cinder27/docs/IOS27.2-KERNEL-DIFF.md

iOS 27.2 kernel differential — 27.0.1 vs 27.2 (iPhone19,7)

Scope: the iOS 27.2 security update (24B119) against 27.0.1 (24A446) for iPhone 18 Pro Max (iPhone19,7). The question: what does the update actually change in the kernel, which of the 162 advisory CVEs can be tied to a fix site, and does anything in the diff look like a PPL / SPTM / MIE bypass.

How the images were obtained

Both restore images are the production IPSWs from Apple's CDN:

Build	Version	Size	Kernelcache member
24A446	27.0.1	12,728,434,807 B	kernelcache.release.v6x-pandia
24B119	27.2	13,722,855,612 B	kernelcache.release.v6x-pandia

The kernelcache was pulled straight out of the ZIP with HTTP Range requests, so the analysis did not wait for the full 26 GB. The container is IM4P; the payload is LZFSE.

Build	Kernelcache (decoded)	SHA-256 (first 16)
27.0.1	78,315,520 B	dec73956a9a443c5
27.2	79,167,488 B	9a6efbc4be67319a

Both are MH_FILESET images with a __DATA_SPTM segment, carrying 303 (27.0.1) and 305 (27.2) fileset entries. Two kexts are new: com.apple.driver.ApplePencilDriver, com.apple.iokit.AppleSecurityResearch; none were removed.

Reading the diff

Raw text-segment hashes are useless here: the fileset is relinked, so branch displacements and absolute literal pools move in almost every kext even when the code is unchanged. The diff therefore keys on:

1. __TEXT_EXEC size change (layout-independent),
2. __cstring / __oslogstring set difference (new checks usually add a message),
3. llvm-objdump instruction diff for the kexts that survive both filters.

93 of 303 common kexts changed text size. The largest are the ones the advisory points at:

Delta	Kext	Advisory component
+115,472	com.apple.driver.ASIOKit	IOKit / audio
+39,624	com.apple.driver.AppleH16ANEInterface	Apple Neural Engine
+29,376	com.apple.kernel	Kernel
+16,080	com.apple.driver.AppleAVE2	AVEVideoEncoder
+9,572	com.apple.driver.FairPlayIOKit	Security
+9,316	com.apple.driver.AppleDisplayCrossbar	IOMobileFrameBuffer
+8,304	com.apple.AGXG19P	GPU
+4,712	com.apple.driver.AppleMobileDispH19P-DCP	IOMobileFrameBuffer
+4,480	com.apple.driver.RTBuddy	Kernel / RTKit
+4,152	com.apple.driver.AppleSARService	Kernel

Fix sites that are confirmed by strings

CVE-2026-112705 — AppleAVE2 temporal layers

27.2 adds the upper bound that 27.0.1 lacks:

number of temporal layers (prop) is out of range %d %d %d
0 <= pInfo->uPropCfg.sHEVC.iNumberOfTemporalLayers
    && pInfo->uPropCfg.sHEVC.iNumberOfTemporalLayers <= 7
0 < pInfo->sSessionCfg.sEnc.sAlgCfg.sGOP.iNumOfTemporalLayer
    && (... <= 7)
AVE_HEVC_CheckVPSExtBounds
HEVC VPS vps_max_layers_minus1 is out of range
HEVC VPS layer_id_in_nuh is out of range
HEVC VPS layer-set total is out of range

The property is now clamped to 0…7. The trigger in the 27.0.1 dossier (NumberOfTemporalLayers = 16463, first frame → AppleAVE2 +0xDA78) is exactly the value this assertion rejects. A --sweep mode was added to both POCs: it sets 0…12 and submits no frame. On macOS 27.0 it accepts 1…12 (and 16463); on 27.2 the

7 rungs must return an error.

CVE-2026-113910 — decmpfs chunked zlib

27.2 adds the produced-vs-expected check in AppleFSCompression/Common/ChunkCompression.cpp:

%s:%d: chunk %u produced %lld of %lld expected bytes

That is the exact under-production condition the leak harness drives. The C POC's --loop / --keep collector now sits on a documented fix site.

CVE-2026-112507 — ipc_port request table

27.2 adds the checks the 27.0.1 code was missing:

ipr != ((void*)0)
table != ((void*)0)
ipc_misc.c

This is a NULL-check fix, not a reclaimable-object fix. It matches the device result already recorded: mach_port_request_notification returns -300 (MIG_TYPE_ERROR) for every type/right combination, 0 of 12,288 registrations armed, so the request-table path is never entered from an unentitled app.

Other kernel changes

The core kernel gains 62 meaningful strings (build paths and UUIDs excluded). The security-relevant ones:

• VM entry %p lock shared lock overflow — a new vm_map lock-overflow panic, consistent with the COW / vm_map CVEs (112474 / 112576).
• Page modified after framebank withdraw %p — page-lifecycle check.
• size <= sdl->sdl_alen — sockaddr_dl bounds check in the network stack.
• speculative_pages_freed / _demoted / _requeued_inactive — pageout counters.
• FilterDropBadDirection, nx_netif_filter_pkt_to_mbuf, pktap != NULL, ret == TB_ERROR_SUCCESS — network filter validation.
• ipr != NULL, table != NULL, ipc_misc.c — the 112507 fix.
• New entitlements: com.apple.private.verified-jit-mode, com.apple.private.vfs.unmunged-access-time, com.apple.security.cs.debugger.

These line up with the 15 Kernel entries in the advisory (UAF, OOB read/write, race, type confusion, COW integrity, kernel-layout disclosure). The advisory does not assign individual functions, so the mapping above is evidence-based, not a per-CVE signature.

PPL / SPTM / MIE

This is the part the request specifically asked to dig into.

• __DATA_SPTM is byte-identical in both builds: 311,296 bytes, SHA-256 f4bc1e5e95f61af5…. No SPTM code or data changed.
• The PPL token strings (UAT_PPL_IOCTL_*, PPL map operation failed, PPL state object) are unchanged; no new PPL checks or messages.
• No MIE / Memory Integrity / mtag / page-protection strings were added or removed.
• The only SPTM-related additions are boot-time memory-size validation: memsize=%u MB leaves no memory for XNU/SPTM to manage, Mismatch of ARM_LARGE_MEMORY in SPTM/XNU, and iBoot DRAM-size checks. These are configuration checks, not a permission bypass.
• The 27.2 advisory contains no component named PPL, SPTM, MIE, or Page Protection, and no CVE description mentions them.

Verdict: no PPL, SPTM, or MIE bypass is fixed in iOS 27.2, and the firmware diff shows no change in the SPTM/PPL/MIE code paths. A bypass PoC for any of the three would have to come from a different bug, not from this update. The kernel CVEs with "write kernel memory" impacts are ordinary kernel memory-safety bugs; none of them is a page-table / monitor bypass on its own, and exploiting one would still have to defeat SPTM/PPL/MIE at runtime.

The 15 Kernel CVEs — what the advisory claims vs. what the binary shows

CVE	Advisory impact	Description	Binary evidence	R/W potential
2026-112474	terminate or write kernel memory	UAF	vm_map / lock-overflow strings (candidate)	theoretical UAF→R/W, no trigger
2026-112476	terminate	OOB read	kmalloc/zone paths, no unique string	read/DoS only
2026-112501	terminate	race	—	DoS
2026-112507	terminate or write kernel memory	OOB write	ipr != NULL, table != NULL, ipc_misc.c	not reachable from an unentitled app (-300)
2026-112514	terminate or corrupt kernel memory	UAF	framebank / page-lifecycle strings (candidate)	theoretical
2026-112516	terminate	UAF	—	DoS
2026-112517	terminate or corrupt kernel memory	UAF	—	theoretical
2026-112576	unexpected COW memory changes	memory integrity	VM entry ... lock shared lock overflow (candidate)	data-corruption primitive
2026-112606	terminate	type confusion	—	theoretical
2026-112624	bypass Privacy preferences	improved checks	new com.apple.private.* / TCC-adjacent strings (candidate)	privacy bypass, not kernel R/W
2026-112665	determine kernel memory layout	info disclosure	size <= sdl->sdl_alen (candidate)	KASLR leak candidate
2026-112679	terminate or corrupt kernel memory	UAF	—	theoretical
2026-112698	terminate	memory handling	—	DoS
2026-65350	terminate or corrupt kernel memory	UAF	—	theoretical
2026-84495	terminate or write kernel memory	UAF	—	theoretical

"Advisory impact" is Apple's wording. "Binary evidence" is what the 27.2 kernel actually adds; where no unique string exists, the CVE cannot be pinned to a function from the image alone. "Theoretical" means the primitive class can lead to R/W, not that a working trigger is known. No trigger code for these 15 was recovered from the diff, and no PoC was fabricated.

Note the discrepancy on 112507: Apple calls it an out-of-bounds write, while the 27.2 fix is a NULL-check pair (ipr, table) plus a new ipc_misc.c string. A NULL dereference is a DoS, not a reclaimable out-of-bounds object; this matches the device result.

What can be turned into a PoC

CVE	Primitive	PoC status
2026-112705	fixed-offset constant fill in AppleAVE2	existing Swift/C POC + new --sweep; kernel panic on 27.0.1, property refused on 27.2
2026-113910	kernel heap disclosure through decmpfs	existing C collector (--loop, --keep, pointer classes); read-only
2026-112507	request-table NULL check / race	existing harness; unreachable from an unentitled app (-300)
2026-112696	ANE validation, +39 KB	no trigger in the diff; ANE kext strings show resource/scheduler validation, not a user-reachable entry
2026-65385	IOHIDEvent fixed-offset write	IOHIDFamily grew only 236 B (+ TCCService); the advisory's IOKit fix is likely in the userland IOKit.framework (DSC), not this kext
other Kernel CVEs	UAF/OOB/race	fix sites visible as strings, but no trigger or reclaim strategy; writing a PoC would be guesswork

The WebKit, ImageIO, CoreMedia and other userland components live in the dyld shared cache inside the root filesystem image, which is not part of the ZIP's plain files; those were not diffed here.

Reproduce

python3 tools/ipsw/remote_ipsw.py extract <ipsw-url> kernelcache work/kernel/27.2.im4p
python3 tools/ipsw/ipswlib.py kernel ...            # decode + list
python3 tools/ipsw/extract_kext.py work/kernel/27.2.kernel \
        work/kernel/27.2-entries.json com.apple.driver.AppleAVE2 out.macho
python3 tools/ipsw/disasm_diff.py a.macho b.macho

The tools are read-only: no device is touched, and no firmware is modified.