AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

vendor/sunfish/patches/007-kernelsu/0001-exec-avoid-post-hook-filename-uaf.patch

@@ -0,0 +1,38 @@
+From: sunfish-a16-rom local integration
+Subject: [PATCH] exec: avoid filename use-after-free in ReSukiSU post hook
+
+Applies to our existing manual-hook integration, not pristine LineageOS.
+__do_execve_file() consumes filename, including putname() on return paths.
+The current wrapper then passes the freed object to a helper that reads
+filename->name. Call ReSukiSU's post handler directly with NULL instead;
+that handler explicitly accepts missing arguments for its LSM adapter.
+
+Reference: ReSukiSU 6d674e50a022a85076dcfe4498af9a8bfead2cf9,
+kernel/feature/sucompat.c (ksu_handle_post_execve and post_execveat).
+This fixes a source-level lifetime defect; no boot-panic causality claimed.
+Prepared during the DEBUG build without modifying the live build inputs.
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1885,7 +1885,7 @@
+ extern int ksu_handle_execveat(int *fd, struct filename **filename_ptr,
+ 				void *argv, void *envp, int *flags);
+ __attribute__((hot))
+-extern int ksu_handle_post_execveat(int *fd, struct filename **filename_ptr,
++extern int ksu_handle_post_execve(int *fd, const char *filename,
+ 				void *argv, void *envp, int *flags, int *retval);
+ #endif
+ 
+@@ -1898,7 +1898,11 @@
+ 	int retval;
+ 	ksu_handle_execveat(&fd, &filename, &argv, &envp, &flags);
+ 	retval = __do_execve_file(fd, filename, argv, envp, flags, NULL);
+-	ksu_handle_post_execveat(&fd, &filename, &argv, &envp, &flags, &retval);
++	/* __do_execve_file() already released filename on success and failure.
++	 * The ReSukiSU post hook accepts NULL filename (also used by its LSM
++	 * adapter); do not dereference the freed struct filename wrapper.
++	 */
++	ksu_handle_post_execve(&fd, NULL, &argv, &envp, &flags, &retval);
+ 	return retval;
+ #else
+ 	return __do_execve_file(fd, filename, argv, envp, flags, NULL);