AppleAVE2 · temporal layers
Concrete encoding calls and a supplied panic support a crash reproduction. Useful kernel access and mitigation bypasses remain unproven.
- Capability
- Kernel crash
- Device & build
- Supplied panic: iPhone18,1, iOS 27.0.1 (24A446), T8150
- Primary artifact
- Source + panic
- Published
- Reviewed
Observed
- The app sets an oversized temporal-layer count through VideoToolbox and submits an encoding frame. The supplied panic identifies videocodecd and AppleAVE2.
- The author describes the corruption as a fixed-offset constant fill, with no arbitrary kernel read/write. The README supplies a surviving input control and reports API rejection on iOS 27.2.
- The author credits the original Calif/Chollima discovery and presents this project as a reproduction.
Assessment
The privileged fault makes this relevant to kernel research. A restricted write can be useful, but the public artifact does not identify a useful repeatable state change that execution survives.
Limits
- The faulting instruction’s offset, AppleAVE2 +0xDA78, locates the crash. It does not establish control of a write destination or identify the original overwritten object.
- No memory-disclosure primitive, acquired kernel access, MIE bypass, or complete jailbreak is demonstrated.
- The source and panic were inspected. Exact CVE attribution was not independently established by a driver binary comparison, and no on-device reproduction was performed here.