009: publish AXPR23 final source and public documentation

vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh

@@ -16,6 +16,14 @@
 # sunfish_defconfig turns it on. This kernel has no UFFDIO_MOVE (that ioctl
 # is 6.1+), so ART only opens a fd and times out. Match GOLDEN.
 #
+# MEMCG / CGROUP_PIDS: Android 16 mounts cgroup v2 and attempts per-UID memory
+# and PID controller activation. The old sunfish defconfig leaves both off,
+# which produces `+memory ... Invalid argument` at runtime. Enable the native
+# 4.14 controllers for the next candidate.
+#
+# LOCALVERSION_AUTO: the kernel source is intentionally patched in the build;
+# do not expose the source worktree's incidental `-dirty` suffix in uname.
+#
 # Usage: apply_uss5_1_defconfig.sh <kernel-tree>
 set -euo pipefail
 
@@ -23,7 +31,8 @@ K=${1:?kernel tree}
 DEF="$K/arch/arm64/configs/sunfish_defconfig"
 test -f "$DEF"
 
-for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR; do
+for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR \
+         MEMCG CGROUP_PIDS LOCALVERSION_AUTO; do
   sed -i "/CONFIG_${k}/d" "$DEF"
 done
 
@@ -31,6 +40,9 @@ done
   echo "# CONFIG_SECURITY_YAMA is not set"
   echo "CONFIG_SLAB_FREELIST_RANDOM=y"
   echo "# CONFIG_USERFAULTFD is not set"
+  echo "CONFIG_MEMCG=y"
+  echo "CONFIG_CGROUP_PIDS=y"
+  echo "# CONFIG_LOCALVERSION_AUTO is not set"
 } >> "$DEF"
 
-echo "OK: US-S5-1 defconfig (SLAB_FREELIST_RANDOM; YAMA, USERFAULTFD off) on $K"
+echo "OK: US-S5-1 defconfig (SLAB_FREELIST_RANDOM; MEMCG, CGROUP_PIDS on; YAMA, USERFAULTFD, LOCALVERSION_AUTO off) on $K"