- parser at 0xfffffff0270cbe18 sets the verify flag to 0 when
/arm-io/sgx lacks verify-gmmu-tlbis-at-sync
- BuildManifest maps iPhone19,7 -> v64sap; that DT lacks the key, as do
iBoot, AGX and the kernelcache; only SPTM contains the strings
- consequence: the GMMU TLBI completion window remains open on iPhone 27.2
(fix-gating gap, not a new memory-safety bug)
Catalog.groups is a hard-coded list and did not include the arrivals catalog,
so the five new modules (112705 probe/fire, 112621 probe/fire, 84636) and
kern.ipc.lifecycle were counted in Catalog.all but invisible in the POCs tab.
Add a localized 新收录 / New arrivals group at the top; simulator screenshot
confirms all six entries render. Build 6.
- docs/KERNEL-RW-ASSESSMENT.md: per-primitive verdict. None of the six
kernel-reachable bugs supplies both address and value control; the chain
requirements (KASLR, grooming, reclaim, gadget, PAC/PPL) are listed per entry
- CVE-2026-113910.c: leak collector — 8 chunk configs x --loop, canonical
pointer classification (kernel-text / kernel-data / kernel-other), --keep
raw dump, --verbose; candidates are printed, never dereferenced
- 112705 / 65385 / 112696: explicit primitive-limit headers (DoS, fixed-offset
write without leak, honest negative); no blind writes
- README: link the assessment and the new 113910 receipt (0 candidates, 16 runs)
Three public research arrivals, each with a .swift and .c POC folder:
- CVE-2026-112705 (AppleAVE2 NumberOfTemporalLayers): app split into a
property probe (ave.ntl) and a deliberate fire module (ave.ntl.fire);
C twin carries a --force-host gate because a frame submit reaches the
same driver that panicked the dev Mac, so the host only builds it
- CVE-2026-112621 (LinkPresentation LPAnimatedImageTranscoder): 256x16 ->
256x48 container, loopback og:image delivery, LPMetadataProvider; probe
checks the pool math, fire runs the real transcode; C twin reproduces the
48-row clear against a guard page (32,768 B past the 16,384-byte pool)
- CVE-2026-84636 (configd dynamic store): SSID + router MAC without the
wifi-info entitlement, compared in-process with CNCopyCurrentNetworkInfo
56 modules, 34 CVE folders, 45 Swift POC files, 34 C twins. Device IPA
2.1 build 4; simulator regression: sc.dynamicstore / ave.ntl / lp.heic all
done (overflow=32768, NTL refused 0/4 on the simulator's encoder path).
- 31 C POC files, one per CVE folder: full seed construction + trigger +
main(), self-contained, no app dependency. All compile clean with
clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
(CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.
JBJF