0270cbe18 sets the verify flag to 0 when
  /arm-io/sgx lacks verify-gmmu-tlbis-at-sync
- BuildManifest maps iPhone19,7 -> v64sap; that DT lacks the key, as do
  iBoot, AGX and the kernelcache; only SPTM contains the strings
- consequence: the GMMU TLBI completion window remains open on iPhone 27.2
  (fix-gating gap, not a new memory-safety bug)

docs/SPTM-MIE-27.2.md

@@ -164,6 +164,58 @@ not supply.
   reachable primitive (DART userclient, tag-storage mapping, or hibernation
   image control) and a device session; writing one blind would be guesswork.
 
+## Critical finding — the 27.2 TLBI verification is disabled on iPhone19,7
+
+The check is conditional. SPTM's `uat_bootstrap_parse_dt` (27.2,
+`0xfffffff0270cbe18`) reads the `/arm-io/sgx` node and looks up
+`verify-gmmu-tlbis-at-sync`. The property-missing path is explicit:
+
+```
+0xfffffff0270cc184  adrp x8, 0xfffffff0270ae000
+0xfffffff0270cc188  ldr  x22, [x8, #0x208]
+0xfffffff0270cc18c  strb wzr, [x22, #0x81]     ; verify flag = 0
+0xfffffff0270cc190  ... continue parsing
+```
+
+So if the property is absent, the verification is **off**, not fatal.
+
+Now the device mapping:
+
+- `BuildManifest.plist` maps **iPhone19,7 → DeviceClass `v64sap`**.
+- The 27.2 `DeviceTree.v64sap.im4p` (406,684 B decoded) contains
+  `agx-address-space-mgmt-mode`, `tlbi-aperture-offset`, `dart-options` and the
+  SAPT node, but **no** `verify-gmmu-tlbis-at-sync`,
+  `gmmu-tlbi-verification-reg` or `gmmu-tlbi-verification-bit`.
+- The same strings are absent from the 27.2 iBoot, the AGX firmware, and the
+  whole kernelcache. They exist only in SPTM itself.
+
+The iPad images the reference report analysed (`j817ap` / `j820ap`) do carry the
+property, which is why beta3 looks fixed there. On iPhone19,7 the gate is
+missing, so the 27.2 build executes the **beta2 behaviour**: AMXOP25 loop →
+`dsb oshnxs` → clear pending count → continue, with the verification block
+skipped.
+
+### What this means
+
+- On iPhone19,7, the GMMU TLBI completion window is **not closed by 27.2**.
+  The UAT unmap → data page freed → GMMU stale translation race remains.
+- The fix is a code change plus a per-device DeviceTree gate; the gate is absent
+  on the iPhone 19,7 image. This is a fix-gating gap, not a new memory-safety bug.
+- This makes the Titan-style end goal (data page → PAPT page → GPU stale write →
+  RO-zone writable alias) still applicable on an iPhone running 27.2, assuming
+  the rest of the chain is reachable.
+
+Caveat: this is static evidence (parser + DT + BuildManifest + component search).
+Runtime confirmation is a 27.2 iPhone boot with the DT dumped and the SPTM verify
+flag read; that device was not available here. The 18PM in this lab is 27.0.1,
+where the check does not exist at all.
+
+### If the flag is present
+
+If a future iPhone build adds the DT property, the check runs and the window
+closes (panic `Failed to verify TLBI` on a still-pending GMMU TLBI). That is the
+condition to test in the next firmware.
+
 ## Verification plan — GMMU TLBI completion race
 
 The static delta is real, but exploitability depends on keeping a DART client's