009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/009-kernel-hardening-map.md

@@ -0,0 +1,267 @@
+# 009 kernel hardening map (FR-017)
+
+> **Priority finding, 2026-09-26:** Bisect scripts (including the new dmesg-only
+> and slab-only scripts) force **bp2a**, whereas the GOOD build used **bp4a**.
+> Direct image comparison finds GOODMAKE security patch 2026-09 / SDK 36.1
+> versus mild 2025-08 / SDK 36.0. GOODMAKE boots according to the owner.
+> These are not isolated defconfig trials; see the audit below before testing.
+
+> **Audit 2026-09-26:** Before resuming builds, read
+> [the boot investigation](009-kernel-boot-audit-20260926.md).
+> The defconfig-only experiment also added FORTIFY C stubs and its `boot.img`
+> is byte-identical to the older full-hardening image; only `boot-make.img`
+> represents the new build. Its reported boot failure does not yet isolate
+> configuration alone. The later mild build already exists; its LAB boot
+> result was not found in the reviewed records.
+> Subsequent owner-provided history reports failed attempts rebooting into
+> recovery (Try again / Factory data reset), followed by successful system
+> boot after restoring GOOD. Thus "never recovery" below is not a universal
+> description. That history still presents mild as pending; see the audit.
+
+**Base**: LineageOS 23.2 `sunfish` / `kernel/google/msm-4.14` (non-GKI).  
+**Not base**: GrapheneOS A13 sunfish tree, random prebuilts, KernelSU.
+
+## Inventory (2026-09-18, `rom-dev01`)
+
+| Item | Value |
+|------|--------|
+| LOS tree | `/srv/rom/src/lineage/kernel/google/msm-4.14` |
+| LOS rev | `28f9290ae067` — *Revert "BACKPORT: module: Do not offer sha224…"* |
+| Version | `4.14.357-openela` |
+| AXP stack | `/srv/rom/references/axp/kernel_patches` @ `df3cab2155b3` (codeberg mirror) |
+| Dry-run worktree | `/srv/rom/artifacts/009-axp-los23-port/kernel-harden-dryrun/` |
+| Iodé manifest | `/srv/rom/references/iode/android-manifest` (`v5-staging`) |
+
+### LOS `sunfish_defconfig` already on
+
+`CFI_CLANG`, `SHADOW_CALL_STACK`, `CC_STACKPROTECTOR_STRONG`, `RANDOMIZE_BASE`,
+`ARM64_SW_TTBR0_PAN`, `SECURITY_PERF_EVENTS_RESTRICT`, `HARDENED_USERCOPY`(+PAGESPAN),
+`BUG_ON_DATA_CORRUPTION`, `SCHED_STACK_END_CHECK`, `# CONFIG_DEVMEM is not set`,
+`BPF_JIT_ALWAYS_ON`.  
+`# CONFIG_UNMAP_KERNEL_AT_EL0 is not set` (kept as LOS).
+
+### LOS defconfig gaps (vs typical Graphene/AH)
+
+Not set in `sunfish_defconfig` (may need Kconfig + patches first):  
+`FORTIFY_SOURCE`, `INIT_ON_ALLOC_DEFAULT_ON`, `INIT_ON_FREE_DEFAULT_ON`,
+`SLAB_FREELIST_RANDOM`, `SLAB_FREELIST_HARDENED`, `SHUFFLE_PAGE_ALLOCATOR`,
+`PAGE_POISONING`, `SECURITY_DMESG_RESTRICT`, `DEBUG_LIST`, `REFCOUNT_FULL`.
+
+### AXP `kernel_patches` shape
+
+| Series | 4.14 patches | Role |
+|--------|-------------:|------|
+| `0001-LinuxIncrementals` | 335 | Version bumps — **skip** (tree already 4.14.357-openela) |
+| `0004`–`0006`, `0008-*`, `0009` | ~40 Graphene/AH | Stage-1 candidates (below) |
+| `CVE-*` dirs | ~2301 with 4.14 | Mega CVE stage — **later**, after Stage 1 boots |
+| Location-related | — | **Skip** (FR-018 policy) |
+
+### IodéOS
+
+`v5-staging` manifest cloned; **no** `sunfish` / `msm-4.14` kernel project in
+snippets. Public gitlab device/kernel repos need auth. Treat Iodé as
+**userspace privacy** for this device; no extra 4.14 kernel delta found.
+
+## Source priority (owner 2026-09-18)
+
+| Priority | Source | Role |
+|----------|--------|------|
+| 1 | **AXP** sunfish kernel / build patches | Clone first (max) |
+| 2 | **LOS 23.2** msm-4.14 as shipped | Inventory; skip dupes |
+| 3 | **IodéOS** (LOS fork) | Diff for extra 4.14-safe hardening/deblob |
+| 4 | **GrapheneOS** | Optional: modern techniques / docs; A13 sunfish only if clearly useful |
+| — | **DivestOS** standalone | **Do not hunt** (EOL). AXP-inherited commits OK via AXP clone |
+
+## Location policy
+
+**Do not** extra-cap location vs LOS defaults (FR-018). Skip AXP location
+lockdown patches; document as skipped. Goal: **precise, fast GPS** like
+stock LOS 23.2 — not AXP privacy lockdown. Deblob/CVE stages must not
+reintroduce location hardening by accident.
+
+## Sequential apply probe (Graphene/AH only)
+
+Clean worktree @ `28f9290ae067`, patches from AXP `kernel_patches` in Divest-like
+order (`4.14` then `ANY`). Result: **OK=30, SKIP_ALREADY=4, FAIL=12**.
+
+Full machine log:  
+`/srv/rom/artifacts/009-axp-los23-port/kernel-harden-dryrun/apply-sequential-summary.txt`
+
+## Patch ledger
+
+| id | title | source | AXP? | 4.14-safe? | decision | notes |
+|----|-------|--------|------|------------|----------|-------|
+| KH-INC | LinuxIncrementals 4.14 (335) | AXP `0001` @ df3cab215 | Y | n/a | **skip** | Already 4.14.357-openela |
+| KH-004 | Perf events restrict | AXP `0004` ANY/0001 | Y | Y | **skip** | Already in LOS (`SKIP_ALREADY` + defconfig) |
+| KH-005 | Deny USB (toggle) | AXP `0005-Graphene-Deny_USB` 4.14/0003 | Y | Y | **stage1 apply** | Clean apply |
+| KH-006 | wcnss buffer fixes | AXP `0006` ANY/0001–0003 | Y | ? | **skip/port later** | Wrong path on this tree (`can't find file`) |
+| KH-008-as | alloc_size attrs | AXP `0008-…-allocsize` | Y | Y | **stage1 apply** | OK: 0002,0011,0016,0021; FAIL: 0007 (vmalloc.h hunk) |
+| KH-008-bug | ksize BUG_ON | AXP `0008-…-bugon` 0010 | Y | Y | **stage1 apply** | OK |
+| KH-008-fort | FORTIFY intra-object | AXP `0008-…-fortify` 0004 | Y | Y | **stage1 apply** | OK; then enable `CONFIG_FORTIFY_SOURCE` |
+| KH-008-misc | misc Graphene | AXP `0008-…-misc` | Y | Y | **stage1 apply** | OK 0001,0005,0010,0018; SKIP 0021 + ANY/0015 |
+| KH-008-rnd | brk/arg randomize | AXP `0008-…-random` | Y | Y | **stage1 apply** | All 4 OK when sequential |
+| KH-008-ro | __ro_after_init / sysctl RO | AXP `0008-…-ro` | Y | partial | **stage1 apply** | OK most; FAIL 0007, 0034 (sysctl drift) |
+| KH-008-san | page/slab sanitize | AXP `0008-…-sanitize` | Y | Y | **stage1 apply** | All 4 OK sequential |
+| KH-008-slab | SLAB_HARDENED | AXP `0008-…-slab` | Y | partial | **stage1 apply** | OK 0006,0014; FAIL 0010,0018 |
+| KH-008-un | unused-fn noise | AXP `0008-…-unused` | Y | Y | **stage1 apply** | OK (build hygiene) |
+| KH-009 | rfc4941bis IPv6 | AXP `0009` | Y | partial | **skip** | 4.14/0003 already present; ANY/* fail |
+| KH-CVE | CVE clean-offset 429 + denylist | AXP `CVE-*` | Y | LAB OK `#47` | **ship partial** | `cve-clean-offset.list` (ex-430−49980); high-offset ≥200 quarantined; `CVE-2022-49980` denylist (udc_lock); see `009-cve-bisect-plan.md` / `009-axp-graphene-remaining.md` |
+| KH-LOC | AXP location lockdown | AXP | Y | — | **skip** | FR-018 |
+| KH-IODE | Iodé kernel delta | Iodé | — | — | **skip** | No sunfish 4.14 fork found |
+| KH-CFG | Hardening defconfig | LOS+AXP | — | Y | **stage1 after patches** | Flip gaps that Kconfig allows post-patch |
+| KH-US-S5-1 | Yama + SLAB_FREELIST_RANDOM | Graphene/AXP class | Y | Y | **apply** | `apply_uss5_1_defconfig.sh`; LSM already listed yama |
+
+### Stage 1 apply list (exact files)
+
+From host `$KP=/srv/rom/references/axp/kernel_patches` — **only** these (order
+matters):
+
+```
+0005-Graphene-Deny_USB/4.14/0003.patch
+0008-Graphene-Kernel_Hardening-allocsize/4.14/0002.patch
+0008-Graphene-Kernel_Hardening-allocsize/4.14/0011.patch
+0008-Graphene-Kernel_Hardening-allocsize/4.14/0016.patch
+0008-Graphene-Kernel_Hardening-allocsize/4.14/0021.patch
+0008-Graphene-Kernel_Hardening-bugon/4.14/0010.patch
+0008-Graphene-Kernel_Hardening-fortify/4.14/0004.patch
+0008-Graphene-Kernel_Hardening-misc/4.14/0001.patch
+0008-Graphene-Kernel_Hardening-misc/4.14/0005.patch
+0008-Graphene-Kernel_Hardening-misc/4.14/0010.patch
+0008-Graphene-Kernel_Hardening-misc/4.14/0018.patch
+0008-Graphene-Kernel_Hardening-random/4.14/0002.patch
+0008-Graphene-Kernel_Hardening-random/4.14/0007.patch
+0008-Graphene-Kernel_Hardening-random/4.14/0012.patch
+0008-Graphene-Kernel_Hardening-random/4.14/0017.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0002.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0012.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0017.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0028.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0030.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0032.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0038.patch
+0008-Graphene-Kernel_Hardening-sanitize/4.14/0005.patch
+0008-Graphene-Kernel_Hardening-sanitize/4.14/0009.patch
+0008-Graphene-Kernel_Hardening-sanitize/4.14/0015.patch
+0008-Graphene-Kernel_Hardening-sanitize/4.14/0017.patch
+0008-Graphene-Kernel_Hardening-slab/4.14/0006.patch
+0008-Graphene-Kernel_Hardening-slab/4.14/0014.patch
+0008-Graphene-Kernel_Hardening-unused/4.14/0001.patch
+0008-Graphene-Kernel_Hardening-unused/4.14/0002.patch
+```
+
+Then defconfig (only options that exist after patches): at least
+`CONFIG_FORTIFY_SOURCE=y`; evaluate `INIT_ON_*` / slab freelist / dmesg restrict
+against Kconfig `depends on` before flipping.
+
+## Applied / skipped summary
+
+- **Applied (2026-09-18, live tree):** Stage 1 — 30 AXP Graphene/AH patches via
+  `vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh` onto
+  `/srv/rom/src/lineage/kernel/google/msm-4.14` (Stage1 alone ~28 paths;
+  tree also had prior Magisk-track dirt: KSU/SusFS `# CONFIG_* is not set`
+  stubs + residual SusFS-touched fs/overlayfs etc. — not Stage1).
+- **Defconfig (same day):** `CONFIG_FORTIFY_SOURCE=y`,
+  `CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y`, `CONFIG_INIT_ON_FREE_DEFAULT_ON=y`,
+  `CONFIG_SECURITY_DMESG_RESTRICT=y`, `CONFIG_SLAB_HARDENED=y`.
+- Skipped: location lockdown (policy); Divest-as-hunt (policy); LinuxIncrementals;
+  KH-004 (already present); KH-006 wcnss (path miss); KH-009 ANY; Iodé kernel
+  (none found); CVE mega (in progress via `cve_checker`)
+- Failed probe (port later): allocsize/0007, ro/0007+0034, slab/0010+0018
+- **Build fix 2026-09-18:** Stage1 `slab/0014` misfuzzed into `is_root_cache`
+  (`return p == s` with no `p`) — reverted that stub. Intent was
+  `slab_equal_or_root`; LOS already has `return s == p` there.
+- **Build fix 2026-09-18b:** `CONFIG_FORTIFY_SOURCE=y` + Clang LTO left
+  `__read_overflow*` undefined in modules (qcacld/techpack) — added `BUG()`
+  stubs + `EXPORT_SYMBOL` in `lib/string.c`.
+- **Bacon OK (Stage1 only):**
+  `/srv/rom/artifacts/009-axp-los23-port/20260918T180359Z-axp-kh-stage1/`
+- **CVE bacon OK:**
+  `/srv/rom/artifacts/009-axp-los23-port/20260918T215034Z-axp-kh-cve/`
+  Stage1 + ~500 CVE patches that compile. ~34 incomplete series on denylist
+  (`cve-stage/denylist.txt`) — skipped, not silently dropped without a log.
+  Magisk preroot present; KernelSU absent.
+- **More complete bacon OK:**
+  `/srv/rom/artifacts/009-axp-los23-port/20260918T231654Z-axp-kh-full/`
+  AXP `hardenDefconfig` on the CVE tree (only options this Kconfig has).
+  Left on: `IO_URING`, `USERFAULTFD`, WireGuard, IPA. Magisk preroot OK.
+- **Not done:** userspace Deblob.sh (Widevine/IMS/CNE). Kernel deblob in AXP
+  is mostly IPA removal — skipped so mobile data keeps working.
+- **Flash target (LAB 2026-09-21):** back on
+  `20260918T143547Z-axp-full` (pre-kernel-hardening). Owner confirmed boot OK.
+- **Boot-fail (LAB 2026-09-21):** all three KH artifacts hang at Google logo
+  (bootloader splash, never recovery/Android):
+  - `231654Z-axp-kh-full`, `215034Z-axp-kh-cve`, `180359Z-axp-kh-stage1`
+  - Stage1 **`boot-make.img` (no Magisk)** also hangs → kernel Stage1 (+
+    Stage1 defconfig extras), not Magisk packaging.
+  - OTA `payload` boot == Magisk artifact boot; OTA `dtbo` identical across
+    good vs Stage1. Loose `dtbo.img`/`vbmeta.img` in artifact dirs ≠ payload
+    (do not flash those sueltos). Embedded boot `dtb` identical all four.
+  - `/sys/fs/pstore` empty after failed boots (no ramoops).
+- **Bisect 2026-09-21:** `20260921T185024Z-bisect-defconfig-only`
+  (clean LOS + FORTIFY/INIT_ON_*/DMESG/SLAB_FREELIST_HARDENED, no Graphene
+  patches) → LAB **bootloop** / try-again recovery.
+- **LAB 2026-09-28:** Clang FORTIFY nested-`strlen` fix (`strlcpy`/`strcpy` →
+  `__underlying_strlen`). Family `full` + **combo4+FORTIFY** boot. Magisk bacon:
+  `apply_combo4_fortify.sh` / `009-bacon-axp-combo4-fortify.sh`.
+- **LAB 2026-09-29 (ship kernel pack):** Stage1 (30) + combo4 + Clang FORTIFY
+  Magisk bacon `20260929T123401Z-axp-stage1-combo4` — boots, Wi‑Fi CRC OK,
+  Deny USB sysctl present. Attribution: `docs/009-gate-g-kernel-attribution.md`.
+  Apply: `apply_stage1_combo4.sh`. Bacon: `009-bacon-axp-stage1-combo4.sh`.
+- **CVE re-try 2026-09-29:** full `cve-strict` (503) = LAB Google logo hang.
+  Bisect: `docs/009-cve-bisect-plan.md` (`cve-bisect-h1/h2.list`).
+- **Bisect 2026-09-21 mild:** `DMESG_RESTRICT` + `SLAB_FREELIST_HARDENED`
+  only → same failure.
+- **Control 2026-09-26:** `20260918T143547Z` **boot-make.img** (no Magisk,
+  no extra CONFIG) flashed onto Magisk system → **boots OK**.
+- **Audit 2026-09-26 (owner second opinion):** bisect scripts wrongly used
+  `lunch …-bp2a-userdebug` while good bacon uses `breakfast` → `bp4a`.
+  Mild/defconfig-only boots carry `security_patch=2025-08-05` / SDK 36.0 vs
+  GOODMAKE `2026-09-01` / 36.1; ramdisk and other kernel options also differ.
+  **Invalidates** “DMESG/SLAB alone kill boot”. bp2a one-config builds aborted.
+  See `docs/009-kernel-boot-audit-20260926.md`.
+- **Control ksync 2026-09-26:** new breakfast/bp4a kernel (no Stage1 CONFIG)
+  injected into GOODMAKE ramdisk → LAB **boots OK** (`20260926T161646Z-bisect-ksync-control`).
+  Method validated. Next: same inject path, one CONFIG at a time (DMESG then SLAB).
+  **Future tests:** always `breakfast`/bp4a + inject kernel into GOODMAKE ramdisk;
+  never bp2a-only bootimage as a “config” experiment. Lessons also in agent
+  personal store `009-kernel-bisect-lessons.md`.
+  Deblob still deferred (GPS: no AXP location lockdown).
+
+## CVE / hardening / deblob policy (owner 2026-09-18 evening)
+
+- **Source of truth**: AXP method (`kernel_patches` + `cve_checker`), applied onto
+  LOS23 `msm-4.14` — not inventing our own CVE hunt.
+- **Skip if already fixed** in LOS tree (patcher “already applied” / reverse
+  hunks). LOS23 is newer than AXP22; many CVEs may already be present via
+  `4.14.357-openela`. Hardening/deblob are where AXP usually still wins.
+- **Loose 4.19**: when enabled, the patcher may also try patches filed under
+  `4.19/` (and with extreme matching, even `^5.x`/`^6.x`) on a `4.14` tree.
+  First pass with loose ON applied ~185 non-4.14 patches and **broke the
+  build** (incomplete binder/bpf/f2fs series). **OFF for CVE apply** (exact
+  `4.14` + `ANY` only). Re-evaluate later if needed.
+- **On failure**: do not silent-drop — attempt fix / adapt / re-apply; only
+  then document skip with reason (AXP `Fix_CVE_Patchers` style).
+- **Deblob**: AXP deblob pass after CVE/hardening inventory (separate from CVE
+  IDs); Lineage rarely matches AXP here.
+- **Flash**: owner on return; agent does not need to flash for this phase.
+
+## 2026 catalog refresh (started 2026-09-19)
+
+CIP `kernel-sec` cloned at `/srv/rom/references/cip-kernel-sec` @ `025be706`
+(2026-09-19). Scrape vs AXP catalog `df3cab215` (2025-10-30): **7086** CVEs
+not in that list (6317× CVE-2026, 769× CVE-2025). **None** have a `4.14`
+backport link; one has `4.19`. The rest are mainline / 5.10+.
+
+kernel.org `linux-stable` `v4.14.*` stops at **4.14.336**. Nothing newer to
+incremental-apply; the LOS tree is already `4.14.357-openela`.
+
+Android bulletins (new URL `/docs/security/bulletin/YYYY/YYYY-MM-01`, which
+the jar scraper does not accept) have **no** `git.kernel.org` links. Kernel
+rows point at `android.googlesource.com/kernel/common`: 2025-12 (44),
+2026-03 (36), 2026-06 (2), 2026-09 (10). Links saved in
+`/srv/rom/artifacts/009-axp-los23-port/cve-2026/asb-links.txt`.
+
+Download + checker (read-only on the live tree; does not reset the flashed
+kernel) is detached as tmux `009-cve-2026`. One mainline patch per new CVE
+lands in `/srv/rom/references/axp/kernel_patches_2026/`. Apply is **not**
+started: 2026 patches are 6.x and the last loose pass broke 4.14.