Three public research arrivals, each with a .swift and .c POC folder:
- CVE-2026-112705 (AppleAVE2 NumberOfTemporalLayers): app split into a
property probe (ave.ntl) and a deliberate fire module (ave.ntl.fire);
C twin carries a --force-host gate because a frame submit reaches the
same driver that panicked the dev Mac, so the host only builds it
- CVE-2026-112621 (LinkPresentation LPAnimatedImageTranscoder): 256x16 ->
256x48 container, loopback og:image delivery, LPMetadataProvider; probe
checks the pool math, fire runs the real transcode; C twin reproduces the
48-row clear against a guard page (32,768 B past the 16,384-byte pool)
- CVE-2026-84636 (configd dynamic store): SSID + router MAC without the
wifi-info entitlement, compared in-process with CNCopyCurrentNetworkInfo
56 modules, 34 CVE folders, 45 Swift POC files, 34 C twins. Device IPA
2.1 build 4; simulator regression: sc.dynamicstore / ave.ntl / lp.heic all
done (overflow=32768, NTL refused 0/4 on the simulator's encoder path).
JBJF
ed682e859b