cinder27

7 Commits 1 Branch 6 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
JBJF	3ac5108928	iOS 27.2 kernel differential + NTL fix-boundary sweep - docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7 assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE code change or bypass fix - tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext extractor, llvm-objdump diff, advisory mapper - CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module now sweeps 0/1/7/8/64/1024/16462/16463 - app 2.3 build 7	2026-10-31 17:09:48 +08:00
JBJF	6f4ed67c38	112507 reachability closed: notification registration refused (-300) - New kern.ipc.lifecycle module: dead-name registration, dead-name send, notification receive, name reuse — single-threaded, safe on device - Device receipt (iPhone19,7, iOS 27.0.1, ad-hoc signed): request DEAD_NAME returns -300 (MIG_TYPE_ERROR); send -> MACH_SEND_INVALID_DEST; receive times out; 0/12,288 registrations armed in kern.ipc - macOS 27 sweep: 13 notification-type/right combinations, all -300 - kern.ipc now counts armed registrations and retracts the old 'survived' verdict when armed == 0; the request table is never armed - docs/KERNEL-RW-ASSESSMENT.md: 112507 marked closed for this app - app 2.2 build 5; 57 modules	2026-10-31 15:59:20 +08:00
JBJF	c30aadf9bb	kernel R/W assessment for the high/critical entries - docs/KERNEL-RW-ASSESSMENT.md: per-primitive verdict. None of the six kernel-reachable bugs supplies both address and value control; the chain requirements (KASLR, grooming, reclaim, gadget, PAC/PPL) are listed per entry - CVE-2026-113910.c: leak collector — 8 chunk configs x --loop, canonical pointer classification (kernel-text / kernel-data / kernel-other), --keep raw dump, --verbose; candidates are printed, never dereferenced - 112705 / 65385 / 112696: explicit primitive-limit headers (DoS, fixed-offset write without leak, honest negative); no blind writes - README: link the assessment and the new 113910 receipt (0 candidates, 16 runs)	2026-10-31 15:37:58 +08:00

Author

SHA1

Message

Date

JBJF

3ac5108928

iOS 27.2 kernel differential + NTL fix-boundary sweep

- docs/IOS27.2-KERNEL-DIFF.md: 27.0.1 vs 27.2 (iPhone19,7), 162 advisory
  CVEs, 93 size-changed kexts; confirmed fix sites for 112705 (NTL 0..7
  assertion), 113910 (produced vs expected chunk bytes), 112507 (ipr/table
  NULL checks in ipc_misc.c); __DATA_SPTM byte-identical, no PPL/SPTM/MIE
  code change or bypass fix
- tools/ipsw/: Range-based IPSW reader, IM4P/LZFSE + fileset parser, kext
  extractor, llvm-objdump diff, advisory mapper
- CVE-2026-112705: --sweep mode (0..12, no frame) in both POCs; app module
  now sweeps 0/1/7/8/64/1024/16462/16463
- app 2.3 build 7

2026-10-31 17:09:48 +08:00

JBJF

6f4ed67c38

112507 reachability closed: notification registration refused (-300)

- New kern.ipc.lifecycle module: dead-name registration, dead-name send,
  notification receive, name reuse — single-threaded, safe on device
- Device receipt (iPhone19,7, iOS 27.0.1, ad-hoc signed): request DEAD_NAME
  returns -300 (MIG_TYPE_ERROR); send -> MACH_SEND_INVALID_DEST; receive
  times out; 0/12,288 registrations armed in kern.ipc
- macOS 27 sweep: 13 notification-type/right combinations, all -300
- kern.ipc now counts armed registrations and retracts the old 'survived'
  verdict when armed == 0; the request table is never armed
- docs/KERNEL-RW-ASSESSMENT.md: 112507 marked closed for this app
- app 2.2 build 5; 57 modules

2026-10-31 15:59:20 +08:00

JBJF

c30aadf9bb

kernel R/W assessment for the high/critical entries

- docs/KERNEL-RW-ASSESSMENT.md: per-primitive verdict. None of the six
  kernel-reachable bugs supplies both address and value control; the chain
  requirements (KASLR, grooming, reclaim, gadget, PAC/PPL) are listed per entry
- CVE-2026-113910.c: leak collector — 8 chunk configs x --loop, canonical
  pointer classification (kernel-text / kernel-data / kernel-other), --keep
  raw dump, --verbose; candidates are printed, never dereferenced
- 112705 / 65385 / 112696: explicit primitive-limit headers (DoS, fixed-offset
  write without leak, honest negative); no blind writes
- README: link the assessment and the new 113910 receipt (0 candidates, 16 runs)

2026-10-31 15:37:58 +08:00