009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-axp-graphene-remaining.md

@@ -1,5 +1,11 @@
 # 009 — Remaining path to AXP / Graphene-class ship (post clean-429)
 
+**Stale as an execution order.** Boot, vendor SPL, lock-scope, release-keys,
+and `hardened_malloc` moved on 2026-10-08. Start from
+`docs/009-handoff-20261008.md`.
+
+
+
 Non-normative roadmap after LAB **BOOT_OK** on Stage1+combo4+FORTIFY+Magisk+
 **CVE clean-offset 429** (denylist `CVE-2022-49980`), kernel `#47`
 (`20261001T180955Z-axp-stage1-combo4-cve-clean`). Authoritative requirements
@@ -8,6 +14,12 @@ remain `specs/009-axp-los23-port/spec.md` + constitution.
 Goal (owner): **almost all** applicable AXP.OS / Graphene-class behaviour on
 LOS 23.2 sunfish Magisk track — not a blind dump, not bootloader lock.
 
+**2026-10-07 next-bacon correction:** `misc/0021` is already present in the
+LOS kernel base. Stage1 must omit it and use `patch --forward`; otherwise GNU
+patch auto-reverses it and shrinks `KSYM_NAME_LEN` 192→128 under Clang CFI.
+The first corrected candidate retains 192 and applies only the
+`CVE-2022-49980` lock-scope companion as its new kernel delta.
+
 ## Already landed (kernel / Magisk core)
 
 | Layer | Status |
@@ -16,7 +28,7 @@ LOS 23.2 sunfish Magisk track — not a blind dump, not bootloader lock.
 | Combo4 + Clang FORTIFY | Ship |
 | Magisk preroot EXTENDROM-class | Ship |
 | CVE clean-offset 429 | Ship (LAB OK) |
-| `CVE-2022-49980` | Denylist until lock-scope port |
+| `CVE-2022-49980` | Original one-liner denylisted; corrected lock-scope candidate next |
 | High-offset CVE (~73) | Quarantine — triage started |
 
 Recover/bisect baseline: `20260929T123401Z-axp-stage1-combo4` (`#32`).
@@ -27,7 +39,8 @@ Recover/bisect baseline: `20260929T123401Z-axp-stage1-combo4` (`#32`).
    nf_tables leftovers still skipped. Next kernel depth: **US-S5-1** defconfig
    (Yama + `SLAB_FREELIST_RANDOM`), not more bulk CVE.
 2. **`CVE-2022-49980` proper port** — keep UAF fix without recursive
-   `udc_lock` (mainline lock-scope series). Optional; denylist is safe.
+   `udc_lock` using the reviewed lock-scope companion. Boot and USB gadget
+   smoke are still required; the original one-liner remains denylisted.
 3. Failed Stage1 probes (allocsize/ro/slab) — low priority vs high-offset.
 4. Graphene modern techniques / `hardened_malloc` — backlog (`docs/hardening-backlog.md`);
    evaluate after CVE depth is stable.