// sb.stash · SpringBoard · SBHomeScreenService stashed layout · CVE-2026-112646
// Stashed layout name validation probe
// C twin of the Swift POC: looks up SBHomeScreenService in this process, checks for
// the 27.2 validation selector, and stats the container's IconState.plist.
// Build: clang -O2 -o cve-2026-112646 CVE-2026-112646.c -lobjc
// Run:   ./cve-2026-112646

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <objc/runtime.h>

int main(void) {
    // class lookup: SpringBoard's own classes are only registered inside SpringBoard
    Class cls = objc_getClass("SBHomeScreenService");
    printf("SBHomeScreenService in this process: %s\n", cls ? "yes" : "no");

    SEL validator = sel_registerName("_validationErrorForStashedLayoutName:");
    if (cls && class_respondsToSelector(cls, validator)) {
        printf("  validation method present (27.2 fixed)\n");
    } else {
        printf("  validation method absent (27.0 unfixed)\n");
    }

    // container probe: IconState.plist only exists inside SpringBoard's container
    const char *home = getenv("HOME");
    char path[1024];
    snprintf(path, sizeof path, "%s/Library/SpringBoard/IconState.plist", home ? home : "/tmp");
    struct stat st;
    if (stat(path, &st) == 0) {
        printf("IconState.plist in this container: present (%lld B)\n", (long long)st.st_size);
    } else {
        printf("IconState.plist in this container: absent\n");
    }
    printf("CVE-2026-112646 · stashed-layout surface is SpringBoard-only; other processes\n"
           "reach it only through the XPC surface the 27.0 build left unvalidated\n");
    return 0;
}