009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh

@@ -6,8 +6,13 @@
 # off; CONFIG_LSM already lists yama but SECURITY_YAMA was unset so the LSM
 # never built.
 #
-# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped) or
-# CVE-2022-49980 (denylist until lock-scope port).
+# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped).
+# CVE-2022-49980's one-liner stays on the denylist. The bacon applies
+# ports/cve-2022-49980-lock-scope.patch after the CVE lists.
+#
+# USERFAULTFD: GOLDEN's running 4.14.355 config leaves it unset. LOS 23
+# sunfish_defconfig turns it on. This kernel has no UFFDIO_MOVE (that ioctl
+# is 6.1+), so ART only opens a fd and times out. Match GOLDEN.
 #
 # Usage: apply_uss5_1_defconfig.sh <kernel-tree>
 set -euo pipefail
@@ -17,15 +22,14 @@ DEF="$K/arch/arm64/configs/sunfish_defconfig"
 test -f "$DEF"
 test -f "$K/security/yama/Kconfig"
 
-for k in SECURITY_YAMA SLAB_FREELIST_RANDOM; do
+for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR; do
   sed -i "/CONFIG_${k}/d" "$DEF"
-  # drop "# CONFIG_FOO is not set" lines too (sed above only matches CONFIG_FOO=)
-  sed -i "/# CONFIG_${k} is not set/d" "$DEF"
 done
 
 {
   echo "CONFIG_SECURITY_YAMA=y"
   echo "CONFIG_SLAB_FREELIST_RANDOM=y"
+  echo "# CONFIG_USERFAULTFD is not set"
 } >> "$DEF"
 
-echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM) on $K"
+echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM, USERFAULTFD off) on $K"