docs: Cutter/rz-ghidra decompilation of the MTE gate and TLBI completion path

- parser at 0xfffffff0270cbe18 sets the verify flag to 0 when
  /arm-io/sgx lacks verify-gmmu-tlbis-at-sync
- BuildManifest maps iPhone19,7 -> v64sap; that DT lacks the key, as do
  iBoot, AGX and the kernelcache; only SPTM contains the strings
- consequence: the GMMU TLBI completion window remains open on iPhone 27.2
  (fix-gating gap, not a new memory-safety bug)

README.md

@@ -145,7 +145,7 @@ Kernel R/W feasibility for the high/critical entries is in [docs/KERNEL-RW-ASSES
 
 112507 reachability was re-measured on the target (iPhone19,7, iOS 27.0.1) with the new `kern.ipc.lifecycle` module and an `armed` counter in `kern.ipc`: `mach_port_request_notification` returns -300 (MIG_TYPE_ERROR) for every type/right combination tried, 0 armed out of 12,288 registrations. The request table is never armed, so the race is not reachable from an unentitled app; the earlier "survived the interleaving" line is retracted. Details in [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md).
 
-**iOS 27.2 firmware diff (27.0.1 vs 27.2, iPhone19,7):** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md). The update carries 162 advisory CVEs; 93 of 303 common kexts changed text size. Confirmed fix sites: 112705 clamps `NumberOfTemporalLayers` to 0…7 (`iNumberOfTemporalLayers <= 7` assertion), 113910 adds `chunk %u produced %lld of %lld expected bytes`, 112507 adds `ipr != NULL` / `table != NULL` in `ipc_misc.c`. `__DATA_SPTM` is byte-identical across both builds; the PPL/SPTM/MIE string and code surface is unchanged, so no bypass for those three is fixed in 27.2.
+**iOS 27.2 firmware diff (27.0.1 vs 27.2, iPhone19,7):** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md). The update carries 162 advisory CVEs; 93 of 303 common kexts changed text size. Confirmed fix sites: 112705 clamps `NumberOfTemporalLayers` to 0…7 (`iNumberOfTemporalLayers <= 7` assertion), 113910 adds `chunk %u produced %lld of %lld expected bytes`, 112507 adds `ipr != NULL` / `table != NULL` in `ipc_misc.c`. The kernel's `__DATA_SPTM` segment is byte-identical, but the separate `sptm.t8160` firmware changed from SPTM-820.0.22 to **820.40.24** (+64 KiB: DART/IOMMU, TLBI and hibernation hardening, not in the CVE list). MIE/MTE policy in SPTM/XNU is unchanged. See [docs/SPTM-MIE-27.2.md](docs/SPTM-MIE-27.2.md) for the deep dive and candidate bypass directions.
 
 ## Module semantics
 

README.zh-CN.md

@@ -144,7 +144,7 @@ armed 不是超时——是**死亡 oracle 命中**：负载触发进程崩溃
 
 112507 的可达性已在目标机（iPhone19,7 / iOS 27.0.1）上用新增的 `kern.ipc.lifecycle` 模块与 `kern.ipc` 的 `armed` 计数重测：`mach_port_request_notification` 在所有类型/权限组合上都返回 -300（MIG_TYPE_ERROR），12,288 次注册 0 次成功。请求表从未被武装，因此无特权 app 触达不到该竞态；此前“活过交错”的结论撤回。详见 [docs/KERNEL-RW-ASSESSMENT.md](docs/KERNEL-RW-ASSESSMENT.md)。
 
-**iOS 27.2 固件 diff（27.0.1 vs 27.2，iPhone19,7）：** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md)。本次更新含 162 条公告 CVE；303 个共有 kext 中 93 个 `__TEXT_EXEC` 尺寸变化。已确认的修复点：112705 把 `NumberOfTemporalLayers` 收紧到 0…7（断言 `iNumberOfTemporalLayers <= 7`），113910 新增 `chunk %u produced %lld of %lld expected bytes`，112507 在 `ipc_misc.c` 新增 `ipr != NULL` / `table != NULL`。`__DATA_SPTM` 两版字节完全一致，PPL/SPTM/MIE 的字符串与代码面没有变化 —— 27.2 没有修这三个 bypass。
+**iOS 27.2 固件 diff（27.0.1 vs 27.2，iPhone19,7）：** [docs/IOS27.2-KERNEL-DIFF.md](docs/IOS27.2-KERNEL-DIFF.md)。本次更新含 162 条公告 CVE；303 个共有 kext 中 93 个 `__TEXT_EXEC` 尺寸变化。已确认的修复点：112705 把 `NumberOfTemporalLayers` 收紧到 0…7（断言 `iNumberOfTemporalLayers <= 7`），113910 新增 `chunk %u produced %lld of %lld expected bytes`，112507 在 `ipc_misc.c` 新增 `ipr != NULL` / `table != NULL`。kernel 里的 `__DATA_SPTM` 段两版字节一致，但独立的 `sptm.t8160` 固件从 SPTM-820.0.22 升到 **820.40.24**（+64 KiB：DART/IOMMU、TLBI 与休眠加固，不在 CVE 列表里）。SPTM/XNU 的 MIE/MTE 策略没有变化。深度分析与候选 bypass 方向见 [docs/SPTM-MIE-27.2.md](docs/SPTM-MIE-27.2.md)。
 
 ## 模块语义
 

docs/IOS27.2-CVE-LIST.md

@@ -0,0 +1,168 @@
+# iOS 27.2 advisory — all entries
+
+162 CVEs across 67 components. Source: Apple security advisory 149230 (iOS 27.2 / iPadOS 27.2, 2026-10-26).
+
+| CVE | Component | Impact | Description | Binary candidate |
+|---|---|---|---|---|
+| CVE-2026-112466 | AVEVideoEncoder | An app may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved input validation. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
+| CVE-2026-112468 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
+| CVE-2026-112469 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
+| CVE-2026-112470 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
+| CVE-2026-112689 | AVEVideoEncoder | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved input validation. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
+| CVE-2026-112705 | AVEVideoEncoder | An app may be able to cause unexpected system termination | An out-of-bounds write issue was addressed with improved bounds checking. | com.apple.driver.AppleAVE2 / VideoToolbox AVE plugin |
+| CVE-2026-86971 | Accelerate Framework | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | Accelerate |
+| CVE-2026-84493 | AccessorySetupKit | A malicious app may be able to access Bluetooth without user consent | An authentication issue was addressed with improved state management. | AccessorySetupKit |
+| CVE-2026-112446 | Accounts | An app may be able to access sensitive user data | This issue was addressed with additional entitlement checks. | Accounts |
+| CVE-2026-112612 | Accounts | An attacker with physical access to a trust-paired device may be able to read and write arbitrary files | A path handling issue was addressed with improved validation. | Accounts |
+| CVE-2026-113898 | Accounts | A malicious application may be able to bypass Privacy preferences | A logging issue was addressed with improved data redaction. | Accounts |
+| CVE-2026-112692 | App Intents | An app may be able to access sensitive user data | This issue was addressed with additional entitlement checks. | AppIntents |
+| CVE-2026-112690 | App Store | A remote attacker may be able to break out of the WebContent sandbox | This issue was addressed with improved input validation. | AppStore |
+| CVE-2026-113914 | App Store | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | AppStore |
+| CVE-2026-86987 | Apple Intelligence | A remote attacker may be able to access sensitive user data | An authorization issue was addressed with improved entitlement checks. | AppleIntelligence |
+| CVE-2026-112696 | Apple Neural Engine | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | AppleH16ANEInterface / AppleNeuralEngine.framework |
+| CVE-2026-84494 | Apple Neural Engine | An app may be able to cause unexpected system termination or write kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | AppleH16ANEInterface / AppleNeuralEngine.framework |
+| CVE-2026-112415 | AppleAVD | An app may be able to cause unexpected system termination or corrupt process memory | An out-of-bounds write was addressed with improved input validation. | ? |
+| CVE-2026-112416 | AppleAVD | Processing a maliciously crafted video file may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
+| CVE-2026-112454 | AppleAVD | Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory | The issue was addressed with improved memory handling. | ? |
+| CVE-2026-112546 | Audio | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | AudioToolbox / AudioCodecs |
+| CVE-2026-112566 | Bluetooth | An attacker in physical proximity may be able to cause a denial-of-service | A null pointer dereference was addressed with improved validation. | Bluetooth.framework / IOBluetooth kexts |
+| CVE-2026-113906 | Bluetooth | An attacker in physical proximity may be able to cause a denial-of-service | A null pointer dereference was addressed with improved validation. | Bluetooth.framework / IOBluetooth kexts |
+| CVE-2026-112619 | Calendar | Processing a maliciously crafted calendar invitation may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CalendarFoundation |
+| CVE-2026-112678 | Calendar | An app may be able to access sensitive user data | A permissions issue was addressed with additional restrictions. | CalendarFoundation |
+| CVE-2026-112701 | CloudKit | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | CloudKit |
+| CVE-2026-86988 | ColorSync | Processing a maliciously crafted image may result in disclosure of process memory | The issue was addressed with improved checks. | ColorSync |
+| CVE-2026-113910 | Compression | An app may be able to disclose kernel memory | A memory initialization issue was addressed with improved memory handling. | libcompression.dylib |
+| CVE-2026-113908 | Contacts | An app may be able to access sensitive user data | A privacy issue was addressed by removing sensitive data. | Contacts |
+| CVE-2026-112638 | CoreAudio | An attacker in radio range may be able to cause unexpected system termination | A heap buffer overflow was addressed with improved bounds checking. | CoreAudio.framework / AudioToolbox |
+| CVE-2026-113907 | CoreAudio | An app may be able to cause unexpected system termination or corrupt process memory | A buffer overflow issue was addressed with improved memory handling. | CoreAudio.framework / AudioToolbox |
+| CVE-2026-113912 | CoreAudio | Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | An out-of-bounds access issue was addressed with improved bounds checking. | CoreAudio.framework / AudioToolbox |
+| CVE-2026-86969 | CoreAudio | An app may be able to cause unexpected system termination or corrupt kernel memory | An out-of-bounds write was addressed with improved input validation. | CoreAudio.framework / AudioToolbox |
+| CVE-2026-86972 | CoreAudio | Processing a maliciously crafted audio file may lead to memory corruption | A buffer overflow was addressed with improved size validation. | CoreAudio.framework / AudioToolbox |
+| CVE-2026-112610 | CoreGraphics | Processing a maliciously crafted PDF file may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
+| CVE-2026-112611 | CoreGraphics | Processing a maliciously crafted PDF file may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
+| CVE-2026-113950 | CoreGraphics | Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | CoreGraphics.framework |
+| CVE-2026-112688 | CoreMedia | Parsing a file may lead to an unexpected app termination or arbitrary code execution | A memory corruption issue was addressed with improved memory handling. | CoreMedia.framework / mediaplaybackd |
+| CVE-2026-112706 | CoreMedia | An app may be able to access sensitive user data | A permissions issue was addressed with additional restrictions. | CoreMedia.framework / mediaplaybackd |
+| CVE-2026-86990 | CoreMedia | A malicious app may be able to access the camera without user permission | An access issue was addressed with improved access restrictions. | CoreMedia.framework / mediaplaybackd |
+| CVE-2026-86992 | CoreMedia | Processing a maliciously crafted video file may lead to unexpected app termination | The issue was addressed with improved memory handling. | CoreMedia.framework / mediaplaybackd |
+| CVE-2026-112656 | CoreText | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | CoreText.framework |
+| CVE-2026-113896 | FileProvider | An app may be able to access sensitive user data | A race condition was addressed with additional validation. | FileProvider |
+| CVE-2026-112618 | Files | An app may be able to access sensitive user data | An access issue was addressed with improved access restrictions. | Files |
+| CVE-2026-112432 | FontParser | An app may be able to access sensitive user data | A logging issue was addressed with improved data redaction. | FontParser.framework |
+| CVE-2026-112642 | FontParser | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | FontParser.framework |
+| CVE-2026-112683 | FontParser | Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | FontParser.framework |
+| CVE-2026-86970 | FontParser | Processing a maliciously crafted font may result in the disclosure of process memory | An out-of-bounds read was addressed with improved input validation. | FontParser.framework |
+| CVE-2026-112456 | HFS | Processing a maliciously crafted file may lead to heap corruption | An out-of-bounds write issue was addressed with improved input validation. | com.apple.filesystems.hfs.kext |
+| CVE-2026-112518 | Heimdal | An attacker in a privileged network position may be able to impersonate a Kerberos KDC | An issue with signature validation was addressed with improved checks. | Heimdal (Kerberos) |
+| CVE-2026-112596 | HomeKit | Processing a maliciously crafted video file may lead to unexpected system termination | An integer overflow was addressed with improved bounds checking. | HomeKit |
+| CVE-2026-86978 | HomeKit | An app may be able to access sensitive user data | This issue was addressed with improved checks. | HomeKit |
+| CVE-2026-112515 | IOHIDFamily | An attacker may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | com.apple.iokit.IOHIDFamily |
+| CVE-2026-65385 | IOKit | A buffer overflow may result in memory corruption and unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | IOKit.framework / IOKit kexts |
+| CVE-2026-112459 | IOMobileFrameBuffer | An app may be able to cause unexpected system termination or corrupt kernel memory | A race condition was addressed with improved state handling. | com.apple.driver.IOMobileFrameBuffer |
+| CVE-2026-112554 | IOStorageFamily | An app may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | com.apple.iokit.IOStorageFamily |
+| CVE-2026-112477 | IOSurface | An app may be able to cause unexpected system termination or corrupt kernel memory | A race condition was addressed with improved locking. | IOSurface.framework / IOSurface kext |
+| CVE-2026-112488 | ImageIO | Processing a maliciously crafted image may corrupt process memory | A buffer overflow issue was addressed with improved memory handling. | ImageIO.framework |
+| CVE-2026-112561 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
+| CVE-2026-112571 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | A memory initialization issue was addressed with improved memory handling. | ImageIO.framework |
+| CVE-2026-112614 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ImageIO.framework |
+| CVE-2026-112625 | ImageIO | Processing a maliciously crafted image may result in memory corruption | An integer underflow was addressed with improved input validation. | ImageIO.framework |
+| CVE-2026-112627 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
+| CVE-2026-112629 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
+| CVE-2026-112630 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An uninitialized memory issue was addressed with improved memory handling. | ImageIO.framework |
+| CVE-2026-112632 | ImageIO | Processing a maliciously crafted image may result in disclosure of process memory | An uninitialized memory issue was addressed with improved memory handling. | ImageIO.framework |
+| CVE-2026-112633 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ImageIO.framework |
+| CVE-2026-112634 | ImageIO | Processing a maliciously crafted image may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ImageIO.framework |
+| CVE-2026-112474 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112476 | Kernel | An app may be able to cause unexpected system termination | An out-of-bounds read was addressed with improved bounds checking. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112501 | Kernel | An app may be able to cause unexpected system termination | A race condition was addressed with improved state handling. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112507 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | An out-of-bounds write issue was addressed with improved bounds checking. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112514 | Kernel | An attacker may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112516 | Kernel | An app may be able to cause unexpected system termination | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112517 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use after free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112576 | Kernel | An app may be able to cause unexpected changes to copy-on-write memory | A memory integrity issue was addressed with improved handling of copy-on-write pages. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112606 | Kernel | An app may be able to cause unexpected system termination | A type confusion issue was addressed with improved memory handling. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112624 | Kernel | An app may be able to bypass Privacy preferences | This issue was addressed with improved checks. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112665 | Kernel | An app may be able to determine kernel memory layout | An information disclosure issue was addressed with improved state management. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112679 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112698 | Kernel | An app may be able to cause unexpected system termination | The issue was addressed with improved memory handling. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-65350 | Kernel | An app may be able to cause unexpected system termination or corrupt kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-84495 | Kernel | An app may be able to cause unexpected system termination or write kernel memory | A use-after-free issue was addressed with improved memory management. | kernelcache core (pmap/ipc/vm/bsd) |
+| CVE-2026-112621 | LinkPresentation | Processing a maliciously crafted image may result in memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | LinkPresentation.framework |
+| CVE-2026-112414 | Mail | Processing a maliciously crafted message may lead to a denial-of-service | A stack overflow was addressed with improved input validation. | Mail |
+| CVE-2026-112671 | Mail | A remote attacker may be able to cause a denial-of-service | A resource exhaustion issue was addressed with improved input validation. | Mail |
+| CVE-2026-112707 | Maps | An app may be able to identify what other apps a user has installed | A privacy issue was addressed by moving sensitive data to a protected location. | Maps |
+| CVE-2026-113915 | MediaAnalysis | An app may be able to access sensitive user data | A race condition was addressed with additional validation. | MediaAnalysis |
+| CVE-2026-112687 | MediaRemote | An attacker on the local network may be able to cause unexpected system termination or corrupt process memory | This issue was addressed by removing the vulnerable code. | MediaRemote |
+| CVE-2026-112682 | Messages | A remote attacker may be able to cause unexpected app termination | An input validation issue was addressed with improved input validation. | Messages / IMSharedUtilities |
+| CVE-2026-86989 | MobileGestalt | An app may be able to fingerprint the user | An authorization issue was addressed with improved state management. | MobileGestalt |
+| CVE-2026-112413 | Model I/O | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | ? |
+| CVE-2026-112449 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An integer overflow was addressed with improved input validation. | ? |
+| CVE-2026-112461 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
+| CVE-2026-112485 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | The issue was addressed with improved memory handling. | ? |
+| CVE-2026-112486 | Model I/O | Processing a 3D model may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | ? |
+| CVE-2026-112565 | Model I/O | Processing a maliciously crafted 3D model may lead to memory corruption | An integer overflow was addressed with improved input validation. | ? |
+| CVE-2026-112660 | Photos Storage | An app may be able to bypass certain Privacy preferences | An authorization issue was addressed with improved state management. | Photos |
+| CVE-2026-112676 | Photos Storage | An app may be able to access a user's Photos Library | This issue was addressed with additional entitlement checks. | Photos |
+| CVE-2026-65397 | Photos Storage | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Photos |
+| CVE-2026-112681 | Power Management | An app may be able to fingerprint the user | This issue was addressed with additional entitlement checks. | com.apple.driver.AppleARMPlatform / PM kexts |
+| CVE-2026-86925 | Quick Look | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | QuickLook |
+| CVE-2026-112491 | RealityKit | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds read was addressed with improved bounds checking. | RealityKit |
+| CVE-2026-112547 | ReplayKit | An app may be able to access sensitive user data | A type confusion issue was addressed with improved checks. | ReplayKit |
+| CVE-2026-112609 | Safety Check | An app may be able to access sensitive user data | This issue was addressed with improved checks. | SafetyCheck |
+| CVE-2026-112423 | SceneKit | Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents | An out-of-bounds read was addressed with improved bounds checking. | SceneKit |
+| CVE-2026-112425 | SceneKit | Processing a 3D model may result in disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | SceneKit |
+| CVE-2026-112464 | SceneKit | Processing a maliciously crafted file may lead to heap corruption | An out-of-bounds write issue was addressed with improved input validation. | SceneKit |
+| CVE-2026-86991 | SceneKit | Processing a maliciously crafted file may lead to unexpected process termination | A buffer overflow was addressed with improved bounds checking. | SceneKit |
+| CVE-2026-112616 | Screen Time | An app may be able to access sensitive user data | An authorization issue was addressed with improved access control. | ScreenTime |
+| CVE-2026-112652 | Security | An malicious app may be able to bypass certificate validation | A logic issue was addressed with improved state management. | Security.framework |
+| CVE-2026-113913 | Security | Processing web content may disclose sensitive information | An input validation issue was addressed with improved input validation. | Security.framework |
+| CVE-2026-112455 | Shortcuts | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Shortcuts |
+| CVE-2026-112559 | Shortcuts | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Shortcuts |
+| CVE-2026-112658 | Siri | An app may be able to access sensitive user data | This issue was addressed with improved input validation. | Siri |
+| CVE-2026-112685 | Siri | An app may be able to access sensitive user data | An authorization issue was addressed with improved state management. | Siri |
+| CVE-2022-26704 | Spotlight | An app may be able to gain elevated privileges | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. | Spotlight |
+| CVE-2026-112567 | Spotlight | A malicious application may be able to bypass Privacy preferences | This issue was addressed with improved checks. | Spotlight |
+| CVE-2026-112628 | Spotlight | An app may be able to access sensitive user data | This issue was addressed with improved data access restriction. | Spotlight |
+| CVE-2026-112646 | SpringBoard | An app may be able to cause unexpected system termination or corrupt process memory | An out-of-bounds write issue was addressed with improved bounds checking. | SpringBoard |
+| CVE-2026-112691 | SwiftUI | An app may be able to cause unexpected system termination | An out-of-bounds write issue was addressed with improved input validation. | SwiftUI |
+| CVE-2026-86968 | System Preferences | A malicious app may be able to access restricted system interfaces or launder launch attribution | An access issue was addressed with improved access control. | SystemPreferences |
+| CVE-2026-84605 | TextKit | An app may be able to read the device's name | An authorization issue was addressed with improved state management. | TextKit |
+| CVE-2026-112595 | Thread | An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network | This issue was addressed with improved authentication. | ThreadNetwork.framework |
+| CVE-2026-112479 | USB | A malicious USB device may be able to cause unexpected system termination or read kernel memory | An out-of-bounds read was addressed with improved bounds checking. | USB kexts |
+| CVE-2026-112599 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112615 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112623 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112640 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112651 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112653 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112654 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112655 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112659 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A type confusion issue was addressed with improved memory handling. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112666 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112669 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A race condition was addressed with improved state handling. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112673 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A type confusion issue was addressed with improved state handling. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112680 | WebKit | Processing maliciously crafted web content may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112684 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | This issue was addressed through improved state management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112686 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A race condition was addressed with improved locking. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112693 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112695 | WebKit | Processing maliciously crafted web content may lead to an unexpected process termination | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112697 | WebKit | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112699 | WebKit | Processing maliciously crafted web content may result in the disclosure of process memory | An out-of-bounds read was addressed with improved bounds checking. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-113903 | WebKit | Processing maliciously crafted web content may lead to unexpected memory modification | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-113904 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-113949 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A type confusion issue was addressed with improved state management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-113952 | WebKit | A website may be able to use a media format that should be restricted in Lockdown Mode | A logic issue was addressed with improved checks. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-86974 | WebKit | Processing maliciously crafted web content may lead to memory corruption | A type confusion issue was addressed with improved checks. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-86985 | WebKit | Processing maliciously crafted web content may lead to an unexpected process crash | This issue was addressed with improved input validation. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-86986 | WebKit | Processing maliciously crafted web content may lead to an unexpected Safari crash | A use-after-free issue was addressed with improved memory management. | JavaScriptCore / WebKit / WebCore |
+| CVE-2026-112637 | WebKit Canvas | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | WebCore (canvas) |
+| CVE-2026-112626 | WebKit JavaScript Bindings | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | JavaScriptCore bindings |
+| CVE-2026-112639 | WebKit Process Model | Processing maliciously crafted web content may lead to arbitrary code execution | A use-after-free issue was addressed with improved memory management. | WebKit process model |
+| CVE-2026-113897 | WebKit Process Model | A remote attacker may be able to break out of Web Content sandbox | This issue was addressed by removing the vulnerable code. | WebKit process model |
+| CVE-2026-113901 | WebRTC | Processing maliciously crafted web content may lead to an unexpected process crash | A use-after-free issue was addressed with improved memory management. | WebRTC.framework |
+| CVE-2026-86973 | WebRTC | Processing maliciously crafted web content may lead to an unexpected process crash | An out-of-bounds read was addressed with improved bounds checking. | WebRTC.framework |
+| CVE-2026-112620 | Wi-Fi | An attacker in a privileged network position may be able to cause a denial-of-service | A denial-of-service issue was addressed with improved input validation. | WiFi frameworks / IO80211 kext |
+| CVE-2026-112622 | Wi-Fi | An attacker in radio range may be able to cause unexpected system termination | An out-of-bounds read was addressed with improved bounds checking. | WiFi frameworks / IO80211 kext |
+| CVE-2026-113909 | Wi-Fi | An attacker in physical proximity may be able to corrupt process memory | A memory corruption issue was addressed with improved input validation. | WiFi frameworks / IO80211 kext |
+| CVE-2026-112522 | libarchive | Processing a maliciously crafted file may lead to unexpected app termination | An out-of-bounds write issue was addressed with improved bounds checking. | libarchive.2.dylib |
+| CVE-2026-112607 | mDNSResponder | A remote attacker may be able to leak memory | An out-of-bounds read was addressed with improved bounds checking. | mDNSResponder |

docs/IOS27.2-KERNEL-DIFF.md

@@ -20,11 +20,15 @@ analysis did not wait for the full 26 GB. The container is IM4P; the payload is
 | Build | Kernelcache (decoded) | SHA-256 (first 16) |
 |---|---|---|
 | 27.0.1 | 78,315,520 B | `dec73956a9a443c5` |
-| 27.2 | 79,167,488 B | `9a6efbc4be67319a` |
+| 27.2 (v6x-pandia) | 78,675,968 B | `1aaf47dbc73650e3` |
 
-Both are `MH_FILESET` images with a `__DATA_SPTM` segment, carrying 303 (27.0.1) and
+Both are `MH_FILESET` images with a `__DATA_SPTM` segment, carrying 303 (27.0.1)
-305 (27.2) fileset entries. Two kexts are new: `com.apple.driver.ApplePencilDriver`,
+and 304 (27.2) fileset entries. One kext is new: `com.apple.driver.ApplePencilDriver`;
-`com.apple.iokit.AppleSecurityResearch`; none were removed.
+none were removed.
+
+27.2 ships three kernelcaches (`v63`, `v64`, `v6x-pandia`); iPhone19,7 uses
+`v6x-pandia` (member SHA-256 `0777eb09…`). The numbers and addresses below are
+from that member, not from the first kernelcache in the ZIP.
 
 ## Reading the diff
 
@@ -36,7 +40,7 @@ code is unchanged. The diff therefore keys on:
 2. `__cstring` / `__oslogstring` set difference (new checks usually add a message),
 3. `llvm-objdump` instruction diff for the kexts that survive both filters.
 
-93 of 303 common kexts changed text size. The largest are the ones the advisory
+93 of 303 common kexts changed text size (v6x-pandia). The largest are the ones the advisory
 points at:
 
 | Delta | Kext | Advisory component |
@@ -126,26 +130,43 @@ per-CVE signature.
 
 ## PPL / SPTM / MIE
 
-This is the part the request specifically asked to dig into.
+**Correction:** the kernel's `__DATA_SPTM` segment is byte-identical (311,296 B,
+same SHA), but SPTM is a separate firmware image and **did** change:
 
-- `__DATA_SPTM` is **byte-identical** in both builds: 311,296 bytes, SHA-256
+- `Firmware/sptm.t8160`: SPTM-820.0.22 → **SPTM-820.40.24**, 1,261,600 → 1,327,136 B
-  `f4bc1e5e95f61af5…`. No SPTM code or data changed.
+  (+64 KiB, all in `__LATE_CONST`); `__TEXT_EXEC` same size, different hash.
-- The PPL token strings (`UAT_PPL_IOCTL_*`, `PPL map operation failed`,
+- New checks: DART `VIOLATION_T8110_DART_UNGANG_GAPF_RACE`, GMMU TLBI
-  `PPL state object`) are unchanged; no new PPL checks or messages.
+  verification, IOMMU read-refcount validation, UAT Dekker lock timeouts,
-- No MIE / Memory Integrity / mtag / page-protection strings were added or removed.
+  `VIOLATION_NVME_ILLEGAL_HIBERNATION_QUEUE_LATCH`, hibernation handoff page count.
-- The only SPTM-related additions are boot-time memory-size validation:
+- `txm.iphoneos`: same size, build-path/version only (Image4 374~7022 → 374~8637).
-  `memsize=%u MB leaves no memory for XNU/SPTM to manage`, `Mismatch of
+- `exclavecore`: 33,259,754 → 33,489,130 B (+229,376) — separate domain.
-  ARM_LARGE_MEMORY in SPTM/XNU`, and iBoot DRAM-size checks. These are
+- MIE/MTE policy in SPTM is unchanged: the `MTE tag page containing SK tags`
-  configuration checks, not a permission bypass.
+  check is a 210-instruction function in both builds (relocated, same shape), and
-- The 27.2 advisory contains no component named PPL, SPTM, MIE, or Page Protection,
+  the kernel's MTE strings are identical. The Exclave image changed separately.
-  and no CVE description mentions them.
 
-**Verdict: no PPL, SPTM, or MIE bypass is fixed in iOS 27.2, and the firmware diff
+The full analysis, function addresses, and candidate bypass directions (DART
-shows no change in the SPTM/PPL/MIE code paths.** A bypass PoC for any of the three
+GAPF race, hibernation handoff, SK tag-page aliasing, dangling tag storage) are in
-would have to come from a different bug, not from this update. The kernel CVEs with
+[SPTM-MIE-27.2.md](SPTM-MIE-27.2.md). No working SPTM/MIE bypass was produced: the
-"write kernel memory" impacts are ordinary kernel memory-safety bugs; none of them
+27.2 changes add checks, and the candidate paths need a reachable primitive that
-is a page-table / monitor bypass on its own, and exploiting one would still have to
+the diff does not contain.
-defeat SPTM/PPL/MIE at runtime.
+
+## Kernel fix-site candidates (27.2, address in the final 24B119 kernelcache)
+
+These are the functions that reference the new 27.2 strings. They are candidate
+fix sites for the 15 Kernel CVEs; the advisory does not map a CVE to a function,
+so treat the CVE attribution as an inference.
+
+| New string | Function (27.2) | Likely area |
+|---|---|---|
+| `size <= sdl->sdl_alen` | `0xfffffe000aeee474` (assert at `0xfffffe000aeee74c`) | sockaddr_dl / ifaddr bounds (info leak candidate, cf. 112665) |
+| `Failed mbuf validity check` | `0xfffffe000aeaf8ac`, `0xfffffe000aecee70`, `0xfffffe000b0161bc`, `0xfffffe000b0c17a0` | mbuf length vs off+len (OOB read/write candidate) |
+| `VM entry %p lock shared lock overflow` | `0xfffffe000b4bad74` | vm_map shared-lock state (COW / 112576 candidate) |
+| `Page modified after framebank withdraw %p` | `0xfffffe000ad831b8` | pmap page lifecycle (UAF candidate) |
+
+The `sdl` site is the most user-reachable of the four: it is on the network
+interface/address path and the string is an assertion added in 27.2. The mbuf
+site is next. Neither has a trigger or a demonstrated R/W effect; they are the
+next functions to audit with a device.
 
 ## What can be turned into a PoC
 

docs/SPTM-MIE-27.2.md

@@ -0,0 +1,338 @@
+# SPTM / MIE deep dive — iOS 27.2 (24B119) vs 27.0.1 (24A446)
+
+This is the part that the kernelcache alone cannot answer. SPTM is a separate
+firmware image in the IPSW (`Firmware/sptm.t8160.release.im4p`), and it **did**
+change in 27.2. The earlier note that "SPTM is unchanged" was based only on the
+kernel's `__DATA_SPTM` segment and was wrong: that segment is identical, but the
+SPTM monitor itself is not.
+
+## Component inventory
+
+| Component | 27.0.1 | 27.2 | Change |
+|---|---|---|---|
+| `sptm.t8160` | 1,261,600 B · SPTM-820.0.22 | 1,327,136 B · SPTM-820.40.24 | **+65,536 B** |
+| `txm.iphoneos` | 557,088 B · Image4 374~7022 | 557,088 B · Image4 374~8637 | build-only |
+| `exclavecore.t8160` | 33,259,754 B | 33,489,130 B | +229,376 B |
+| kernel `__DATA_SPTM` | 311,296 B · sha f4bc1e5e… | 311,296 B · sha f4bc1e5e… | **identical** |
+| kernel MTE strings | `VM_KERN_MEMORY_MTAG`, taggable pages | same | unchanged |
+
+SPTM segment sizes:
+
+| Segment | 27.0.1 | 27.2 |
+|---|---|---|
+| `__TEXT_EXEC` | 425,984 | 425,984 |
+| `__LATE_CONST` | 524,288 | **589,824** (+65,536) |
+| `__TEXT` / `__DATA` / `__BOOTDATA` | 98,304 / 65,536 / 98,304 | same |
+
+The +64 KiB is entirely in `__LATE_CONST`; the executable text kept its size but
+its hash changed (`347aa218…` → `064c286f…`), so functions were edited/relocated.
+
+## What 27.2 adds to SPTM
+
+String diff (32 new, 7 removed) is dominated by IOMMU/DART and hibernation
+hardening — none of it is named in the 162-CVE advisory:
+
+- `VIOLATION_T8110_DART_UNGANG_GAPF_RACE`
+- `%s: %s: iommu_read_refcnt (0x%hhx) > read_refcnt(0x%x) for FTE %p`
+- `%s: Failed to verify TLBI`
+- `%s: The GMMU TLBI verification register should be 8B-aligned`
+- `gmmu-tlbi-verification-reg` / `gmmu-tlbi-verification-bit`
+- `%s: UAT Dekker gate acquisition timed out after %llu ns`
+- `%s: UAT Dekker lock acquisition timed out after %llu ns`
+- `%s: dart %p (%s:%u): relaxed_rw_protections and allow_pte_remap are not supported together`
+- `%s: dart %p (%s:%u): Inconsistent unganged clock protection configuration`
+- `VIOLATION_NVME_ILLEGAL_HIBERNATION_QUEUE_LATCH`
+- `hib_header_copy->handoffPageCount < HIB_HANDOFF_PAGECOUNT_LIMIT`
+- `sptm_allow_vm_isa_internal_guests`, `sptm_is_iuou_or_iuos_device`
+- `SPTM-820.40.24|2026-10-03:14:50:35`
+
+The TLBI string has five code xrefs in 27.2, at functions starting near
+`0xfffffff0270c7aac`, `0xfffffff0270c85f8`, `0xfffffff0270c987c`,
+`0xfffffff0270cacf4` and `0xfffffff027109940`.
+
+Function-level alignment makes the change concrete. The first TLBI function
+(`0xfffffff0270c7aac`, **369 instructions**) matches a **264-instruction**
+function at `0xfffffff0270b7a90` in 27.0.1 (prefix similarity 0.90). The 27.2
+version inserts a block that:
+
+1. reads `DAIF` and masks interrupts (`msr DAIFSet, #0x7`, `dsb sy`);
+2. reads `CNTVCTSS_EL0` and `CNTFRQ_EL0` and computes a deadline;
+3. loads a timeout constant (`0x3d40` = 15680 units) and the TLBI verification
+   register address;
+4. polls/validates the GMMU TLBI completion, and only then continues.
+
+The 27.0.1 function issues the invalidation and proceeds without that wait. This
+is not a relocated instruction; it is an added completion check.
+
+The DART violation names are not referenced by a direct `adr`/`adrp+add` — they
+are indexed through a violation table, so their exact raiser is a table lookup.
+The name itself is the evidence that 27.2 adds a check for the T8110 DART
+"ungang GAPF" race.
+
+## MIE / MTE surface
+
+MIE is not a single binary. The relevant pieces are:
+
+- **SPTM**: manages tag pages and checks `MTE tag page containing SK tags is
+  mapped`. The function is at `0xfffffff0270c6320` in 27.0.1 and
+  `0xfffffff0270d7028` in 27.2; both are exactly 210 instructions, same prologue
+  and same range-check shape (`subs` + `ccmp` against two globals). It was
+  relocated, not rewritten.
+- **Kernel**: the MTE page allocator (`VM_KERN_MEMORY_MTAG`, taggable pages, MTE
+  fill thread) has the same strings in both builds; no new MTE logic appears in
+  the 62 new kernel strings.
+- **Exclave core**: carries the PMM tag machinery (`pmmtag_l4_decode`,
+  `Conclave MTE tag check fault`, shared-memory tags), and grew by 229,376 B.
+  That is a separate firmware update; no CVE in the advisory names it.
+
+So the MIE *policy* surface in SPTM and XNU is unchanged in 27.2. The only
+MIE-adjacent code that changed is inside Exclave, which is a separate domain.
+
+Related SPTM strings that were already present in 27.0.1 and remain:
+
+- `%s: Dangling tag storage reference from previous mapping attempt`
+- `%s: Found SK-owned memory in non-wired memory`
+- `%s: dart %p (%s:%u): power down not permitted as SK still using the DART`
+
+The dangling-tag check is a real state machine: a previous tag-storage mapping
+attempt can leave a reference that SPTM detects later. It exists in both builds,
+so it is not a 27.2 fix; it is an audit target.
+
+### MTE check semantics (27.2, `0xfffffff0270d7028`)
+
+The 210-instruction function is a PA-range gate, not a tag-value check:
+
+```
+x19 = page PA
+if (x19 - [0xfffffff0270ae218] < ([0xfffffff0270ae220] - [0xfffffff0270ae218])) {
+    ... state bit test ...
+    if (state bit) panic("%s: MTE tag page containing SK tags is mapped %#lx", x19)
+}
+```
+
+The comparison is on the physical address. An alias that maps the same physical tag
+page at a different virtual address does not move the PA, so it does not avoid the
+check. A bypass would need to make SPTM see a different PA for the same tag memory
+(a page-table/IOMMU bug), or to corrupt the range globals / state bit — none of
+which is present in the 27.2 diff. This is why the MTE line remains a hypothesis,
+not a finding.
+
+## Why Titan does not transfer
+
+Titan (iOS 16.1–17.4b3, A14–A17) is not an SPTM logic bug. It uses:
+
+1. AGX coprocessor code execution to overwrite the AGX `power` thread state;
+2. the AGX hibernation context to restore a attacker-supplied `TTBR1_EL1` and a
+   second ROP stack (microPPL bypass);
+3. a self-referencing page-table entry to map and write any physical page,
+   defeating PPL/SPTM.
+
+Apple patched the AGX thread-state PAC in 18.1b4 and the TTBR restore in 17.4b4.
+The 27.2 SPTM diff is not a return of that bug: it is DART/hibernation hardening
+inside the monitor. A 27.2-era bypass would need a new primitive that can either
+(a) make SPTM map a page table it does not protect, or (b) corrupt the tag/SK
+metadata that SPTM trusts. There is no such primitive in the diff.
+
+## Candidate bypass directions (hypotheses, not PoCs)
+
+These are grounded in the 27.2 changes and the unchanged MIE checks. None is a
+working exploit; each needs a reachable primitive that the firmware diff does
+not supply.
+
+0. **GMMU TLBI completion race (strongest static lead).** 27.0.1 lacks the
+   completion wait that 27.2 adds to the DART invalidation path. A DMA-capable
+   device whose translation is invalidated can keep using a stale GMMU entry if
+   the invalidation has not completed; the stale entry is a DMA read/write to a
+   page that SPTM has already unmapped or repurposed. This is an IOMMU bypass,
+   not a page-table permission bypass, but it defeats the same isolation goal.
+   Reachability requires a userclient that owns DART mappings and can keep DMA
+   in flight across an unmap — the next thing to test on hardware.
+1. **DART unganged-GAPF race.** 27.2 adds a violation for a race between
+   unganging a DART and a page-table remap. On 27.0.1 the race can leave a stale
+   DART translation if a mapping is unganged while a PTE is remapped. A stale
+   IOMMU translation is a DMA read/write primitive to memory SPTM considers
+   protected. Reachability: a userclient that owns DART mappings (IOGPU, display,
+   NVMe, PCIe). This is the closest analogue to a "SPTM bypass", but it is an
+   IOMMU bypass, not a page-table permission bypass.
+2. **Hibernation handoff page count.** 27.2 adds
+   `hib_header_copy->handoffPageCount < HIB_HANDOFF_PAGECOUNT_LIMIT` and the
+   NVMe hibernation queue latch violation. On 27.0.1 a corrupted hibernation
+   header could make SPTM restore from a handoff page it did not size-check.
+   Reachability: modifying the hibernation image or the NVMe queue, not an app.
+3. **SK tag-page aliasing.** The SPTM check only rejects a tag page whose
+   physical address falls in the `[start,end)` range loaded from two globals. A
+   mapping that aliases the same physical tag page at a different PA, or a
+   remap that changes the range after the check, would let user-controlled tags
+   cover SK memory. That is an MIE bypass: forge the tag for an SK page, then
+   read/write it. Reachability: a kernel primitive that maps tag storage with a
+   user-influenced PA; not present in the 27.2 diff.
+4. **Dangling tag-storage reference.** SPTM already detects a dangling
+   reference from a previous mapping attempt. A race between unmap and remap of
+   tag storage could leave the stale reference usable; the freed tag page could
+   be reallocated as a user tag page. Same MIE impact as (3).
+
+## Verdict
+
+- SPTM **did** change: 820.0.22 → 820.40.24, +64 KiB, DART/TLBI/hibernation
+  hardening. The kernel-side `__DATA_SPTM` being identical is not evidence that
+  SPTM is unchanged.
+- No SPTM/MIE bypass is named in the 27.2 advisory, and no page-table permission
+  check was removed or weakened in the diff. The changes add checks.
+- MIE policy in SPTM/XNU is unchanged; Exclave changed separately.
+- A working bypass was **not** produced. The candidate paths above need a
+  reachable primitive (DART userclient, tag-storage mapping, or hibernation
+  image control) and a device session; writing one blind would be guesswork.
+
+## Critical finding — the 27.2 TLBI verification is disabled on iPhone19,7
+
+The check is conditional. SPTM's `uat_bootstrap_parse_dt` (27.2,
+`0xfffffff0270cbe18`) reads the `/arm-io/sgx` node and looks up
+`verify-gmmu-tlbis-at-sync`. The property-missing path is explicit:
+
+```
+0xfffffff0270cc184  adrp x8, 0xfffffff0270ae000
+0xfffffff0270cc188  ldr  x22, [x8, #0x208]
+0xfffffff0270cc18c  strb wzr, [x22, #0x81]     ; verify flag = 0
+0xfffffff0270cc190  ... continue parsing
+```
+
+So if the property is absent, the verification is **off**, not fatal.
+
+Now the device mapping:
+
+- `BuildManifest.plist` maps **iPhone19,7 → DeviceClass `v64sap`**.
+- The 27.2 `DeviceTree.v64sap.im4p` (406,684 B decoded) contains
+  `agx-address-space-mgmt-mode`, `tlbi-aperture-offset`, `dart-options` and the
+  SAPT node, but **no** `verify-gmmu-tlbis-at-sync`,
+  `gmmu-tlbi-verification-reg` or `gmmu-tlbi-verification-bit`.
+- The same strings are absent from the 27.2 iBoot, the AGX firmware, and the
+  whole kernelcache. They exist only in SPTM itself.
+
+The iPad images the reference report analysed (`j817ap` / `j820ap`) do carry the
+property, which is why beta3 looks fixed there. On iPhone19,7 the gate is
+missing, so the 27.2 build executes the **beta2 behaviour**: AMXOP25 loop →
+`dsb oshnxs` → clear pending count → continue, with the verification block
+skipped.
+
+### What this means
+
+- Reachability on the final 27.2 v6x-pandia build is confirmed: the
+  `IOGPUFamily` kext still exports `IOGPUDeviceUserClient::s_new_resource`,
+  `s_submit_command_buffers`, `s_create_io_command_queue`,
+  `s_destroy_io_command_queue`, `s_perform_io`, `s_group_add_resources`,
+  `s_group_remove_resources`, `s_create_vniodesc`; the kernel still contains
+  `IOUAT doUnmap/queueUnmap/commitUnmaps/prepareFWUnmap`,
+  `uat_get_root_table_paddr`, `pmap_iommu_ioctl_internal` and
+  `sptm_check_sapt_is_writable`. So the user path from IOGPU to the SPTM UAT
+  unmap exists unchanged.
+- Method handler addresses in the final v6x kext:
+  `IOGPUDeviceUserClient::s_new_resource` = `0xfffffe000a176094`,
+  `s_submit_command_buffers` = `0xfffffe000a176424`. Selector recovery is still
+  blocked: there is no direct `bl` to either handler and no raw/chained pointer
+  in the kext or the kernelcache; the dispatch is indirect and the table is
+  relocated at boot. Recovering the selector numbers needs a decompiler
+  (Ghidra/IDA/Hopper) or a live kernel view, neither of which is available here.
+- On iPhone19,7, the GMMU TLBI completion window is **not closed by 27.2**.
+  The UAT unmap → data page freed → GMMU stale translation race remains.
+- The fix is a code change plus a per-device DeviceTree gate; the gate is absent
+  on the iPhone 19,7 image. This is a fix-gating gap, not a new memory-safety bug.
+- This makes the Titan-style end goal (data page → PAPT page → GPU stale write →
+  RO-zone writable alias) still applicable on an iPhone running 27.2, assuming
+  the rest of the chain is reachable.
+
+Caveat: this is static evidence (parser + DT + BuildManifest + component search).
+Runtime confirmation is a 27.2 iPhone boot with the DT dumped and the SPTM verify
+flag read; that device was not available here. The 18PM in this lab is 27.0.1,
+where the check does not exist at all.
+
+### If the flag is present
+
+If a future iPhone build adds the DT property, the check runs and the window
+closes (panic `Failed to verify TLBI` on a still-pending GMMU TLBI). That is the
+condition to test in the next firmware.
+
+## Cutter / rz-ghidra decompilation
+
+The open-source decompiler in Cutter 2.5.0 (`rizin` + `rz-ghidra`, no Java) was used
+to confirm the two key functions. Raw `__TEXT_EXEC,__text` is loaded as ARM64, and
+`retab` is patched to `ret` in a copy so the decompiler does not truncate.
+
+MTE SK tag-page check (`0xfffffff0270d7028`, raw offset `0x23028`):
+
+```c
+if ((uint64_t)arg1 < *(uint64_t *)0xffffffffffffa218 ||
+    *(uint64_t *)0xffffffffffffa220 <= (uint64_t)arg1) {
+    func_0x0004b2ac(arg1);      // outside the SK tag-page PA range: normal path
+}
+// inside the range: panic "MTE tag page containing SK tags is mapped"
+```
+
+TLBI completion path (`0xfffffff0270c7aac`, raw offset `0x13aac`): the decompiler
+shows the verification state being read (`uVar15 >> bit & 1`), a countdown
+(`uVar14`), and the GMMU invalidation issued through a code pointer inside the
+loop; 27.0.1 lacks this block (function 264 vs 369 instructions).
+
+The IOGPU method handlers (`s_new_resource` at raw offset `0x70a4`,
+`s_submit_command_buffers` at `0x7434`) are PAC-heavy and the decompiler truncates
+at the first `pacibsppc`/`braa`; disassembly is still available, but selector
+recovery needs the dispatch table or a live kernel.
+
+## Verification plan — GMMU TLBI completion race
+
+The static delta is real, but exploitability depends on keeping a DART client's
+DMA in flight across an unmap. The test is hardware-only; it is written down here
+so the next session does not have to rediscover the shape.
+
+Target: a disposable 27.0.1 device (vulnerable) and a 27.2 device (control).
+
+Primitive needed: an IOGPU userclient plus IOSurface/metal command buffers. The
+kernel DART and IOGPU kexts are unchanged in 27.2 (IOGPU only gained a
+`systemPagingOff()` timeout diagnostic), so the user-reachable map/unmap path is
+the same on both builds; the fix lives inside SPTM.
+
+Steps:
+
+1. Allocate a page-aligned IOSurface `S`, fill it with a canary, map it through
+   IOGPU, and record its physical pages if the API exposes them.
+2. Submit a long-running GPU write into `S` (a compute shader that keeps writing
+   a pattern for several milliseconds).
+3. While the GPU work is in flight, unmap/free `S` through IOGPU so the DART
+   entry is invalidated. On 27.0.1 the invalidation is not completion-checked.
+4. Immediately allocate a fresh page `P` (user or kernel object) and fill it with
+   a different canary. If the GPU's writes land in `P`, the GMMU entry survived
+   the unmap: a stale DMA write primitive.
+5. Escalate only after step 4 is observed: reuse `P` as a kernel object with a
+   pointer field and use the GPU write to corrupt it.
+
+Success criterion: a write to `P` after `S` was unmapped, reproducible on 27.0.1
+and absent on 27.2. A GPU timeout or a single crash is not success; the canary
+difference is.
+
+Safety: run with the phone's panic log enabled, one stage at a time, and stop on
+the first unexpected kernel panic. The harness must journal the stage before the
+unmap (same pattern as Cinder27's GuardJournal).
+
+## Verification plan — MIE tag storage
+
+The SPTM `MTE tag page containing SK tags` check is unchanged, so a bypass here
+would be a new bug, not a 27.2 regression. It needs a kernel primitive that maps
+tag storage with a caller-influenced physical address (or a dangling tag-storage
+reference). The 27.2 diff does not expose such a primitive. The audit order is:
+
+1. Find the kernel callers of the SPTM tag-storage map/unmap operations (the
+   kernel MTE allocator, `VM_KERN_MEMORY_MTAG`).
+2. Check whether the PA is derived from a user-controlled IOSurface/descriptor.
+3. If yes, attempt an alias (map the same PA at a different address) and see
+   whether the SPTM range check still rejects it.
+4. If the check is bypassed, forge the tag for an SK page and read/write it.
+
+Until step 1 yields a user-influenced PA, this remains a hypothesis.
+
+## Reproduce
+
+```bash
+python3 tools/ipsw/remote_ipsw.py extract <url> sptm work/fw/27.2-sptm.im4p
+python3 tools/ipsw/ipswlib.py kernel ...          # IM4P/LZFSE decode
+python3 tools/string_xref.py work/fw/27.2-sptm.bin "Failed to verify TLBI"
+python3 tools/fw_diff.py work/fw/27.0.1-sptm.bin work/fw/27.2-sptm.bin
+```

tools/decompiler/README.md

@@ -0,0 +1,17 @@
+# ARM64 decompiler (Cutter / rizin / rz-ghidra)
+
+IDA Pro is commercial; this uses the open-source decompiler bundled with Cutter 2.5.0
+(`/Applications/Cutter.app`). No Java is involved, so it works on macOS 27 where the
+Ghidra JVM crashes in CodeHeap.
+
+```bash
+tools/decompiler/decompile.sh <raw-arm64-text.bin> <function-offset-hex>
+```
+
+Raw blobs are the `__TEXT_EXEC,__text` section of a Mach-O (see
+`tools/ipsw/ipswlib.py` for extraction). `SLEIGHHOME` is set to the bundled
+`rz_ghidra_sleigh` specs; without it rz-ghidra reports "No sleigh specification".
+
+Limitations: PAC instructions (`pacibsp`, `retab`) and some pointer-auth branches
+truncate the decompiler output. Patch `retab` (0xd65f0fff) to `ret` (0xd65f03c0) in
+a copy of the blob before decompiling; keep the original for ground truth.

tools/decompiler/decompile.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# Decompile one function from a raw ARM64 blob with Cutter's rz-ghidra.
+# usage: decompile.sh <raw.bin> <offset-hex> [sleighhome]
+set -e
+RZ=/Applications/Cutter.app/Contents/Resources/bin/rizin
+export DYLD_LIBRARY_PATH=/Applications/Cutter.app/Contents/Resources/lib
+export SLEIGHHOME=${3:-/Applications/Cutter.app/Contents/Resources/lib/rizin/plugins/rz_ghidra_sleigh}
+"$RZ" -a arm -b 64 -e scr.color=0 -q -c "s $2; af; pdg" "$1"

tools/ipsw/sptm_gate.py

@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Check whether an IPSW's SPTM TLBI verification gate is enabled for a device.
+
+Usage: python3 sptm_gate.py <sptm.bin> <devicetree.bin>
+Both inputs are decoded Mach-O/IM4P payloads (see remote_ipsw.py + ipswlib.py).
+
+Background: SPTM 27.2 parses /arm-io/sgx and looks up
+verify-gmmu-tlbis-at-sync. If the property is missing it sets the verify flag
+to 0 (0xfffffff0270cc18c: strb wzr,[x22,#0x81]) and the GMMU TLBI completion
+check is skipped. This script reports whether the gate is present in the DT.
+"""
+import sys
+
+KEYS = [
+    b"verify-gmmu-tlbis-at-sync",
+    b"gmmu-tlbi-verification-reg",
+    b"gmmu-tlbi-verification-bit",
+]
+
+
+def main():
+    sptm = open(sys.argv[1], "rb").read()
+    dt = open(sys.argv[2], "rb").read()
+    print("SPTM strings:")
+    for k in KEYS:
+        print(f"  {k.decode():32} {'present' if k in sptm else 'absent'}")
+    print("DeviceTree gate:")
+    for k in KEYS:
+        print(f"  {k.decode():32} {'present' if k in dt else 'absent'}")
+    gate = all(k in dt for k in KEYS)
+    print()
+    print("VERDICT:", "gate ENABLED" if gate else "gate DISABLED (SPTM check will be skipped)")
+    return 0 if gate else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())