docs: Cutter/rz-ghidra decompilation of the MTE gate and TLBI completion path

docs/SPTM-MIE-27.2.md

@@ -251,6 +251,32 @@ If a future iPhone build adds the DT property, the check runs and the window
 closes (panic `Failed to verify TLBI` on a still-pending GMMU TLBI). That is the
 condition to test in the next firmware.
 
+## Cutter / rz-ghidra decompilation
+
+The open-source decompiler in Cutter 2.5.0 (`rizin` + `rz-ghidra`, no Java) was used
+to confirm the two key functions. Raw `__TEXT_EXEC,__text` is loaded as ARM64, and
+`retab` is patched to `ret` in a copy so the decompiler does not truncate.
+
+MTE SK tag-page check (`0xfffffff0270d7028`, raw offset `0x23028`):
+
+```c
+if ((uint64_t)arg1 < *(uint64_t *)0xffffffffffffa218 ||
+    *(uint64_t *)0xffffffffffffa220 <= (uint64_t)arg1) {
+    func_0x0004b2ac(arg1);      // outside the SK tag-page PA range: normal path
+}
+// inside the range: panic "MTE tag page containing SK tags is mapped"
+```
+
+TLBI completion path (`0xfffffff0270c7aac`, raw offset `0x13aac`): the decompiler
+shows the verification state being read (`uVar15 >> bit & 1`), a countdown
+(`uVar14`), and the GMMU invalidation issued through a code pointer inside the
+loop; 27.0.1 lacks this block (function 264 vs 369 instructions).
+
+The IOGPU method handlers (`s_new_resource` at raw offset `0x70a4`,
+`s_submit_command_buffers` at `0x7434`) are PAC-heavy and the decompiler truncates
+at the first `pacibsppc`/`braa`; disassembly is still available, but selector
+recovery needs the dispatch table or a live kernel.
+
 ## Verification plan — GMMU TLBI completion race
 
 The static delta is real, but exploitability depends on keeping a DART client's