009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding, bundled apps, and AXP-class product surface docs/scripts.
2026-10-05 10:42:00 +02:00
1 parent fd793b9471
commit deaaf42caa
@@ -0,0 +1 @@
+certs/
@@ -13,6 +13,8 @@ LOCAL_OVERRIDES_PACKAGES := com.google.android.gms
 LOCAL_SRC_FILES := prebuilt/GmsCore.apk
 LOCAL_REPLACE_PREBUILT_APK_INSTALLED := $(LOCAL_PATH)/prebuilt/GmsCore.apk
 LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
+# microG v0.3.16+ declares required uses-library com.android.location.provider
+LOCAL_USES_LIBRARIES := com.android.location.provider
 LOCAL_OPTIONAL_USES_LIBRARIES := \
    org.apache.http.legacy \
    androidx.window.extensions \
@@ -47,3 +49,49 @@ LOCAL_OPTIONAL_USES_LIBRARIES := \
    androidx.window.extensions \
    androidx.window.sidecar
 include $(BUILD_PREBUILT)
+
+# 009 bundled apps (PRESIGNED; host prebuilts via symlink) → product
+# Optional window libs: same manifest tags as Phonesky/GmsCore (A16 enforce check).
+include $(CLEAR_VARS)
+LOCAL_MODULE := AuroraStore
+LOCAL_MODULE_CLASS := APPS
+LOCAL_PRODUCT_MODULE := true
+LOCAL_CERTIFICATE := PRESIGNED
+LOCAL_SRC_FILES := prebuilt/AuroraStore.apk
+LOCAL_REPLACE_PREBUILT_APK_INSTALLED := $(LOCAL_PATH)/prebuilt/AuroraStore.apk
+LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
+LOCAL_OPTIONAL_USES_LIBRARIES := \
+    androidx.window.extensions \
+    androidx.window.sidecar
+include $(BUILD_PREBUILT)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := Droidify
+LOCAL_MODULE_CLASS := APPS
+LOCAL_PRODUCT_MODULE := true
+LOCAL_CERTIFICATE := PRESIGNED
+LOCAL_SRC_FILES := prebuilt/Droidify.apk
+LOCAL_REPLACE_PREBUILT_APK_INSTALLED := $(LOCAL_PATH)/prebuilt/Droidify.apk
+LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
+LOCAL_OPTIONAL_USES_LIBRARIES := \
+    androidx.window.extensions \
+    androidx.window.sidecar
+include $(BUILD_PREBUILT)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := FossifyGallery
+LOCAL_MODULE_CLASS := APPS
+LOCAL_PRODUCT_MODULE := true
+LOCAL_CERTIFICATE := PRESIGNED
+LOCAL_OVERRIDES_PACKAGES := Gallery Gallery2 Glimpse
+LOCAL_SRC_FILES := prebuilt/FossifyGallery.apk
+LOCAL_REPLACE_PREBUILT_APK_INSTALLED := $(LOCAL_PATH)/prebuilt/FossifyGallery.apk
+LOCAL_MODULE_SUFFIX := $(COMMON_ANDROID_PACKAGE_SUFFIX)
+include $(BUILD_PREBUILT)
+
+# US-S4-2 — AXP PRO has no Jelly (system_ext noDefaultBrowserWebView).
+include $(CLEAR_VARS)
+LOCAL_MODULE := NoLineageJelly
+LOCAL_MODULE_TAGS := optional
+LOCAL_OVERRIDES_PACKAGES := Jelly
+include $(BUILD_PHONY_PACKAGE)
@@ -7,3 +7,22 @@
 # official microG (which breaks F-Droid same-signer updates).

 BOARD_SUPER_PARTITION_ERROR_LIMIT := 9441378304
+
+# Product LINEAGE_VERSION id: set in vendor/extra/product.mk (via bacon
+# symlink to extra-product.mk) — BoardConfig is too late for version.mk.
+# Keep a duplicate here only as documentation / get_build_var fallback.
+TARGET_UNOFFICIAL_BUILD_ID := AXP-Resurection-Pro
+
+# US-S3 — project AVB *signing* key (Gate G infrastructure).
+# Included after device/google/sunfish BoardConfig-common.mk → override here.
+# Keep WITH_AVB unset → BoardConfigLineage adds vbmeta --flags 3
+# (HASHTREE_DISABLED|VERIFICATION_DISABLED). Magisk-friendly unlocked LAB;
+# NOT runtime AVB enforcement / "hardened verified boot".
+# Bootloader relock = wont. OEM unlocking: leave enabled (escape hatch only).
+_AXP_AVB_KEY := vendor/sunfish-a16/certs/avb.pem
+ifneq ($(wildcard $(_AXP_AVB_KEY)),)
+  BOARD_AVB_ALGORITHM := SHA256_RSA4096
+  BOARD_AVB_KEY_PATH := $(_AXP_AVB_KEY)
+  BOARD_AVB_VBMETA_SYSTEM_ALGORITHM := SHA256_RSA4096
+  BOARD_AVB_VBMETA_SYSTEM_KEY_PATH := $(_AXP_AVB_KEY)
+endif
@@ -0,0 +1,8 @@
+# Bundled user apps (009) — Aurora Store, Droidify, Fossify Gallery.
+# APKs live on host at /srv/rom/prebuilts/axp-apps/ (never Git).
+# Symlink into vendor/sunfish-a16/prebuilt/ before bacon.
+
+PRODUCT_PACKAGES += \
+    AuroraStore \
+    Droidify \
+    FossifyGallery
@@ -0,0 +1,13 @@
+# AXP Resurection Pro product / OTA identity (009).
+#
+# "Pro" marks the full Magisk-resurrection track (not a future slim/minimal
+# variant). GOLDEN used releasetype PRO + ro.lineage.version=…-sunfish-pro.
+#
+# TARGET_UNOFFICIAL_BUILD_ID is set in vendor/extra/product.mk (early Lineage
+# hook, before version.mk). BoardConfig + this file are not early enough alone.
+# Ship scripts also publish AXP-Resurection-Pro-*.zip from lineage-*.zip.
+
+# Identity props (not axp.os endpoints). Empty on GOLDEN for ro.axp.version —
+# local track marker only.
+PRODUCT_PRODUCT_PROPERTIES += \
+    ro.axp.resurection.track=pro
@@ -0,0 +1,5 @@
+# Early Lineage hook (vendor/lineage/config/common.mk inherits this *before*
+# version.mk). Required so LINEAGE_VERSION picks up the unofficial id.
+# BoardConfig.mk is too late for TARGET_UNOFFICIAL_BUILD_ID.
+
+TARGET_UNOFFICIAL_BUILD_ID := AXP-Resurection-Pro
@@ -0,0 +1,29 @@
+# US-S4 — userspace hardening (AXP Resurection Pro).
+# Match AXP.OS PRO sunfish product surface (see hardening/README.md +
+# docs/009-axp-pro-product-apps-20260324.md).
+#
+# Real strips:
+#   US-S4-1 apply_009_drop_openssh_packages.py (common.mk)
+#   US-S4-2 apply_009_drop_jelly_gallery2.py (Jelly + Gallery2)
+# PRODUCT_PACKAGES filter-out via inherit alone has failed before — keep as
+# belt-and-suspenders only.
+
+PRODUCT_PACKAGES := $(filter-out \
+    scp \
+    sftp \
+    ssh \
+    sshd \
+    sshd_config \
+    ssh-keygen \
+    start-ssh \
+    rsync \
+    Jelly \
+    Gallery2 \
+    Glimpse \
+    ,$(PRODUCT_PACKAGES))
+
+PRODUCT_PACKAGES += NoLineageJelly
+
+PRODUCT_PACKAGES_DEBUG := $(filter-out procmem,$(PRODUCT_PACKAGES_DEBUG))
+
+# Keep init.openssh.rc — AXP PRO still ships it (mkdir /data/ssh* only).
@@ -0,0 +1,15 @@
+# Magisk preroot (009) — clean Magisk, stock UI, no modules.
+# Wiring: vendor/sunfish-a16/magisk/{prepare_magisk.sh,patch.sh,apply_releasetools_hook.py}
+# Runtime: SUNFISH_A16_MAGISK_PREROOT=1 + prepare_magisk.sh before packaging.
+# Magisk is NOT a PRODUCT_PACKAGE (EXTENDROM-style preroot).
+
+# No packages — boot is patched at releasetools time.
+
+# US-S2 release keys (PRODUCT_DEFAULT_DEV_CERTIFICATE) — see signing.mk
+$(call inherit-product-if-exists, vendor/sunfish-a16/signing.mk)
+
+# OTA / version branding (TARGET_UNOFFICIAL_BUILD_ID=AXP-Resurection-Pro)
+$(call inherit-product-if-exists, vendor/sunfish-a16/branding.mk)
+
+# US-S4-1 userspace hardening (drop product OpenSSH, etc.)
+$(call inherit-product-if-exists, vendor/sunfish-a16/hardening.mk)
@@ -0,0 +1,26 @@
+# Magisk preroot (sunfish-a16 / 009)
+
+**Policy:** clone AXP / EXTENDROM `EXTENDROM_PREROOT_BOOT` — do not invent.
+Diverge only if LOS23 or Magisk version breaks that path.
+
+**Clean Magisk**, stock UI. No GOLDEN modules. No KernelSU in ship kernel.
+
+| File | Role |
+|------|------|
+| `prepare_magisk.sh` | Unzip Magisk APK → `$OUT_DIR/.magisk` (same as extendrom `er.sh`) |
+| `patch.sh` | From sfX extendrom — patches boot.img via Magisk `boot_patch.sh` |
+| `apply_releasetools_hook.py` | Inject into releasetools `common.py` (A16) |
+
+AXP virgin UX: Magisk not a `PRODUCT_PACKAGE`; root inactive until user
+Additional Setup. See `docs/009-magisk-preinstall-runbook.md`.
+
+```bash
+export SUNFISH_A16_MAGISK_PREROOT=1   # optional; READY file is the real gate
+MAGISK_STAGE_DIR=$ANDROID_BUILD_TOP/out/.magisk \
+  vendor/sunfish-a16/magisk/prepare_magisk.sh
+python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
+```
+
+Hook **v2** runs when `out/.magisk/READY` exists (preferred) and/or
+`SUNFISH_A16_MAGISK_PREROOT=1`. Env alone is unreliable under soong/ninja.
+Without READY / env the hook no-ops.
@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""Idempotent Magisk preroot hook into releasetools common.py (LOS 23.2 / A16).
+
+Gate (either is enough):
+  - ``out/.magisk/READY`` present (preferred — survives ninja/soong env scrubbing)
+  - ``SUNFISH_A16_MAGISK_PREROOT=1``
+
+Matches sfX extendrom inject (always-on once staged), adapted for A16 + our
+vendor path. ``RunAndCheckOutput`` env is merged with ``os.environ`` so PATH /
+ANDROID_BUILD_TOP survive (extendrom only passed ``system_root_image``; that
+works via shebang but is fragile under sandboxes).
+"""
+from __future__ import annotations
+
+import argparse
+import os
+import pathlib
+import re
+import sys
+
+MARKER = "SUNFISH_A16: Magisk preroot hook"
+MARKER_VER = "SUNFISH_A16: Magisk preroot hook v2"
+
+BUILD_HOOK = '''
+  # SUNFISH_A16: Magisk preroot hook v2 (before AVB)
+  # Gate: staged out/.magisk/READY and/or SUNFISH_A16_MAGISK_PREROOT=1
+  _sf_top = os.getenv("ANDROID_BUILD_TOP") or os.environ.get("PWD") or os.getcwd()
+  _sf_ready = os.path.isfile(os.path.join(_sf_top, "out", ".magisk", "READY"))
+  _sf_env = os.environ.get("SUNFISH_A16_MAGISK_PREROOT") == "1"
+  if _sf_ready or _sf_env:
+    if ((partition_name == "boot" and info_dict.get("init_boot") != "true")
+        or partition_name == "init_boot"):
+      mpatcher = [
+          os.path.join(_sf_top, "vendor/sunfish-a16/magisk/patch.sh"),
+          img.name,
+          _sf_top,
+      ]
+      logger.info("SUNFISH_A16 Magisk patching (build): %s", img.name)
+      _sf_penv = os.environ.copy()
+      _sf_penv["system_root_image"] = info_dict.get("system_root_image", "false")
+      _sf_penv.setdefault("ANDROID_BUILD_TOP", _sf_top)
+      RunAndCheckOutput(mpatcher, verbose=True, env=_sf_penv)
+'''
+
+PREBUILT_HOOK = '''
+  # SUNFISH_A16: Magisk preroot hook v2 (prebuilt)
+  _sf_top = os.getenv("ANDROID_BUILD_TOP") or os.environ.get("PWD") or os.getcwd()
+  _sf_ready = os.path.isfile(os.path.join(_sf_top, "out", ".magisk", "READY"))
+  _sf_env = os.environ.get("SUNFISH_A16_MAGISK_PREROOT") == "1"
+  if _sf_ready or _sf_env:
+    if ((prebuilt_name == "boot.img" or prebuilt_name == "init_boot.img")
+        and os.path.exists(prebuilt_path)):
+      if info_dict is None:
+        info_dict = OPTIONS.info_dict
+      bimg = os.path.join(_sf_top, prebuilt_path)
+      logger.info("SUNFISH_A16 Magisk patching (prebuilt): %s", bimg)
+      mpatcher = [
+          os.path.join(_sf_top, "vendor/sunfish-a16/magisk/patch.sh"),
+          bimg,
+          _sf_top,
+      ]
+      _sf_penv = os.environ.copy()
+      _sf_penv["system_root_image"] = info_dict.get("system_root_image", "false")
+      _sf_penv.setdefault("ANDROID_BUILD_TOP", _sf_top)
+      RunAndCheckOutput(mpatcher, verbose=True, env=_sf_penv)
+'''
+
+
+def _strip_old_hooks(text: str) -> str:
+    """Remove prior SUNFISH Magisk hook blocks (v1 gated or v2)."""
+    # Build hook: from our comment through just before AVB block
+    text = re.sub(
+        r"\n  # SUNFISH_A16: Magisk preroot hook(?: v2)? \(before AVB\).*?"
+        r"(?=\n  # AVB: if enabled)",
+        "\n",
+        text,
+        count=1,
+        flags=re.S,
+    )
+    # Prebuilt hook: after BOOTABLE_IMAGES assign, before "if os.path.exists(prebuilt_path)"
+    text = re.sub(
+        r"(  prebuilt_path = os\.path\.join\(unpack_dir, \"BOOTABLE_IMAGES\", prebuilt_name\)\n)"
+        r"\n  # SUNFISH_A16: Magisk preroot hook(?: v2)? \(prebuilt\).*?"
+        r"(?=\n  if os\.path\.exists\(prebuilt_path\):)",
+        r"\1",
+        text,
+        count=1,
+        flags=re.S,
+    )
+    return text
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--top", default=os.environ.get("ANDROID_BUILD_TOP", ""))
+    ap.add_argument("--dry-run", action="store_true")
+    ap.add_argument(
+        "--force",
+        action="store_true",
+        help="Replace an existing SUNFISH Magisk hook with v2",
+    )
+    args = ap.parse_args()
+    top = pathlib.Path(args.top or ".")
+    target = top / "build/make/tools/releasetools/common.py"
+    if not target.is_file():
+        print(f"ERROR: missing {target}", file=sys.stderr)
+        return 2
+    text = target.read_text()
+
+    if MARKER_VER in text and not args.force:
+        print(f"already applied (v2): {target}")
+        return 0
+
+    if MARKER in text or MARKER_VER in text:
+        if not args.force and MARKER_VER not in text:
+            # old v1 present — upgrade
+            pass
+        text = _strip_old_hooks(text)
+
+    needle_avb = (
+        '  # AVB: if enabled, calculate and add hash to boot.img or recovery.img.\n'
+        '  if info_dict.get("avb_enable") == "true":\n'
+        '    avbtool = info_dict["avb_avbtool"]\n'
+        '    if partition_name == "recovery":'
+    )
+    idx = text.find(needle_avb)
+    if idx < 0:
+        print("ERROR: AVB anchor not found", file=sys.stderr)
+        return 3
+    text = text[:idx] + BUILD_HOOK + "\n" + text[idx:]
+
+    assign = '  prebuilt_path = os.path.join(unpack_dir, "BOOTABLE_IMAGES", prebuilt_name)\n'
+    idx2 = text.find(assign)
+    if idx2 < 0:
+        print("ERROR: prebuilt assign not found", file=sys.stderr)
+        return 4
+    insert_at = idx2 + len(assign)
+    text = text[:insert_at] + PREBUILT_HOOK + "\n" + text[insert_at:]
+
+    if args.dry_run:
+        print("dry-run OK (v2)")
+        return 0
+    target.write_text(text)
+    print(f"applied v2 -> {target}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,122 @@
+#!/bin/bash
+#########################################################################################################
+#
+# simple patch wrapper for patching a boot.img during the build process
+#
+#########################################################################################################
+#
+# Copyright (C) 2023-2024 steadfasterX <steadfasterX -AT- binbash #DOT# rocks>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+#########################################################################################################
+#
+# usage:
+# ./patch.sh <full-path-of-boot.img>
+#
+#########################################################################################################
+
+# DO NOT set -e !
+
+# parse calling params
+export BOOTIMG="$1"
+export TOP="$2"
+[ -z "$TOP" -o ! -d "$TOP" ] && TOP=$PWD
+
+# colored (optional) output
+PRINT(){
+    MSG="$2"
+    case $1 in
+        [1-9]*|E|ERROR)
+            echo -e "\e[0;31m$0 - ERROR: ${MSG}\e[0m" ;;
+        I|INFO)
+            echo -e "\e[1;34m$0 - INFO: ${MSG}\e[0m" ;;
+        0|OK|SUCCESS)
+            echo -e "\e[0;32m$0 - OK: ${MSG}\e[0m" ;;
+        *)
+            echo -e "$0 - ${MSG}" ;;
+    esac
+}
+
+PRINT I "Starting: $0 with: >$BOOTIMG< (TOP=$TOP)"
+
+# LEGACYSAR can't be detected by the magisk patcher so must be set by us where needed (e.g. fajita).
+# LEGACYSAR ensures kernel gets patched if required.
+# https://github.com/topjohnwu/Magisk/blob/9aa466c7730ef4ef73195b476f9804ebf86932d2/scripts/boot_patch.sh#L220-L243
+export LEGACYSAR=${system_root_image}
+PRINT I "system_root_image=$LEGACYSAR"
+
+# PREINITDEVICE can't be detected during build so must be set manually
+# otherwise  "Requires Additional Setup" on first start will not be able to patch w/o direct flash
+# which is a problem on locked devices (obviously)
+# https://github.com/AXP-OS/build/wiki/Frequently-Asked-Questions#magisk-requires-additional-setup-on-start
+export PREINITDEVICE=userdata
+
+# tell magisk that we are not in booted android
+export BOOTMODE=false
+
+# set output file descriptor to pts0 which *should* be the current shell
+export OUTFD=0
+
+# do not remove verity nor encryption
+export KEEPVERITY=true
+export KEEPFORCEENCRYPT=true
+
+# set magisk environment
+export OUT_DIR=$TOP/out
+export MAG_DIR="$OUT_DIR/.magisk"
+
+# disable due to not allowed binary or useless within the build process
+alias dos2unix=
+alias mount=echo
+alias umount=echo
+
+# enable a fallback to get properties, according to:
+# https://github.com/topjohnwu/Magisk/blob/4eaf701cb79cd9255333abad8482e69987f86280/scripts/util_functions.sh#L59
+getprop(){
+   find $OUT_DIR/target/product -type f -name build.prop -exec grep $1 {} \; | tail -n1
+}; export -f getprop
+
+test -e $BOOTIMG
+PRINT $? "testing existence of >$BOOTIMG< returned: $?"
+
+# do the magisk magic
+/bin/bash $MAG_DIR/boot_patch.sh "$BOOTIMG" \
+    && cp -v $MAG_DIR/new-boot.img "$BOOTIMG"
+RET=$?
+
+# simple check if magisk can be found in the resulting boot.img
+grep -q --text 'magisk' $BOOTIMG
+MCHK=$?
+
+# sometimes the above is not valid even though patching was successful
+if [ $MCHK -ne 0 ];then
+    PRINT I "Simple magisk check failed, unpacking for a detailed test..\n"
+    [ -d "$MAG_DIR/test" ] && rm -rf $MAG_DIR/test
+    mkdir $MAG_DIR/test
+    cd $MAG_DIR/test
+    $MAG_DIR/magiskboot unpack $BOOTIMG && $MAG_DIR/magiskboot cpio ramdisk.cpio test
+    case $? in
+        1|4) MCHK=0;;
+        *) ;;
+    esac
+    cd $TOP
+    rm -rf $MAG_DIR/test
+fi
+
+# check & print result
+if [ "$MCHK" -eq 0 ];then PRINT OK "MAGISK found in $BOOTIMG!";else PRINT E "Magisk not found in $BOOTIMG!";fi
+RET=$((RET + $MCHK))
+
+PRINT $RET "ended with: $RET\n\n"
+exit $RET
@@ -0,0 +1,55 @@
+#!/bin/bash
+# Stage Magisk v22+ APK into $OUT_DIR/.magisk (or MAGISK_STAGE_DIR) for preroot.
+# Attribute: sfX-android extendrom er.sh MAGISK block + Magisk upstream.
+set -euo pipefail
+TOP="${ANDROID_BUILD_TOP:-${1:-}}"
+OUT_DIR="${OUT_DIR:-$TOP/out}"
+STAGE="${MAGISK_STAGE_DIR:-$OUT_DIR/.magisk}"
+APK="${MAGISK_APK:-/srv/rom/prebuilts/magisk/Magisk-v30.7.apk}"
+ARCH="${MAGISK_TARGET_ARCH:-arm64}"
+
+if [ -z "$TOP" ] || [ ! -d "$TOP" ]; then
+  echo "Usage: ANDROID_BUILD_TOP=/path prepare_magisk.sh" >&2
+  exit 2
+fi
+test -f "$APK" || { echo "Missing Magisk APK: $APK" >&2; exit 4; }
+
+rm -rf "$STAGE"
+mkdir -p "$STAGE"
+unzip -q "$APK" -d "$STAGE/src"
+
+# Host tools (x86_64) for patching during build
+cp "$STAGE/src/lib/x86_64/libmagiskboot.so" "$STAGE/magiskboot" 2>/dev/null \
+  || cp "$STAGE/src/lib/x86/libmagiskboot.so" "$STAGE/magiskboot"
+chmod 755 "$STAGE/magiskboot"
+
+if [ "$ARCH" = "arm64" ]; then
+  if [ -f "$STAGE/src/lib/arm64-v8a/libmagisk64.so" ]; then
+    cp "$STAGE/src/lib/arm64-v8a/libmagisk64.so" "$STAGE/magisk64"
+  else
+    cp "$STAGE/src/lib/arm64-v8a/libmagisk.so" "$STAGE/magisk"
+  fi
+  cp "$STAGE/src/lib/arm64-v8a/libmagiskinit.so" "$STAGE/magiskinit"
+  [ -f "$STAGE/src/lib/arm64-v8a/libinit-ld.so" ] && cp "$STAGE/src/lib/arm64-v8a/libinit-ld.so" "$STAGE/init-ld"
+  [ -f "$STAGE/src/lib/arm64-v8a/libmagiskpolicy.so" ] && cp "$STAGE/src/lib/arm64-v8a/libmagiskpolicy.so" "$STAGE/magiskpolicy"
+else
+  echo "Unsupported MAGISK_TARGET_ARCH=$ARCH" >&2
+  exit 4
+fi
+
+chmod 755 "$STAGE/src/assets/boot_patch.sh"
+rm -rf "$STAGE/src/assets/dexopt" "$STAGE/src/assets/chromeos" 2>/dev/null || true
+cp "$STAGE/src/assets/"* "$STAGE/"
+cp "$STAGE/src/assets/boot_patch.sh" "$STAGE/root_boot.sh"
+chmod 755 "$STAGE/boot_patch.sh" "$STAGE/magiskinit" "$STAGE/magiskboot"
+[ -f "$STAGE/magisk64" ] && chmod 755 "$STAGE/magisk64"
+[ -f "$STAGE/magisk" ] && chmod 755 "$STAGE/magisk"
+[ -f "$STAGE/init-ld" ] && chmod 755 "$STAGE/init-ld"
+
+# Point patch.sh at our vendor copy
+MARKER="$STAGE/READY"
+echo "apk=$(basename "$APK")" > "$MARKER"
+echo "arch=$ARCH" >> "$MARKER"
+echo "staged=$(date -u -Iseconds)" >> "$MARKER"
+echo "OK Magisk staged at $STAGE"
+cat "$MARKER"
@@ -10,9 +10,11 @@ python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_f

 - **Call recording**: EXTENDROM `er.sh` F_CALLREC / AXP GOLDEN
  (`extendrom_call_recording`). steadfasterX EXTENDROM.
- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` already
-  wired in `WindowManagerService` on A16; DO preference
-  `allow_flag_secure_override` writes that key.
+- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` + DO
+  preference `allow_flag_secure_override`. Stock WMS only applies the
+  setting when `ro.debuggable=1`; we remove that gate via
+  `apply_wms_disable_secure_debuggable_gate.py` so ship images keep
+  `ro.debuggable=0` while the toggle still works.

 ## Touched paths

@@ -24,9 +26,15 @@ python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_f
 | Settings controllers | `…/ER_CallRec*.java`, `…/FlagSecureOverride*.java` |
 | Settings DO XML + strings | `res/xml/development_settings.xml`, `res/values/strings.xml` |
 | Dashboard | `DevelopmentSettingsDashboardFragment.java` |
-| Capture path | stock WMS `disable_secure_windows` (no extra WM patch) |
+| Capture path | WMS `updateDisableSecureWindows()` — **no** `ro.debuggable` gate |
+| WMS apply | `apply_wms_disable_secure_debuggable_gate.py` |
+
+```bash
+python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
+```

 Backups: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`  
-Marker: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`
+Markers: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`,
+`SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE`

 See `docs/008-call-rec-flag-secure-runbook.md`.
@@ -5,16 +5,18 @@ Call recording (AXP GOLDEN / EXTENDROM F_CALLREC):
 - Settings.Secure.ER_ALLOW_ANY_CALL_REC = \"extendrom_call_recording\"
 - DO switch + Dialer CallRecorder.canRecordInCurrentCountry early-return

-FLAG_SECURE (AOSP A16 already implements WM path):
+FLAG_SECURE (AOSP A16 WM path + project WMS gate removal):
 - DO switch writes Settings.Secure.DISABLE_SECURE_WINDOWS
-  (\"disable_secure_windows\"). WindowManagerService.updateDisableSecureWindows()
-  already honours it on debuggable builds (LAB userdebug).
+  (\"disable_secure_windows\").
+- Also run apply_wms_disable_secure_debuggable_gate.py so WMS honours the
+  setting with ro.debuggable=0 (stock AOSP required debuggable).

 Attribution: EXTENDROM (steadfasterX) for call-rec; AOSP DISABLE_SECURE_WINDOWS
-for capture; sunfish-a16 DO wiring.
+for capture; sunfish-a16 DO + WMS gate wiring.

 Run on rom-dev01:
  python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_flag_secure.py
+  python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
 """
 from __future__ import annotations

@@ -125,8 +127,9 @@ public class ER_CallRecInfo extends DeveloperOptionsPreferenceController

 FLAG_SECURE_CTRL = """/*
 * sunfish-a16-rom ({marker}): Developer Options gate for AOSP
- * Settings.Secure.DISABLE_SECURE_WINDOWS (WindowManagerService already
- * honours this on debuggable builds).
+ * Settings.Secure.DISABLE_SECURE_WINDOWS. Pair with
+ * apply_wms_disable_secure_debuggable_gate.py so WMS honours the setting
+ * when ro.debuggable=0.
 */

 package com.android.settings.development;
@@ -406,8 +409,8 @@ def patch_strings() -> None:
    <!-- {MARKER}: FLAG_SECURE override (writes AOSP disable_secure_windows) -->
    <string name="flag_secure_override_category">Secure window screenshots</string>
    <string name="allow_flag_secure_override">Allow screenshots of secure windows</string>
-    <string name="allow_flag_secure_override_summary">When enabled, apps that set FLAG_SECURE can still be captured by the system screenshot / screen record paths (debuggable builds). Weakens app privacy.</string>
-    <string name="allow_flag_secure_override_details">Writes Settings.Secure.disable_secure_windows. On userdebug/eng, WindowManager treats FLAG_SECURE windows as capturable. Default OFF restores stock secure-window behaviour.</string>
+    <string name="allow_flag_secure_override_summary">When enabled, apps that set FLAG_SECURE can still be captured by the system screenshot / screen record paths. Weakens app privacy. Does not change ro.debuggable.</string>
+    <string name="allow_flag_secure_override_details">Writes Settings.Secure.disable_secure_windows. WindowManager treats FLAG_SECURE windows as capturable while this is ON (project build; ro.debuggable stays 0). Default OFF restores stock secure-window behaviour.</string>
 """
    text = text.replace("</resources>", add + "</resources>", 1)
    path.write_text(text)
@@ -458,6 +461,17 @@ def verify_dialer_config() -> None:
        print("Dialer config.xml: call_recording_audio_source=4 (OK)")


+def apply_wms_gate() -> None:
+    """Invoke sibling script that drops the ro.debuggable gate in WMS."""
+    import subprocess
+    import sys
+
+    sibling = Path(__file__).resolve().parent / "apply_wms_disable_secure_debuggable_gate.py"
+    r = subprocess.run([sys.executable, str(sibling)], check=False)
+    if r.returncode != 0:
+        raise SystemExit(f"WMS disable-secure gate apply failed: {r.returncode}")
+
+
 def main() -> None:
    if not TREE.is_dir():
        raise SystemExit(f"LOS tree missing: {TREE}")
@@ -475,6 +489,7 @@ def main() -> None:
    patch_development_xml()
    patch_dashboard()
    verify_dialer_config()
+    apply_wms_gate()
    print("done:", MARKER)


@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Remove AOSP ro.debuggable gate on Settings.Secure.DISABLE_SECURE_WINDOWS.
+
+LOS 23.2 / A16 WindowManagerService.updateDisableSecureWindows() returns early
+unless SystemProperties.getBoolean(\"ro.debuggable\") is true. That blocks the
+Developer Options toggle on builds that keep ro.debuggable=0 (including this
+project's LAB image labelled userdebug).
+
+This patch removes ONLY that gate. Behaviour:
+  disable_secure_windows=0 → stock FLAG_SECURE (mDisableSecureWindows=false)
+  disable_secure_windows=1 → mDisableSecureWindows=true; isSecureLocked()/Task.isSecure()
+                              honour the override (no second debuggable check elsewhere)
+
+Does NOT change ro.debuggable, Build.IS_DEBUGGABLE, ViewServer, or screen-share
+protections (DISABLE_SCREEN_SHARE_PROTECTIONS_FOR_APPS_AND_NOTIFICATIONS).
+
+Audit (LOS23 frameworks/base, 2026-09-18): sole gate is updateDisableSecureWindows();
+WindowState.isSecureLocked / Task.isSecure only call getDisableSecureWindows().
+
+Run on rom-dev01:
+  python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/\\
+      apply_wms_disable_secure_debuggable_gate.py
+"""
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+TREE = Path("/srv/rom/src/lineage")
+MARKER = "SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE"
+BAK_ROOT = Path("/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots")
+WMS = (
+    TREE
+    / "frameworks/base/services/core/java/com/android/server/wm/"
+    "WindowManagerService.java"
+)
+
+OLD = """        void updateDisableSecureWindows() {
+            if (!SystemProperties.getBoolean(SYSTEM_DEBUGGABLE, false)) {
+                return;
+            }
+
+            boolean disableSecureWindows;
+"""
+
+NEW = f"""        void updateDisableSecureWindows() {{
+            // {MARKER}: honour Settings.Secure.DISABLE_SECURE_WINDOWS even when
+            // ro.debuggable=0. Stock AOSP gated this on SYSTEM_DEBUGGABLE; ship
+            // builds keep debuggable off and use the Secure setting alone.
+            boolean disableSecureWindows;
+"""
+
+
+def backup(path: Path) -> None:
+    BAK_ROOT.mkdir(parents=True, exist_ok=True)
+    dest = BAK_ROOT / path.name
+    if not dest.exists():
+        shutil.copy2(path, dest)
+        print(f"backup -> {dest}")
+
+
+def main() -> int:
+    if not WMS.is_file():
+        print(f"ERROR: missing {WMS}")
+        return 2
+    text = WMS.read_text()
+    if MARKER in text:
+        print(f"already applied: {WMS}")
+        return 0
+    if OLD not in text:
+        print("ERROR: expected updateDisableSecureWindows debuggable gate not found")
+        print("(tree already diverged — inspect manually)")
+        return 3
+    backup(WMS)
+    WMS.write_text(text.replace(OLD, NEW, 1))
+    print(f"applied -> {WMS}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Attribute: AXP GOLDEN ConnectivityCheckPreferenceController (Settings.apk),
+ * cloned for LOS 23.2 without axp.os / captiveportal.axpos.org endpoints.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ */
+package com.android.settings.network;
+
+import android.content.ContentResolver;
+import android.content.Context;
+import android.provider.Settings;
+
+import androidx.preference.ListPreference;
+import androidx.preference.Preference;
+import androidx.preference.PreferenceScreen;
+
+import com.android.settings.R;
+import com.android.settings.core.BasePreferenceController;
+import com.android.settings.core.PreferenceControllerMixin;
+import com.android.settingslib.RestrictedLockUtils;
+import com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
+import com.android.settingslib.RestrictedLockUtilsInternal;
+import com.android.settingslib.core.lifecycle.events.OnResume;
+
+import android.os.UserHandle;
+import android.os.UserManager;
+
+/** Internet connectivity check provider list (captive portal URLs). */
+public class ConnectivityCheckPreferenceController extends BasePreferenceController
+        implements PreferenceControllerMixin, Preference.OnPreferenceChangeListener, OnResume {
+
+    private static final String KEY = "connectivity_check_settings";
+
+    private static final int DISABLED = 0;
+    private static final int AMAZON = 1;
+    private static final int CLOUDFLARE = 2;
+    private static final int GOOGLE = 3;
+    private static final int HUAWEI = 4;
+    private static final int KUKETZ = 5;
+    private static final int MICROSOFT = 6;
+    private static final int OPENSUSE = 7;
+    private static final int UBUNTU = 8;
+
+    private ListPreference mConnectivityPreference;
+
+    public ConnectivityCheckPreferenceController(Context context) {
+        super(context, KEY);
+    }
+
+    @Override
+    public int getAvailabilityStatus() {
+        return isDisabledByAdmin() ? DISABLED_FOR_USER : AVAILABLE;
+    }
+
+    @Override
+    public String getPreferenceKey() {
+        return KEY;
+    }
+
+    @Override
+    public void displayPreference(PreferenceScreen screen) {
+        ListPreference pref = new ListPreference(screen.getContext());
+        pref.setKey(KEY);
+        pref.setOrder(30);
+        pref.setIcon(R.drawable.ic_settings_language);
+        pref.setTitle(R.string.connectivity_check_title);
+        pref.setSummary(R.string.connectivity_check_summary);
+        pref.setEntries(R.array.connectivity_check_entries);
+        pref.setEntryValues(R.array.connectivity_check_values);
+        pref.setOnPreferenceChangeListener(this);
+        if (mConnectivityPreference == null) {
+            screen.addPreference(pref);
+            mConnectivityPreference = pref;
+        }
+        super.displayPreference(screen);
+        updatePreferenceState();
+    }
+
+    private void updatePreferenceState() {
+        if (mConnectivityPreference == null) {
+            return;
+        }
+        ContentResolver cr = mContext.getContentResolver();
+        int mode = Settings.Global.getInt(cr, Settings.Global.CAPTIVE_PORTAL_MODE, 1);
+        if (mode == 0) {
+            mConnectivityPreference.setValueIndex(DISABLED);
+            return;
+        }
+        String http = Settings.Global.getString(cr, Settings.Global.CAPTIVE_PORTAL_HTTP_URL);
+        int idx = GOOGLE;
+        if ("http://fireoscaptiveportal.com/generate_204".equals(http)) {
+            idx = AMAZON;
+        } else if ("http://cp.cloudflare.com".equals(http)) {
+            idx = CLOUDFLARE;
+        } else if ("http://connectivitycheck.gstatic.com/generate_204".equals(http)) {
+            idx = GOOGLE;
+        } else if ("http://connectivitycheck.platform.hicloud.com/generate_204".equals(http)) {
+            idx = HUAWEI;
+        } else if ("http://captiveportal.kuketz.de".equals(http)) {
+            idx = KUKETZ;
+        } else if ("http://edge-http.microsoft.com/captiveportal/generate_204".equals(http)) {
+            idx = MICROSOFT;
+        } else if ("http://conncheck.opensuse.org".equals(http)) {
+            idx = OPENSUSE;
+        } else if ("http://connectivity-check.ubuntu.com".equals(http)) {
+            idx = UBUNTU;
+        }
+        mConnectivityPreference.setValueIndex(idx);
+    }
+
+    private void setCaptivePortalURLs(ContentResolver cr, int value) {
+        final String httpKey = Settings.Global.CAPTIVE_PORTAL_HTTP_URL;
+        final String httpsKey = Settings.Global.CAPTIVE_PORTAL_HTTPS_URL;
+        final String fallbackKey = Settings.Global.CAPTIVE_PORTAL_FALLBACK_URL;
+        final String otherKey = Settings.Global.CAPTIVE_PORTAL_OTHER_FALLBACK_URLS;
+        final String modeKey = Settings.Global.CAPTIVE_PORTAL_MODE;
+
+        String http;
+        String https;
+        String fallback;
+        String other;
+        int mode = 1;
+
+        switch (value) {
+            case DISABLED:
+                // Match GOLDEN: write Google URLs then mode=0
+                http = "http://connectivitycheck.gstatic.com/generate_204";
+                https = "https://www.google.com/generate_204";
+                fallback = "http://www.google.com/gen_204";
+                other = "http://play.googleapis.com/generate_204";
+                mode = 0;
+                break;
+            case AMAZON:
+                http = "http://fireoscaptiveportal.com/generate_204";
+                https = "https://fireoscaptiveportal.com/generate_204";
+                fallback = http;
+                other = http;
+                break;
+            case CLOUDFLARE:
+                http = "http://cp.cloudflare.com";
+                https = "https://cp.cloudflare.com";
+                fallback = http;
+                other = http;
+                break;
+            case HUAWEI:
+                http = "http://connectivitycheck.platform.hicloud.com/generate_204";
+                https = "https://connectivitycheck.platform.hicloud.com/generate_204";
+                fallback = http;
+                other = http;
+                break;
+            case KUKETZ:
+                http = "http://captiveportal.kuketz.de";
+                https = "https://captiveportal.kuketz.de";
+                fallback = http;
+                other = http;
+                break;
+            case MICROSOFT:
+                http = "http://edge-http.microsoft.com/captiveportal/generate_204";
+                https = http;
+                fallback = http;
+                other = http;
+                break;
+            case OPENSUSE:
+                http = "http://conncheck.opensuse.org";
+                https = "https://conncheck.opensuse.org";
+                fallback = http;
+                other = http;
+                break;
+            case UBUNTU:
+                http = "http://connectivity-check.ubuntu.com";
+                https = "https://connectivity-check.ubuntu.com";
+                fallback = http;
+                other = http;
+                break;
+            case GOOGLE:
+            default:
+                http = "http://connectivitycheck.gstatic.com/generate_204";
+                https = "https://www.google.com/generate_204";
+                fallback = "http://www.google.com/gen_204";
+                other = "http://play.googleapis.com/generate_204";
+                break;
+        }
+
+        Settings.Global.putString(cr, httpKey, http);
+        Settings.Global.putString(cr, httpsKey, https);
+        Settings.Global.putString(cr, fallbackKey, fallback);
+        Settings.Global.putString(cr, otherKey, other);
+        Settings.Global.putInt(cr, modeKey, mode);
+    }
+
+    @Override
+    public boolean onPreferenceChange(Preference preference, Object newValue) {
+        if (KEY.equals(preference.getKey())) {
+            setCaptivePortalURLs(
+                    mContext.getContentResolver(), Integer.parseInt((String) newValue));
+            return true;
+        }
+        return false;
+    }
+
+    @Override
+    public void onResume() {
+        updatePreferenceState();
+        if (mConnectivityPreference != null && mConnectivityPreference.getValue() != null) {
+            setCaptivePortalURLs(
+                    mContext.getContentResolver(),
+                    Integer.parseInt(mConnectivityPreference.getValue()));
+        }
+    }
+
+    private EnforcedAdmin getEnforcedAdmin() {
+        return RestrictedLockUtilsInternal.checkIfRestrictionEnforced(
+                mContext, UserManager.DISALLOW_CONFIG_PRIVATE_DNS, UserHandle.myUserId());
+    }
+
+    private boolean isDisabledByAdmin() {
+        return getEnforcedAdmin() != null;
+    }
+}
@@ -0,0 +1,58 @@
+# 009 AXP LOS23 port — patch / packaging README
+
+**Track**: Magisk AXP resurrection on LOS 23.2 sunfish (`AXP_Resurection`).  
+**Not ship**: KernelSU / SusFS (`007` standby / optional recycle only).
+
+## Apply order (host tree under `/srv/rom/src/lineage/`)
+
+1. **Google stack** — `vendor/sunfish-a16/gms.mk` + `Android.mk` (microG, GSF,
+   Phonesky). Host APKs: `/srv/rom/prebuilts/{microg,phonesky}/` (never Git).
+2. **Signature spoofing** — `vendor/sunfish-a16/patches/005-sigspoof/`
+   (`apply_005_sigspoof.py`). Attribute: LOS restricted spoofing + AXP/005.
+3. **Call recording unlock** — `vendor/sunfish-a16/patches/008-call-rec-flag-secure/`
+   (`extendrom_call_recording`). Attribute: EXTENDROM `F_CALLREC`.
+4. **Magisk preroot** — EXTENDROM-class boot/`init_boot` patch using Magisk APK
+   from `/srv/rom/prebuilts/magisk/` (see `docs/009-magisk-preinstall-runbook.md`).
+   Stub: `vendor/sunfish-a16/magisk.mk`. Attribute: Magisk upstream + sfX
+   extendrom Magisk patcher. **Host tree currently has no `vendor/extendrom`**
+   — must vendor minimal patcher or checkout extendrom before first Magisk bacon.
+5. **Bundled apps** — `/srv/rom/prebuilts/axp-apps/` + `apps.mk` (Aurora,
+   Droidify, Fossify Gallery). Symlink APKs into `vendor/sunfish-a16/prebuilt/`.
+6. **Private DNS presets** — `apply_009_private_dns_providers.py` (GOLDEN list).
+7. **Internet connectivity check** — `apply_009_connectivity_check.py` (GOLDEN
+   list **minus** AXP.OS / `axpos.org`).
+8. **Disable for user apps** — `apply_009_disable_user_apps.py` (SPA gate).
+9. **Userspace hardening / signing** — staged: see `signing/README.md`,
+   `hardening/README.md` (US-S4-1 OpenSSH trim), and
+   `docs/009-hardening-signing-checklist.md` (US-S1 keys → US-S2 wire →
+   US-S3 AVB → US-S4+ harden). Bootloader lock = wont.
+10. **Kernel hardening** — LOS23 `msm-4.14` + map in
+   `docs/009-kernel-hardening-map.md` (FR-017). Stage 1:
+   `vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh`
+   (AXP Graphene/AH allowlist). Priority: AXP → LOS → Iodé → optional
+   Graphene; no Divest hunt; no extra location lockdown.
+
+## Product includes
+
+Wire Magisk-resurrection product from `vendor/sunfish-a16/` into
+`lineage_sunfish` (same pattern as `004`/`005`). Keep Phonesky priv-app path.
+**No FakeStore. No KernelSU product packages.**
+
+## Deferred
+
+- Banking Gate E / Island validation (owner future).
+- Localization AXP-vs-LOS compare (`docs/009-localization-axp-vs-los.md` stub).
+
+## Host paths (rom-dev01)
+
+| What | Path |
+|------|------|
+| Magisk APK | `/srv/rom/prebuilts/magisk/Magisk-v30.7.apk` |
+| EXTENDROM Magisk patcher | `/srv/rom/references/extendrom/config/magisk/` |
+| Kernel source | `/srv/rom/src/lineage/kernel/google/msm-4.14` |
+| Product include (gms) | `device/google/sunfish/lineage_sunfish.mk` → `vendor/sunfish-a16/gms.mk` |
+| Vanilla baseline | `/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/` |
+| Optional KSU boots | `/srv/rom/artifacts/007-kernelsu/` (non-ship) |
+
+**Gap:** `vendor/extendrom` is **not** checked out in the lineage tree yet.
+Magisk bacon blocked on T011 (symlink/checkout + PREROOT or slim wire).
@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+"""009: port GOLDEN Internet connectivity check UI (sans axp.os).
+
+Copies ConnectivityCheckPreferenceController, adds string/array resources,
+wires into NetworkDashboardFragment. Idempotent.
+"""
+from __future__ import annotations
+
+import pathlib
+import shutil
+import sys
+
+MARKER = "sunfish-a16-009-connectivity-check"
+
+ENTRIES = """    <!-- {m}: GOLDEN connectivity providers minus AXP.OS -->
+    <string-array name="connectivity_check_entries" translatable="false">
+        <item>Disabled</item>
+        <item>Amazon Fire OS (US)</item>
+        <item>Cloudflare (US)</item>
+        <item>Google (US) [default]</item>
+        <item>Huawei (CN)</item>
+        <item>Kuketz (DE)</item>
+        <item>Microsoft Edge (US)</item>
+        <item>openSUSE (DE)</item>
+        <item>Ubuntu (UK)</item>
+    </string-array>
+    <string-array name="connectivity_check_values" translatable="false">
+        <item>0</item>
+        <item>1</item>
+        <item>2</item>
+        <item>3</item>
+        <item>4</item>
+        <item>5</item>
+        <item>6</item>
+        <item>7</item>
+        <item>8</item>
+    </string-array>
+""".format(
+    m=MARKER
+)
+
+STRINGS = f"""    <!-- {MARKER} -->
+    <string name="connectivity_check_title" translatable="false">Internet connectivity check</string>
+    <string name="connectivity_check_summary" translatable="false">HTTP endpoints to use for performing internet connectivity checks.</string>
+"""
+
+
+def ensure_arrays(path: pathlib.Path) -> None:
+    text = path.read_text(encoding="utf-8")
+    if "connectivity_check_entries" in text:
+        return
+    if "</resources>" not in text:
+        raise SystemExit(f"FAIL: no </resources> in {path}")
+    path.write_text(text.replace("</resources>", ENTRIES + "</resources>", 1), encoding="utf-8")
+
+
+def ensure_strings(path: pathlib.Path) -> None:
+    text = path.read_text(encoding="utf-8")
+    if "connectivity_check_title" in text:
+        return
+    path.write_text(text.replace("</resources>", STRINGS + "</resources>", 1), encoding="utf-8")
+
+
+def wire_fragment(path: pathlib.Path) -> None:
+    text = path.read_text(encoding="utf-8")
+    if "ConnectivityCheckPreferenceController" in text:
+        return
+    if "controllers.add(privateDnsPreferenceController);" not in text:
+        raise SystemExit("FAIL: expected PrivateDns add site missing")
+    text = text.replace(
+        "controllers.add(privateDnsPreferenceController);",
+        "controllers.add(privateDnsPreferenceController);\n"
+        f"        // {MARKER}\n"
+        "        controllers.add(new ConnectivityCheckPreferenceController(context));",
+        1,
+    )
+    path.write_text(text, encoding="utf-8")
+
+
+def main() -> int:
+    root = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else ".")
+    here = pathlib.Path(__file__).resolve().parent
+    src = here / "ConnectivityCheckPreferenceController.java"
+    dst = root / (
+        "packages/apps/Settings/src/com/android/settings/network/"
+        "ConnectivityCheckPreferenceController.java"
+    )
+    arrays = root / "packages/apps/Settings/res/values/arrays.xml"
+    # Prefer cm_strings for non-translated titles; fall back to strings.xml end
+    cm = root / "packages/apps/Settings/res/values/cm_strings.xml"
+    frag = root / (
+        "packages/apps/Settings/src/com/android/settings/network/NetworkDashboardFragment.java"
+    )
+    for p in (src, arrays, cm, frag):
+        if not p.is_file():
+            print(f"FAIL: missing {p}", file=sys.stderr)
+            return 1
+
+    if dst.is_file() and MARKER.split("-")[0] and "sans axp" in dst.read_text(encoding="utf-8"):
+        # already copied
+        pass
+    else:
+        dst.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(src, dst)
+
+    ensure_arrays(arrays)
+    ensure_strings(cm)
+    wire_fragment(frag)
+    print(f"OK: connectivity check wired -> {dst}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""009: allow classic Disable for non-system apps (A16 Archive era).
+
+LOS AppDisableButton returns null for !isSystemApp. Graphene/AXP-class UX
+keeps Disable usable for user apps. Attribute: AXP/owner preference over Archive.
+Idempotent.
+"""
+from __future__ import annotations
+
+import pathlib
+import sys
+
+MARKER = "sunfish-a16-009-disable-user-apps"
+
+CANDIDATES = [
+    pathlib.Path("packages/apps/Settings/src/com/android/settings/spa/app/appinfo/AppDisableButton.kt"),
+]
+
+
+def main() -> int:
+    root = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else ".")
+    path = None
+    for rel in CANDIDATES:
+        p = root / rel
+        if p.is_file():
+            path = p
+            break
+    if path is None:
+        print("FAIL: AppDisableButton.kt not found", file=sys.stderr)
+        return 1
+
+    text = path.read_text(encoding="utf-8")
+    if MARKER in text:
+        print(f"OK: already applied ({path})")
+        return 0
+
+    old = "        if (!app.isSystemApp) return null\n"
+    if old not in text:
+        print("FAIL: expected isSystemApp gate not found", file=sys.stderr)
+        return 2
+
+    new = (
+        f"        // {MARKER}: allow Disable for user apps (not only system)\n"
+        f"        // if (!app.isSystemApp) return null\n"
+    )
+    path.write_text(text.replace(old, new, 1), encoding="utf-8")
+    print(f"OK: patched {path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,161 @@
+#!/usr/bin/env python3
+"""US-S4-2 — drop Lineage Jelly + Gallery2 to match AXP.OS PRO product surface.
+
+Oracle: AXP.OS-22.2-20260324-PRO-sunfish.zip product/app has neither Jelly nor
+Gallery2 (browser stub + FossifyGallery_FD live on system_ext). See
+docs/009-axp-pro-product-apps-20260324.md.
+
+FossifyGallery already declares LOCAL_OVERRIDES_PACKAGES := Gallery Gallery2
+Glimpse, but Gallery2 still landed in product/app on the 162840Z ship — same
+class of failure as OpenSSH filter-out. Patch the Lineage PRODUCT_PACKAGES
+add sites and add belt-and-suspenders stubs.
+
+Usage (from ANDROID_BUILD_TOP):
+  python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_jelly_gallery2.py
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import sys
+from pathlib import Path
+
+MARKER = "sunfish-a16-009-uss4-2-jelly-gallery2"
+
+# Common Lineage shapes (tolerant).
+JELLY_BLOCK = re.compile(
+    r"# Browser\n"
+    r"PRODUCT_PACKAGES \+= \\\n"
+    r"    Jelly\n",
+    re.MULTILINE,
+)
+
+# ExactCalculator + Jelly list (common Lineage shape) → keep ExactCalculator only.
+JELLY_WITH_CALC = re.compile(
+    r"(PRODUCT_PACKAGES \+= \\\n"
+    r"    ExactCalculator) \\\n"
+    r"    Jelly\n",
+    re.MULTILINE,
+)
+
+GALLERY2_IN_LIST = re.compile(
+    r"(    DeskClock \\\n)"
+    r"    Gallery2 \\\n",
+    re.MULTILINE,
+)
+
+
+def patch_text(text: str, path: Path) -> tuple[str, list[str]]:
+    notes: list[str] = []
+    bad = f"# Jelly stripped ({MARKER})" in text or f"# Gallery2 stripped ({MARKER})" in text
+    has_pkg = bool(re.search(r"(?m)^[ \t]*Jelly( \\)?$", text)) or bool(
+        re.search(r"(?m)^[ \t]*Gallery2( \\)?$", text)
+    )
+    if MARKER in text and not bad and not has_pkg:
+        notes.append("already")
+        return text, notes
+
+    orig = text
+
+    text, n = JELLY_BLOCK.subn(
+        f"# Browser (Jelly) omitted ({MARKER}) — AXP PRO uses noDefaultBrowserWebView\n",
+        text,
+        count=1,
+    )
+    if n:
+        notes.append(f"jelly_block={n}")
+
+    text, n = JELLY_WITH_CALC.subn(
+        rf"\1\n",
+        text,
+        count=1,
+    )
+    if n:
+        notes.append(f"jelly_calc={n}")
+
+    text, n = GALLERY2_IN_LIST.subn(
+        rf"\1",
+        text,
+        count=1,
+    )
+    if n:
+        notes.append(f"gallery2_list={n}")
+
+    # Remove leftover broken comment-only continuations from older applicator.
+    text2 = re.sub(
+        r"^[ \t]*# (?:Jelly|Gallery2) stripped \(" + re.escape(MARKER) + r"\)\n",
+        "",
+        text,
+        flags=re.MULTILINE,
+    )
+    if text2 != text:
+        notes.append("scrub_bad_comments")
+        text = text2
+
+    if text == orig and not notes:
+        return orig, notes
+    if MARKER not in text and text != orig:
+        text = f"# {MARKER}\n" + text
+    return text, notes
+
+
+def main() -> int:
+    top = Path(os.environ.get("ANDROID_BUILD_TOP", ".")).resolve()
+    candidates = [
+        top / "vendor/lineage/config/common.mk",
+        top / "vendor/lineage/config/common_mobile.mk",
+        top / "vendor/lineage/config/common_full.mk",
+        top / "vendor/lineage/config/telephony.mk",
+        top / "build/make/target/product/handheld_product.mk",
+        top / "build/make/target/product/handheld_system.mk",
+        top / "build/make/target/product/generic_system.mk",
+    ]
+    # Also scan device trees that often force Gallery2
+    for p in (top / "device").rglob("*.mk") if (top / "device").is_dir() else []:
+        if p.name in ("device.mk", "lineage.mk", "lineage_sunfish.mk", "aosp_sunfish.mk"):
+            candidates.append(p)
+
+    touched = 0
+    still_present = []
+    for mk in candidates:
+        if not mk.is_file():
+            continue
+        text = mk.read_text(encoding="utf-8", errors="replace")
+        if "Jelly" not in text and "Gallery2" not in text:
+            continue
+        # Ignore mention-only in comments/docs after a clean strip.
+        has_pkg = bool(re.search(r"(?m)^[ \t]*Jelly( \\)?$", text)) or bool(
+            re.search(r"(?m)^[ \t]*Gallery2( \\)?$", text)
+        )
+        bad = f"# Jelly stripped ({MARKER})" in text or f"# Gallery2 stripped ({MARKER})" in text
+        if not has_pkg and not bad:
+            continue
+        new, notes = patch_text(text, mk)
+        if notes == ["already"]:
+            print(f"OK: already applied ({mk})")
+            touched += 1
+            continue
+        if new == text:
+            print(f"WARN: {mk} mentions Jelly/Gallery2 but no pattern matched: {notes}")
+            still_present.append(str(mk))
+            continue
+        mk.write_text(new, encoding="utf-8")
+        print(f"OK: patched {mk} ({', '.join(notes)})")
+        touched += 1
+
+    if still_present:
+        print(
+            "FAIL: Jelly/Gallery2 still present, patterns missed: "
+            + ", ".join(still_present),
+            file=sys.stderr,
+        )
+        return 1
+    if touched == 0:
+        print("OK: Jelly/Gallery2 already absent from PRODUCT_PACKAGES sites")
+        return 0
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""US-S4-1 — strip OpenSSH/rsync/procmem packages from Lineage common.mk.
+
+AXP.OS PRO sunfish (A15) product/system lack sshd/ssh/rsync/procmem binaries but
+still ship init.openssh.rc. PRODUCT_PACKAGES filter-out via inherit-product did
+*not* remove them from the 20261002T125259Z ship image — patch the source block
+instead (same place Lineage adds them).
+
+Keeps PRODUCT_COPY_FILES for init.openssh.rc (AXP surface).
+
+Usage:
+  python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_drop_openssh_packages.py
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import sys
+from pathlib import Path
+
+MARKER = "sunfish-a16-009-uss4-openssh"
+
+OPENSSH_PACKAGES = re.compile(
+    r"# Openssh\n"
+    r"PRODUCT_PACKAGES \+= \\\n"
+    r"(?:    \S+ \\\n)*"
+    r"    start-ssh\n",
+    re.MULTILINE,
+)
+
+RSYNC_PACKAGES = re.compile(
+    r"# rsync\n"
+    r"PRODUCT_PACKAGES \+= \\\n"
+    r"    rsync\n",
+    re.MULTILINE,
+)
+
+PROCMEM_DEBUG = re.compile(
+    r"# These packages are excluded from user builds\n"
+    r"PRODUCT_PACKAGES_DEBUG \+= \\\n"
+    r"    procmem\n"
+    r"\n"
+    r"ifneq \(\$\(TARGET_BUILD_VARIANT\),user\)\n"
+    r"PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST \+= \\\n"
+    r"    system/bin/procmem\n"
+    r"endif\n",
+    re.MULTILINE,
+)
+
+
+def main() -> int:
+    top = Path(os.environ.get("ANDROID_BUILD_TOP", ".")).resolve()
+    mk = top / "vendor/lineage/config/common.mk"
+    if not mk.is_file():
+        print(f"FAIL: missing {mk}", file=sys.stderr)
+        return 1
+    text = mk.read_text()
+    if MARKER in text:
+        print(f"OK: already applied ({mk})")
+        return 0
+
+    orig = text
+    text, n1 = OPENSSH_PACKAGES.subn(
+        f"# Openssh packages stripped ({MARKER}) — keep init.openssh.rc below\n",
+        text,
+        count=1,
+    )
+    text, n2 = RSYNC_PACKAGES.subn(
+        f"# rsync stripped ({MARKER})\n",
+        text,
+        count=1,
+    )
+    text, n3 = PROCMEM_DEBUG.subn(
+        f"# procmem debug package stripped ({MARKER})\n",
+        text,
+        count=1,
+    )
+    if n1 != 1 or n2 != 1:
+        print(
+            f"FAIL: Openssh/rsync block match n1={n1} n2={n2} n3={n3}",
+            file=sys.stderr,
+        )
+        return 1
+    # procmem block optional if layout drifted
+    if n3 == 0:
+        print("WARN: procmem debug block not matched (layout drift)")
+
+    if "init.openssh.rc" not in text:
+        print("FAIL: init.openssh.rc COPY_FILES missing after patch", file=sys.stderr)
+        return 1
+
+    mk.write_text(text)
+    print(f"OK: patched {mk} (openssh_pkgs={n1} rsync={n2} procmem={n3})")
+    return 0 if text != orig else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,498 @@
+#!/usr/bin/env python3
+"""009: expand Private DNS presets to AXP GOLDEN list (no axp.os).
+
+Clones GOLDEN Settings radios/hostnames into LOS PrivateDnsModeDialogPreference
+(which already has a Cloudflare stub). Idempotent via marker comments.
+"""
+from __future__ import annotations
+
+import pathlib
+import re
+import sys
+
+MARKER = "sunfish-a16-009-private-dns"
+
+# key, UI label, DoT hostname — GOLDEN order (cloudflare hostname = security.*)
+PROVIDERS = [
+    ("adguard", "AdGuard (CT)", "dns.adguard.com"),
+    ("appliedprivacy", "AppliedPrivacy (AT)", "dot1.applied-privacy.net"),
+    ("cira", "CIRA (CA)", "protected.canadianshield.cira.ca"),
+    ("controld", "Control D (CA)", "p2.freedns.controld.com"),
+    ("cleanbrowsing", "CleanBrowsing (US)", "security-filter-dns.cleanbrowsing.org"),
+    ("cznic", "CZ.NIC (CZ)", "odvr.nic.cz"),
+    ("cloudflare", "Cloudflare (US)", "security.cloudflare-dns.com"),
+    ("dnszero", "DNS0 (FR)", "zero.dns0.eu"),
+    ("dnssb", "DNS.SB (DE)", "dot.sb"),
+    ("google", "Google (US)", "dns.google"),
+    ("mullvad", "Mullvad (SE)", "base.dns.mullvad.net"),
+    ("quadnine", "Quad9 (CH)", "dns.quad9.net"),
+    ("restena", "Restena (LU)", "kaitain.restena.lu"),
+    ("switch", "SWITCH (CH)", "dns.switch.ch"),
+    ("uncensoreddns", "UncensoredDNS (DK)", "anycast.censurfridns.dk"),
+]
+
+
+def patch_layout(path: pathlib.Path) -> bool:
+    text = path.read_text(encoding="utf-8")
+    if MARKER in text:
+        return False
+    # Insert provider radios after off, before opportunistic (keep provider+hostname)
+    includes = []
+    for key, _, _ in PROVIDERS:
+        includes.append(
+            f'            <!-- {MARKER} -->\n'
+            f'            <include\n'
+            f'                android:id="@+id/private_dns_mode_{key}"\n'
+            f'                layout="@layout/preference_widget_dialog_radiobutton"/>\n'
+        )
+    block = "".join(includes)
+    # Remove ALL existing cloudflare includes (re-added once via PROVIDERS)
+    text2 = re.sub(
+        r'\s*(?:<!--.*?-->\s*)?<include\s*\n\s*android:id="@\+id/private_dns_mode_cloudflare"\s*\n\s*layout="@layout/preference_widget_dialog_radiobutton"/>\s*',
+        "\n",
+        text,
+        flags=re.DOTALL,
+    )
+    text2 = re.sub(
+        r'\s*<include\s+android:id="@\+id/private_dns_mode_cloudflare"[^/]*/>\s*',
+        "\n",
+        text2,
+    )
+    needle = (
+        '            <include\n'
+        '                android:id="@+id/private_dns_mode_opportunistic"\n'
+        '                layout="@layout/preference_widget_dialog_radiobutton"/>'
+    )
+    if needle not in text2:
+        # alternate formatting
+        needle = 'android:id="@+id/private_dns_mode_opportunistic"'
+        idx = text2.find(needle)
+        if idx < 0:
+            raise SystemExit(f"FAIL: opportunistic radio not in {path}")
+        # find start of include element
+        start = text2.rfind("<include", 0, idx)
+        text2 = text2[:start] + block + text2[start:]
+    else:
+        text2 = text2.replace(needle, block + needle, 1)
+    path.write_text(text2, encoding="utf-8")
+    return True
+
+
+def patch_cm_strings(path: pathlib.Path) -> bool:
+    text = path.read_text(encoding="utf-8")
+    if MARKER in text and "private_dns_hostname_quadnine" in text:
+        return False
+    # Replace/extend cloudflare hostname to GOLDEN security.cloudflare-dns.com
+    text = re.sub(
+        r'<string name="private_dns_hostname_cloudflare"[^>]*>.*?</string>',
+        '<string name="private_dns_hostname_cloudflare" translatable="false">'
+        "security.cloudflare-dns.com</string>",
+        text,
+        count=1,
+    )
+    text = re.sub(
+        r'<string name="private_dns_mode_cloudflare"[^>]*>.*?</string>',
+        '<string name="private_dns_mode_cloudflare" translatable="false">'
+        "Cloudflare (US)</string>",
+        text,
+        count=1,
+    )
+    lines = [f"    <!-- {MARKER}: AXP GOLDEN Private DNS presets -->"]
+    for key, label, host in PROVIDERS:
+        if key == "cloudflare":
+            continue  # already present
+        lines.append(
+            f'    <string name="private_dns_mode_{key}" translatable="false">{label}</string>'
+        )
+        lines.append(
+            f'    <string name="private_dns_hostname_{key}" translatable="false">{host}</string>'
+        )
+    insert = "\n".join(lines) + "\n"
+    if "</resources>" not in text:
+        raise SystemExit(f"FAIL: no </resources> in {path}")
+    text = text.replace("</resources>", insert + "</resources>", 1)
+    path.write_text(text, encoding="utf-8")
+    return True
+
+
+def write_preference_java(path: pathlib.Path) -> None:
+    """Rewrite PrivateDnsModeDialogPreference with data-driven GOLDEN presets."""
+    # Keep copyright / package; replace body after class declaration via full file.
+    providers_java = ",\n".join(
+        f'            new Provider("{key}", R.id.private_dns_mode_{key}, '
+        f"R.string.private_dns_mode_{key}, R.string.private_dns_hostname_{key})"
+        for key, _, _ in PROVIDERS
+    )
+    # Assign custom mode ints starting at 4 (LOS cloudflare used 4)
+    mode_consts = "\n".join(
+        f"    private static final int PRIVATE_DNS_MODE_{key.upper()} = {4 + i};"
+        for i, (key, _, _) in enumerate(PROVIDERS)
+    )
+    map_puts = "\n".join(
+        f"        PRIVATE_DNS_MAP.put(PRIVATE_DNS_MODE_{key.upper()}, "
+        f"R.id.private_dns_mode_{key});"
+        for key, _, _ in PROVIDERS
+    )
+    content = f'''/*
+ * Copyright (C) 2017 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.android.settings.network;
+
+import static android.net.ConnectivitySettingsManager.PRIVATE_DNS_MODE_OFF;
+import static android.net.ConnectivitySettingsManager.PRIVATE_DNS_MODE_OPPORTUNISTIC;
+import static android.net.ConnectivitySettingsManager.PRIVATE_DNS_MODE_PROVIDER_HOSTNAME;
+
+import static com.android.settingslib.RestrictedLockUtils.EnforcedAdmin;
+
+import android.app.Dialog;
+import android.app.settings.SettingsEnums;
+import android.content.ActivityNotFoundException;
+import android.content.Context;
+import android.content.DialogInterface;
+import android.content.Intent;
+import android.net.ConnectivitySettingsManager;
+import android.os.UserHandle;
+import android.os.UserManager;
+import android.text.Editable;
+import android.text.TextWatcher;
+import android.text.method.LinkMovementMethod;
+import android.util.AttributeSet;
+import android.util.Log;
+import android.view.View;
+import android.widget.Button;
+import android.widget.EditText;
+import android.widget.RadioButton;
+import android.widget.RadioGroup;
+import android.widget.TextView;
+
+import androidx.annotation.VisibleForTesting;
+import androidx.appcompat.app.AlertDialog;
+import androidx.preference.PreferenceViewHolder;
+
+import com.android.settings.R;
+import com.android.settings.overlay.FeatureFactory;
+import com.android.settings.utils.AnnotationSpan;
+import com.android.settingslib.CustomDialogPreferenceCompat;
+import com.android.settingslib.HelpUtils;
+import com.android.settingslib.RestrictedLockUtils;
+import com.android.settingslib.RestrictedLockUtilsInternal;
+
+import com.google.android.material.textfield.TextInputLayout;
+import com.google.common.net.InternetDomainName;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Dialog to set the Private DNS.
+ * {MARKER}: AXP GOLDEN provider presets (hostnames from GOLDEN Settings.apk).
+ */
+public class PrivateDnsModeDialogPreference extends CustomDialogPreferenceCompat implements
+        RadioGroup.OnCheckedChangeListener, TextWatcher {{
+
+    public static final String ANNOTATION_URL = "url";
+
+    private static final String TAG = "PrivateDnsModeDialog";
+    private static final Map<Integer, Integer> PRIVATE_DNS_MAP;
+
+{mode_consts}
+
+    private static final Provider[] PROVIDERS = new Provider[] {{
+{providers_java}
+    }};
+
+    static {{
+        PRIVATE_DNS_MAP = new HashMap<>();
+        PRIVATE_DNS_MAP.put(PRIVATE_DNS_MODE_OFF, R.id.private_dns_mode_off);
+        PRIVATE_DNS_MAP.put(PRIVATE_DNS_MODE_OPPORTUNISTIC, R.id.private_dns_mode_opportunistic);
+        PRIVATE_DNS_MAP.put(PRIVATE_DNS_MODE_PROVIDER_HOSTNAME, R.id.private_dns_mode_provider);
+{map_puts}
+    }}
+
+    private static final class Provider {{
+        final String key;
+        final int radioId;
+        final int labelRes;
+        final int hostnameRes;
+
+        Provider(String key, int radioId, int labelRes, int hostnameRes) {{
+            this.key = key;
+            this.radioId = radioId;
+            this.labelRes = labelRes;
+            this.hostnameRes = hostnameRes;
+        }}
+    }}
+
+    @VisibleForTesting
+    TextInputLayout mHostnameLayout;
+    @VisibleForTesting
+    EditText mHostnameText;
+    @VisibleForTesting
+    RadioGroup mRadioGroup;
+    @VisibleForTesting
+    int mMode;
+
+    public PrivateDnsModeDialogPreference(Context context) {{
+        super(context);
+    }}
+
+    public PrivateDnsModeDialogPreference(Context context, AttributeSet attrs) {{
+        super(context, attrs);
+    }}
+
+    public PrivateDnsModeDialogPreference(Context context, AttributeSet attrs, int defStyleAttr) {{
+        super(context, attrs, defStyleAttr);
+    }}
+
+    public PrivateDnsModeDialogPreference(Context context, AttributeSet attrs, int defStyleAttr,
+            int defStyleRes) {{
+        super(context, attrs, defStyleAttr, defStyleRes);
+    }}
+
+    private final AnnotationSpan.LinkInfo mUrlLinkInfo = new AnnotationSpan.LinkInfo(
+            ANNOTATION_URL, (widget) -> {{
+        final Context context = widget.getContext();
+        final Intent intent = HelpUtils.getHelpIntent(context,
+                context.getString(R.string.help_uri_private_dns),
+                context.getClass().getName());
+        if (intent != null) {{
+            try {{
+                widget.startActivityForResult(intent, 0);
+            }} catch (ActivityNotFoundException e) {{
+                Log.w(TAG, "Activity was not found for intent, " + intent.toString());
+            }}
+        }}
+    }});
+
+    private static int modeForRadioId(int radioId) {{
+        if (radioId == R.id.private_dns_mode_off) return PRIVATE_DNS_MODE_OFF;
+        if (radioId == R.id.private_dns_mode_opportunistic) return PRIVATE_DNS_MODE_OPPORTUNISTIC;
+        if (radioId == R.id.private_dns_mode_provider) return PRIVATE_DNS_MODE_PROVIDER_HOSTNAME;
+        for (int i = 0; i < PROVIDERS.length; i++) {{
+            if (PROVIDERS[i].radioId == radioId) {{
+                return 4 + i;
+            }}
+        }}
+        return PRIVATE_DNS_MODE_OPPORTUNISTIC;
+    }}
+
+    private static Provider providerForMode(int mode) {{
+        int idx = mode - 4;
+        if (idx >= 0 && idx < PROVIDERS.length) {{
+            return PROVIDERS[idx];
+        }}
+        return null;
+    }}
+
+    @Override
+    public void onBindViewHolder(PreferenceViewHolder holder) {{
+        super.onBindViewHolder(holder);
+        if (isDisabledByAdmin()) {{
+            holder.itemView.setEnabled(true);
+        }}
+        setSaveButtonListener();
+    }}
+
+    @Override
+    protected void onBindDialogView(View view) {{
+        final Context context = getContext();
+        mMode = ConnectivitySettingsManager.getPrivateDnsMode(context);
+        if (mMode == PRIVATE_DNS_MODE_PROVIDER_HOSTNAME) {{
+            final String host = ConnectivitySettingsManager.getPrivateDnsHostname(context);
+            for (int i = 0; i < PROVIDERS.length; i++) {{
+                if (host != null && host.equals(context.getString(PROVIDERS[i].hostnameRes))) {{
+                    mMode = 4 + i;
+                    break;
+                }}
+            }}
+        }}
+        mRadioGroup = view.findViewById(R.id.private_dns_radio_group);
+        mRadioGroup.check(PRIVATE_DNS_MAP.getOrDefault(mMode, R.id.private_dns_mode_opportunistic));
+        mRadioGroup.setOnCheckedChangeListener(this);
+
+        final RadioButton offRadioButton = view.findViewById(R.id.private_dns_mode_off);
+        offRadioButton.setText(com.android.settingslib.R.string.private_dns_mode_off);
+        for (Provider p : PROVIDERS) {{
+            final RadioButton rb = view.findViewById(p.radioId);
+            if (rb != null) {{
+                rb.setText(p.labelRes);
+            }}
+        }}
+        final RadioButton opportunisticRadioButton =
+                view.findViewById(R.id.private_dns_mode_opportunistic);
+        opportunisticRadioButton.setText(
+                com.android.settingslib.R.string.private_dns_mode_opportunistic);
+        final RadioButton providerRadioButton = view.findViewById(R.id.private_dns_mode_provider);
+        providerRadioButton.setText(com.android.settingslib.R.string.private_dns_mode_provider);
+
+        mHostnameLayout = view.findViewById(R.id.private_dns_mode_provider_hostname_layout);
+        mHostnameText = view.findViewById(R.id.private_dns_mode_provider_hostname);
+        if (mHostnameText != null) {{
+            mHostnameText.setText(ConnectivitySettingsManager.getPrivateDnsHostname(context));
+            mHostnameText.addTextChangedListener(this);
+        }}
+
+        final TextView helpTextView = view.findViewById(R.id.private_dns_help_info);
+        helpTextView.setMovementMethod(LinkMovementMethod.getInstance());
+        final Intent helpIntent = HelpUtils.getHelpIntent(context,
+                context.getString(R.string.help_uri_private_dns),
+                context.getClass().getName());
+        final AnnotationSpan.LinkInfo linkInfo = new AnnotationSpan.LinkInfo(context,
+                ANNOTATION_URL, helpIntent);
+        if (linkInfo.isActionable()) {{
+            helpTextView.setText(AnnotationSpan.linkify(
+                    context.getText(R.string.private_dns_help_message), linkInfo));
+        }} else {{
+            helpTextView.setText("");
+        }}
+
+        updateDialogInfo();
+    }}
+
+    @Override
+    public void onCheckedChanged(RadioGroup group, int checkedId) {{
+        mMode = modeForRadioId(checkedId);
+        updateDialogInfo();
+    }}
+
+    @Override
+    public void beforeTextChanged(CharSequence s, int start, int count, int after) {{
+    }}
+
+    @Override
+    public void onTextChanged(CharSequence s, int start, int before, int count) {{
+    }}
+
+    @Override
+    public void afterTextChanged(Editable s) {{
+        updateDialogInfo();
+    }}
+
+    @Override
+    public void performClick() {{
+        EnforcedAdmin enforcedAdmin = getEnforcedAdmin();
+        if (enforcedAdmin == null) {{
+            super.performClick();
+        }} else {{
+            RestrictedLockUtils.sendShowAdminSupportDetailsIntent(getContext(), enforcedAdmin);
+        }}
+    }}
+
+    private EnforcedAdmin getEnforcedAdmin() {{
+        return RestrictedLockUtilsInternal.checkIfRestrictionEnforced(
+                getContext(), UserManager.DISALLOW_CONFIG_PRIVATE_DNS, UserHandle.myUserId());
+    }}
+
+    private boolean isDisabledByAdmin() {{
+        return getEnforcedAdmin() != null;
+    }}
+
+    private void updateDialogInfo() {{
+        final boolean modeProvider = PRIVATE_DNS_MODE_PROVIDER_HOSTNAME == mMode;
+        if (mHostnameLayout != null) {{
+            mHostnameLayout.setEnabled(modeProvider);
+            mHostnameLayout.setErrorEnabled(false);
+        }}
+    }}
+
+    private void setSaveButtonListener() {{
+        View.OnClickListener onClickListener = v -> doSaveButton();
+        DialogInterface.OnShowListener onShowListener = dialog -> {{
+            if (dialog == null) {{
+                Log.e(TAG, "The DialogInterface is null!");
+                return;
+            }}
+            Button saveButton = ((AlertDialog) dialog).getButton(DialogInterface.BUTTON_POSITIVE);
+            if (saveButton == null) {{
+                Log.e(TAG, "Can't get the save button!");
+                return;
+            }}
+            saveButton.setOnClickListener(onClickListener);
+        }};
+        setOnShowListener(onShowListener);
+    }}
+
+    @VisibleForTesting
+    void doSaveButton() {{
+        Context context = getContext();
+        int modeToSet = mMode;
+        Provider preset = providerForMode(mMode);
+        if (preset != null) {{
+            ConnectivitySettingsManager.setPrivateDnsHostname(context,
+                    context.getString(preset.hostnameRes));
+            modeToSet = PRIVATE_DNS_MODE_PROVIDER_HOSTNAME;
+        }} else if (mMode == PRIVATE_DNS_MODE_PROVIDER_HOSTNAME) {{
+            if (mHostnameLayout == null || mHostnameText == null) {{
+                Log.e(TAG, "Can't find hostname resources!");
+                return;
+            }}
+            if (mHostnameText.getText().isEmpty()) {{
+                mHostnameLayout.setError(context.getString(R.string.private_dns_field_require));
+                Log.w(TAG, "The hostname is empty!");
+                return;
+            }}
+            if (!InternetDomainName.isValid(mHostnameText.getText().toString())) {{
+                mHostnameLayout.setError(context.getString(R.string.private_dns_hostname_invalid));
+                Log.w(TAG, "The hostname is invalid!");
+                return;
+            }}
+            ConnectivitySettingsManager.setPrivateDnsHostname(context,
+                    mHostnameText.getText().toString());
+        }}
+
+        ConnectivitySettingsManager.setPrivateDnsMode(context, modeToSet);
+        FeatureFactory.getFeatureFactory().getMetricsFeatureProvider()
+                .action(context, SettingsEnums.ACTION_PRIVATE_DNS_MODE, modeToSet);
+        Dialog dialog = getDialog();
+        if (dialog != null) {{
+            dialog.dismiss();
+        }}
+    }}
+}}
+'''
+    # Fix f-string doubled braces - we used {{ for literal braces in the template
+    # But MARKER was intended as comment - replace
+    content = content.replace("{MARKER}", MARKER)
+    path.write_text(content, encoding="utf-8")
+
+
+def main() -> int:
+    root = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else ".")
+    layout = root / "packages/apps/Settings/res/layout/private_dns_mode_dialog.xml"
+    cm = root / "packages/apps/Settings/res/values/cm_strings.xml"
+    java = root / (
+        "packages/apps/Settings/src/com/android/settings/network/"
+        "PrivateDnsModeDialogPreference.java"
+    )
+    for p in (layout, cm, java):
+        if not p.is_file():
+            print(f"FAIL: missing {p}", file=sys.stderr)
+            return 1
+
+    if MARKER in java.read_text(encoding="utf-8") and "quadnine" in layout.read_text(
+        encoding="utf-8"
+    ):
+        print("OK: private DNS already applied")
+        return 0
+
+    patch_layout(layout)
+    patch_cm_strings(cm)
+    write_preference_java(java)
+    print(f"OK: private DNS providers applied ({len(PROVIDERS)} presets)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,41 @@
+# Apply early TARGET_UNOFFICIAL_BUILD_ID to device product makefile.
+# Must run before breakfast: inherit-product of vendor/lineage parses version.mk
+# immediately; vendor/extra inherit-product is too late.
+#
+# Usage (on rom-dev01 tree):
+#   python3 vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_unofficial_build_id.py
+
+from __future__ import annotations
+
+from pathlib import Path
+import os
+import sys
+
+MARKER = "TARGET_UNOFFICIAL_BUILD_ID := AXP-Resurection-Pro"
+NEEDLE = "# Inherit some common Lineage stuff.\n"
+INSERT = (
+    "# sunfish-a16: must precede vendor/lineage version.mk (via inherit below)\n"
+    f"{MARKER}\n\n"
+)
+
+
+def main() -> int:
+    top = Path(os.environ.get("ANDROID_BUILD_TOP", ".")).resolve()
+    mk = top / "device/google/sunfish/lineage_sunfish.mk"
+    if not mk.is_file():
+        print(f"FAIL: missing {mk}", file=sys.stderr)
+        return 1
+    text = mk.read_text()
+    if MARKER in text:
+        print(f"OK: already applied ({mk})")
+        return 0
+    if NEEDLE not in text:
+        print(f"FAIL: needle not found in {mk}", file=sys.stderr)
+        return 1
+    mk.write_text(text.replace(NEEDLE, INSERT + NEEDLE, 1))
+    print(f"OK: patched {mk}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,67 @@
+# US-S4-1 — drop Lineage product OpenSSH binaries / rsync / procmem
+
+**Track**: AXP Resurection Pro (Magisk), unlocked sunfish.  
+**Not**: slim variant; not bootloader lock; not Yama (kernel).
+
+## AXP reference (mandatory)
+
+Oracle: `AXP.OS-22.2-20260324-PRO-sunfish.zip` → `payload.bin` → `product.img`
+(+ GOLDEN `ro.lineage.version=22.2-2026.003-sunfish-pro`, Android 15):
+
+| Path | AXP PRO (A15) |
+|------|----------------|
+| `/bin/sshd`, `ssh`, `scp`, `sftp`, `ssh-keygen`, `start-ssh` | **absent** |
+| `/bin/rsync`, `/bin/procmem` | **absent** |
+| `/etc/init/init.openssh.rc` | **present** (`mkdir /data/ssh*`) |
+
+### Was this an A16 Lineage add?
+
+**No.** Lineage `vendor/lineage/config/common.mk` has shipped the Openssh
+block since 2012; lineage-20 / 21 / 22.2 all still include it. AXP PRO on
+A15 therefore **actively omitted** the binaries (same lineage generation
+still lists them upstream). Public `AXP.OS/android_vendor_lineage`
+`upstream_*` mirrors keep the Lineage Openssh block — use the **PRO zip /
+GOLDEN**, not that mirror, as product oracle.
+
+## What we ship
+
+Match AXP PRO product surface by stripping Lineage `common.mk` package
+adds (see `apply_009_drop_openssh_packages.py`) — a plain
+`PRODUCT_PACKAGES := $(filter-out …)` inherit did **not** drop `sshd` from
+ship `20261002T125259Z`:
+
+- Remove packages: `scp`, `sftp`, `ssh`, `sshd`, `sshd_config`, `ssh-keygen`,
+  `start-ssh`, `rsync`, `procmem` (debug)
+- **Keep** `init.openssh.rc` copy (AXP has it)
+
+Remote shell / file transfer on this track remains **adb** (+ Magisk); the
+rc only creates `/data/ssh*` and does not start `sshd` without the binary.
+
+## Verify (LAB after flash)
+
+```text
+adb shell ls /product/bin/sshd                    # expect: No such file
+adb shell ls /product/bin/rsync                   # expect: No such file
+adb shell ls /product/etc/init/init.openssh.rc    # expect: present (AXP)
+adb shell pidof magiskd                           # expect: non-empty
+```
+
+## US-S4-2 — drop Jelly + Gallery2 (AXP PRO product)
+
+**Oracle**: same PRO zip — `product/app` has **no** Jelly / Gallery2;
+`system_ext` ships Fossify + `noDefaultBrowserWebView`. Inventory:
+`docs/009-axp-pro-product-apps-20260324.md`.
+
+- `apply_009_drop_jelly_gallery2.py` — remove Lineage `PRODUCT_PACKAGES`
+  adds for Jelly / Gallery2
+- `NoLineageJelly` uninstallable override module (AXP stub class)
+- Keep `FossifyGallery` (already overrides Gallery/Gallery2/Glimpse)
+
+LAB after flash: no `/product/app/Jelly`, no `/product/app/Gallery2`,
+FossifyGallery present.
+
+## Out of scope
+
+- `CONFIG_SECURITY_YAMA` (kernel / US-S5 — **done** on `162840Z`)
+- Switching lunch to `user` (US-S6)
+- NeoLauncher / Aosmium (wont / exception)
@@ -0,0 +1,89 @@
+# 009 signing / AVB (userspace Gate G)
+
+Clone AXP/GOLDEN posture: **`user` + `release-keys`**, device **unlocked**
+(`orange`). Not IOdes locked-bootloader.
+
+Full checklist: `docs/009-hardening-signing-checklist.md`.
+
+## Stages
+
+| Stage | What |
+|-------|------|
+| US-S1 | Generate keys → `/srv/rom/secrets/android-certs/` |
+| US-S2 | Wire `PRODUCT_DEFAULT_DEV_CERTIFICATE` into bacon |
+| US-S3 | Project AVB key (`AVB_CUSTOM_KEY_PATH`); decide `WITH_AVB` |
+| US-S4+ | Userspace harden / CVE — separate patches |
+
+## Generate (rom-dev01 only)
+
+```bash
+# from synced repo copy or laptop scp of scripts/
+sudo -u android-build bash /srv/rom/src/lineage/vendor/sunfish-a16/../../../../\
+  # prefer:
+bash /path/to/AXP_Resurection/scripts/009-generate-release-keys.sh
+```
+
+Script writes under `/srv/rom/secrets/android-certs/` when that parent is
+writable, otherwise `$HOME/.android-certs` (Lineage default). On rom-dev01
+(2026-09-29) secrets/ is root-owned without group write → keys live in
+`/home/android-build/.android-certs/`. Refuses overwrite. Reminds about
+encrypted offline backup before first signed ship bacon.
+
+## Wire (US-S2 — after keys exist)
+
+In the bacon environment (not committed secrets):
+
+```bash
+export PRODUCT_DEFAULT_DEV_CERTIFICATE=$HOME/.android-certs/releasekey
+# after root relocate: /srv/rom/secrets/android-certs/releasekey
+# lunch lineage_sunfish-userdebug   # first signed build
+# later: lineage_sunfish-user
+```
+
+`009-bacon-axp-stage1-combo4.sh` auto-exports when `$HOME/.android-certs/releasekey.pk8` exists.
+## AVB (US-S3)
+
+Default tree falls back to AOSP `external/avb/test/data/testkey_rsa2048.pem`
+(and LAB has been observed with `testkey_rsa4096`) plus
+`BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flags 3` unless `WITH_AVB=true`
+(`device/google/sunfish/BoardConfigLineage.mk`).
+
+Project key generation is in `009-generate-release-keys.sh`
+(`avb.pem` + `avb_pkmd.bin`). **Wire in tree** (soong-safe path), not only env:
+
+`vendor/sunfish-a16/BoardConfig.mk` sets `BOARD_AVB_KEY_PATH` /
+`BOARD_AVB_ALGORITHM=SHA256_RSA4096` when `certs/avb.pem` exists. Keep
+`WITH_AVB` unset → vbmeta **flags 3** =
+`HASHTREE_DISABLED|VERIFICATION_DISABLED` (libavb) → Magisk preroot on
+unlocked/orange. That is **signing infrastructure**, not runtime AVB harden.
+
+Validate after bacon (script fail-closed) on **target_files `IMAGES/`** (the
+OTA pair). Do not use `out/target/product/$DEVICE/{boot,vbmeta}.img` alone —
+those make images can be stock and disagree with the Magisk payload in the zip.
+Gates: pubkey sha1 == `avb_pkmd.bin` (not AOSP testkey); flags 3;
+`verify_image --key` + `--expected_chain_partition vbmeta_system:1:avb_pkmd.bin`;
+`magiskboot cpio test` ≠ 0; LAB stays `flash.locked=0` + Magisk works.
+
+**OEM unlocking:** leave enabled as a best-effort escape hatch (not a recovery
+guarantee). Do not relock the bootloader on this Magisk track.
+
+## Branding
+
+`TARGET_UNOFFICIAL_BUILD_ID=AXP-Resurection-Pro` is set at the **top** of
+`device/google/sunfish/lineage_sunfish.mk` (before inheriting
+`vendor/lineage` → `version.mk`). Helper:
+`apply_009_unofficial_build_id.py`. **Pro** = full Magisk resurrection track
+(not a future slim/minimal variant). Mirrors GOLDEN’s `…-sunfish-pro` /
+releasetype `PRO` intent without patching `vendor/lineage/config/version.mk`.
+
+`branding.mk` adds `ro.axp.resurection.track=pro`. Ship scripts also publish
+`AXP-Resurection-Pro-<ver>-<date>-sunfish.zip` as a hardlink/copy of the
+Lineage `bacon` zip (no rebuild solely to rename).
+
+
+## Never
+
+- Commit `*.pk8`, private `*.pem`, or pass files.
+- Relock LAB/GOLDEN as a project requirement (OEM unlock-always-on does not
+  make Magisk+relock safe).
+- Flash old `kh-cve` / `kh-full` zips from 2026-09-18.
@@ -0,0 +1,22 @@
+# Stage1 build fixes (FR-017)
+
+> **2026-09-26 audit:** The FORTIFY BUG stubs below are a historical link
+> workaround, **not an accepted fix**. The latest ksync FORTIFY image fails
+> boot according to the owner. Clang exclusion in Kconfig references an
+> undefined CC_IS_CLANG symbol. See
+> [the FORTIFY audit](../../../../docs/009-fortify-boot-audit-20260926.md)
+> before reusing this workaround.
+
+Applied on host `msm-4.14` when Stage1 Graphene/AH hit compile/link issues:
+
+1. **slab 0014 misfuzz** — Graphene patch targeted `slab_equal_or_root`;
+   fuzz applied to `is_root_cache`. Reverted `is_root_cache` to `return true`.
+   LOS already has `slab_equal_or_root` → `s == p`.
+2. **FORTIFY + Clang LTO (historical, invalid as ship fix)** —
+   `CONFIG_FORTIFY_SOURCE=y` caused modpost undefined `__read_overflow*` /
+   `__write_overflow` in qcacld/techpack. Temporary `BUG()` stubs were
+   added in `lib/string.c` to force a link; LAB then failed to boot.
+   **Do not reuse.** Real work: Clang FORTIFY port — see
+   `docs/009-fortify-clang-port.md` and `docs/009-fortify-boot-audit-20260926.md`.
+
+See `docs/009-kernel-hardening-map.md`.
@@ -0,0 +1,83 @@
+# 009 kernel hardening Stage 1 (FR-017)
+
+**Source**: AXP `kernel_patches` @ `df3cab2155b3` (GrapheneOS / AndroidHardening
+series in Divest-era layout).  
+**Base**: LOS `kernel/google/msm-4.14` @ `28f9290ae067` (`4.14.357-openela`).  
+**Map**: `docs/009-kernel-hardening-map.md`.
+
+## Files
+
+| File | Role |
+|------|------|
+| `stage1.list` | Ordered allowlist (30 patches) |
+| `apply_stage1.sh` | Applies list onto a kernel tree |
+
+## Host usage (`rom-dev01`)
+
+```bash
+# dry-run
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
+  /srv/rom/src/lineage/kernel/google/msm-4.14 --dry-run
+
+# apply (dirties the lineage kernel checkout)
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
+  /srv/rom/src/lineage/kernel/google/msm-4.14
+```
+
+Optional: `AXP_KERNEL_PATCHES=/path/to/kernel_patches`.
+
+After apply, flip `sunfish_defconfig` options that the new Kconfig allows
+(at least `CONFIG_FORTIFY_SOURCE=y`); see map `KH-CFG`.
+
+## Boot-OK pack (2026-09-28 LAB) — prefer for Magisk bacon
+
+Stage1 Graphene alone historically hung at the Google logo on LOS23/Clang.
+The pack that boots with Magisk-track `boot-make` is **combo4 + Clang FORTIFY**
+(no Stage1 mega-pack):
+
+```bash
+# on a reset msm-4.14 @ 28f9290ae067:
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh \
+  /path/to/msm-4.14
+```
+
+That applies `fortify-clang/` (incl. nested `__underlying_strlen` fix) +
+driver bounds + defconfig:
+`FORTIFY_SOURCE`, `INIT_ON_*`, `SECURITY_DMESG_RESTRICT`,
+`SLAB_FREELIST_HARDENED`. Bacon entrypoint:
+`scripts/009-bacon-axp-combo4-fortify.sh`.
+
+## Stage1 + combo4 (full bacon, Wi‑Fi coherent)
+
+```bash
+# reset msm-4.14 @ 28f9290ae067, then:
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1_combo4.sh \
+  /path/to/msm-4.14
+# bacon: scripts/009-bacon-axp-stage1-combo4.sh
+```
+
+Order: Stage1 (30) → slab BUILD-FIXES if needed → combo4+FORTIFY.
+Ship via **sideload of the zip** (matching vendor/`wlan.ko`). Do not flash
+only the new boot onto an old slot.
+
+**LAB accepted 2026-09-29:** see `docs/009-gate-g-kernel-attribution.md`.
+
+## GPS / location (FR-018 — do not regress)
+
+Owner wants **precise, fast GPS** (stock LOS behaviour). **Never** apply AXP
+location lockdown, SUPL/IMSI stripping that hurts TTFF, or extra location
+caps vs LOS 23.2. Stage1 list, `cve-strict.list`, and denylist must stay
+free of location-lockdown series (`KH-LOC` = skip). If a future CVE hunk
+touches GNSS/GPS paths only for a real security fix, keep LOS-equivalent
+behaviour and document; do not “harden location” as a side goal.
+
+## Not in Stage 1 alone
+
+- CVE mega — now staged via `apply_stage1_combo4_cve.sh` + `cve-strict.list`
+  (~503 AXP allowlist from 2026-09-18 strict pass; `cve-denylist.txt` skipped).
+  Bacon: `scripts/009-bacon-axp-stage1-combo4-cve.sh` (test-keys; after
+  boot-OK Stage1 pack). **Do not** flash `20260918*-axp-kh-cve/full`.
+- LinuxIncrementals
+- Failed probe patches (port later)
+- Location lockdown (FR-018)
+- Iodé kernel (no sunfish 4.14 fork found)
@@ -0,0 +1,51 @@
+#!/bin/bash
+# Apply the LAB-verified combo4 + Clang FORTIFY pack onto a clean msm-4.14 tree.
+#
+# Boot-OK on sunfish LAB 2026-09-28 (ksync combo4-fortify-fix). This is NOT
+# the full Graphene Stage1 pack (Stage1 alone historically hung at Google logo).
+#
+# Usage: apply_combo4_fortify.sh <kernel-tree>
+# Expects a virgin / reset tree (apply_fortify_clang.py is not idempotent).
+set -e
+
+K=${1:?kernel tree}
+HERE=$(cd "$(dirname "$0")" && pwd)
+FC="$HERE/fortify-clang"
+
+test -d "$K/include/linux"
+test -f "$FC/apply_fortify_clang.py"
+test -f "$FC/0001-driver-bounds-rtac-fils.patch"
+
+python3 "$FC/apply_fortify_clang.py" "$K"
+patch -p1 --forward --batch -d "$K" < "$FC/0001-driver-bounds-rtac-fils.patch"
+
+DEF="$K/arch/arm64/configs/sunfish_defconfig"
+test -f "$DEF"
+
+# Drop any prior toggles we manage, then enable the boot-OK set.
+for k in \
+  FORTIFY_SOURCE \
+  INIT_ON_ALLOC_DEFAULT_ON \
+  INIT_ON_FREE_DEFAULT_ON \
+  SECURITY_DMESG_RESTRICT \
+  SLAB_FREELIST_HARDENED \
+  SLAB_HARDENED
+do
+  sed -i "/CONFIG_${k}/d" "$DEF"
+done
+
+# Keep KernelSU off on this Magisk track.
+sed -i '/CONFIG_KSU/d' "$DEF"
+echo '# CONFIG_KSU is not set' >> "$DEF"
+
+for k in \
+  CONFIG_FORTIFY_SOURCE \
+  CONFIG_INIT_ON_ALLOC_DEFAULT_ON \
+  CONFIG_INIT_ON_FREE_DEFAULT_ON \
+  CONFIG_SECURITY_DMESG_RESTRICT \
+  CONFIG_SLAB_FREELIST_HARDENED
+do
+  echo "${k}=y" >> "$DEF"
+done
+
+echo "OK: combo4+FORTIFY applied on $K"
@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# Apply AXP CVE allowlist onto msm-4.14 (after Stage1+combo4).
+# Source: AXP kernel_patches + cve_checker strict list / bisect slices.
+#
+# Safety (2026-09-29 review):
+# - Default: ABORT on first patch failure (no continue-with-partial-tree).
+# - Keep *.rej / *.orig under CVE_REJECT_DIR (do not silently delete).
+# - Treat large line-offsets / fuzz as WARN or FAIL (mis-apply risk).
+# - Set CVE_STRICT_CONTINUE=1 only for forensic runs (explicit).
+set -euo pipefail
+
+KP="${AXP_KERNEL_PATCHES:-/srv/rom/references/axp/kernel_patches}"
+KERNEL_DIR="${1:-/srv/rom/src/lineage/kernel/google/msm-4.14}"
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LIST="${CVE_STRICT_LIST:-$HERE/cve-strict.list}"
+DENY="${CVE_DENYLIST:-$HERE/cve-denylist.txt}"
+LOG_DIR="${CVE_APPLY_LOG_DIR:-/srv/rom/artifacts/009-axp-los23-port/cve-stage}"
+CONTINUE="${CVE_STRICT_CONTINUE:-0}"
+# Reject apply if GNU patch reports fuzz >= this (0 = disable fuzz fail)
+MAX_FUZZ="${CVE_MAX_FUZZ:-1}"
+# Reject if any hunk offset abs(lines) >= this (0 = disable)
+MAX_ABS_OFFSET="${CVE_MAX_ABS_OFFSET:-200}"
+DRY_RUN=0
+[[ "${2:-}" == "--dry-run" ]] && DRY_RUN=1
+
+if [[ ! -d "$KERNEL_DIR/include/linux" ]]; then
+  echo "error: kernel dir missing: $KERNEL_DIR" >&2
+  exit 1
+fi
+if [[ ! -d "$KP" ]]; then
+  echo "error: AXP kernel_patches missing: $KP" >&2
+  exit 1
+fi
+if [[ ! -f "$LIST" ]]; then
+  echo "error: list missing: $LIST" >&2
+  exit 1
+fi
+
+mkdir -p "$LOG_DIR"
+STAMP=$(date -u +%Y%m%dT%H%M%SZ)
+LOG="$LOG_DIR/apply-cve-strict-${STAMP}.log"
+FAIL_LIST="$LOG_DIR/apply-cve-strict-${STAMP}.fail.txt"
+REJECT_DIR="${CVE_REJECT_DIR:-$LOG_DIR/rejects-${STAMP}}"
+mkdir -p "$REJECT_DIR"
+: >"$FAIL_LIST"
+
+declare -A DENY_MAP=()
+if [[ -f "$DENY" ]]; then
+  while IFS= read -r d || [[ -n "$d" ]]; do
+    [[ -z "$d" || "$d" =~ ^# ]] && continue
+    if [[ "$d" == *"/kernel_patches/"* ]]; then
+      DENY_MAP["${d##*/kernel_patches/}"]=1
+    else
+      DENY_MAP["$d"]=1
+    fi
+  done <"$DENY"
+fi
+
+ok=0
+fail=0
+skip=0
+miss=0
+quality_fail=0
+
+echo "=== CVE strict apply kernel=$KERNEL_DIR dry_run=$DRY_RUN continue=$CONTINUE max_fuzz=$MAX_FUZZ max_abs_offset=$MAX_ABS_OFFSET ===" | tee "$LOG"
+
+while IFS= read -r rel || [[ -n "$rel" ]]; do
+  [[ -z "$rel" || "$rel" =~ ^# ]] && continue
+  if [[ -n "${DENY_MAP[$rel]:-}" ]]; then
+    echo "SKIP_DENY $rel" | tee -a "$LOG"
+    skip=$((skip + 1))
+    continue
+  fi
+  p="$KP/$rel"
+  if [[ ! -f "$p" ]]; then
+    echo "MISS $rel" | tee -a "$LOG"
+    miss=$((miss + 1))
+    echo "$rel" >>"$FAIL_LIST"
+    if [[ "$CONTINUE" != "1" ]]; then
+      echo "error: missing patch (abort)" >&2
+      exit 1
+    fi
+    continue
+  fi
+
+  args=(-p1 --batch -d "$KERNEL_DIR" --forward --no-backup-if-mismatch)
+  if [[ "$DRY_RUN" -eq 1 ]]; then
+    args+=(--dry-run)
+  fi
+
+  patch_log=$(mktemp)
+  set +e
+  patch "${args[@]}" <"$p" >"$patch_log" 2>&1
+  prc=$?
+  set -e
+  cat "$patch_log" >>"$LOG"
+
+  # Quality: fuzz / large offsets even when exit 0
+  fuzz_max=0
+  abs_off_max=0
+  eval "$(python3 -c '
+import re, sys
+text = open(sys.argv[1], errors="replace").read()
+fuzz = off = 0
+for m in re.finditer(r"with fuzz (\d+)", text):
+    fuzz = max(fuzz, int(m.group(1)))
+for m in re.finditer(r"\(offset ([+-]?\d+) lines\)", text):
+    off = max(off, abs(int(m.group(1))))
+print(f"fuzz_max={fuzz}")
+print(f"abs_off_max={off}")
+' "$patch_log")"
+  rm -f "$patch_log"
+
+  qbad=0
+  if [[ "$MAX_FUZZ" -gt 0 && "$fuzz_max" -ge "$MAX_FUZZ" ]]; then
+    echo "QUALITY_FAIL fuzz=$fuzz_max>=$MAX_FUZZ $rel" | tee -a "$LOG"
+    qbad=1
+  fi
+  if [[ "$MAX_ABS_OFFSET" -gt 0 && "$abs_off_max" -ge "$MAX_ABS_OFFSET" ]]; then
+    echo "QUALITY_FAIL abs_offset=$abs_off_max>=$MAX_ABS_OFFSET $rel" | tee -a "$LOG"
+    qbad=1
+  fi
+
+  if [[ "$prc" -eq 0 && "$qbad" -eq 0 ]]; then
+    echo "OK $rel (fuzz_max=$fuzz_max abs_off_max=$abs_off_max)" | tee -a "$LOG"
+    ok=$((ok + 1))
+    continue
+  fi
+
+  # Failure path: preserve rejects
+  echo "FAIL $rel patch_rc=$prc fuzz_max=$fuzz_max abs_off_max=$abs_off_max" | tee -a "$LOG"
+  echo "$rel" >>"$FAIL_LIST"
+  fail=$((fail + 1))
+  [[ "$qbad" -eq 1 ]] && quality_fail=$((quality_fail + 1))
+
+  safe=$(echo "$rel" | tr '/' '_')
+  dest="$REJECT_DIR/$safe"
+  mkdir -p "$dest"
+  # move any rej/orig created under kernel tree
+  while IFS= read -r -d '' rej; do
+    mv "$rej" "$dest/" 2>/dev/null || cp -a "$rej" "$dest/" || true
+  done < <(find "$KERNEL_DIR" -name '*.rej' -print0 2>/dev/null)
+  while IFS= read -r -d '' orig; do
+    mv "$orig" "$dest/" 2>/dev/null || cp -a "$orig" "$dest/" || true
+  done < <(find "$KERNEL_DIR" -name '*.orig' -print0 2>/dev/null)
+  cp -a "$p" "$dest/patch" 2>/dev/null || true
+  echo "rejects_kept=$dest" | tee -a "$LOG"
+
+  if [[ "$CONTINUE" != "1" ]]; then
+    echo "error: abort on FAIL (set CVE_STRICT_CONTINUE=1 to keep going)" >&2
+    echo "CVE strict ABORT OK=$ok FAIL=$fail QUALITY_FAIL=$quality_fail SKIP_DENY=$skip MISS=$miss log=$LOG" | tee -a "$LOG"
+    exit 1
+  fi
+done <"$LIST"
+
+echo "CVE strict done OK=$ok FAIL=$fail QUALITY_FAIL=$quality_fail SKIP_DENY=$skip MISS=$miss dry_run=$DRY_RUN continue=$CONTINUE log=$LOG rejects=$REJECT_DIR" | tee -a "$LOG"
+
+if [[ "$fail" -gt 0 && "$CONTINUE" != "1" ]]; then
+  exit 1
+fi
+if [[ "$ok" -eq 0 && "$DRY_RUN" -eq 0 ]]; then
+  echo "error: zero CVE patches applied" >&2
+  exit 1
+fi
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Apply FR-017 Stage 1 AXP Graphene/AH patches to LOS msm-4.14.
+# Attribute: AXP kernel_patches (GrapheneOS / AndroidHardening series via Divest-era layout).
+set -euo pipefail
+
+KP="${AXP_KERNEL_PATCHES:-/srv/rom/references/axp/kernel_patches}"
+KERNEL_DIR="${1:-/srv/rom/src/lineage/kernel/google/msm-4.14}"
+LIST="$(cd "$(dirname "$0")" && pwd)/stage1.list"
+DRY_RUN=0
+if [[ "${2:-}" == "--dry-run" ]]; then
+  DRY_RUN=1
+fi
+
+if [[ ! -d "$KERNEL_DIR" ]]; then
+  echo "error: kernel dir missing: $KERNEL_DIR" >&2
+  exit 1
+fi
+if [[ ! -d "$KP" ]]; then
+  echo "error: AXP kernel_patches missing: $KP" >&2
+  exit 1
+fi
+
+ok=0
+fail=0
+while IFS= read -r rel || [[ -n "$rel" ]]; do
+  [[ -z "$rel" || "$rel" =~ ^# ]] && continue
+  p="$KP/$rel"
+  if [[ ! -f "$p" ]]; then
+    echo "FAIL missing $rel"
+    fail=$((fail + 1))
+    continue
+  fi
+  args=(-p1 --batch -d "$KERNEL_DIR")
+  if [[ "$DRY_RUN" -eq 1 ]]; then
+    args+=(--dry-run)
+  fi
+  if patch "${args[@]}" < "$p"; then
+    echo "OK $rel"
+    ok=$((ok + 1))
+  else
+    echo "FAIL $rel"
+    fail=$((fail + 1))
+    find "$KERNEL_DIR" -name '*.rej' -delete 2>/dev/null || true
+    find "$KERNEL_DIR" -name '*.orig' -delete 2>/dev/null || true
+    exit 1
+  fi
+done < "$LIST"
+
+echo "Stage1 done OK=$ok FAIL=$fail dry_run=$DRY_RUN"
@@ -0,0 +1,47 @@
+#!/bin/bash
+# Stage1 Graphene/AH (30 patches) + combo4 Clang FORTIFY pack on a clean msm-4.14.
+#
+# Order: Stage1 first (virgin tree), then apply_combo4_fortify.sh (Clang POS +
+# nested __underlying_strlen + driver bounds + combo4 defconfig).
+# Expects reset tree @ 28f9290ae067 (apply_fortify_clang.py is not idempotent).
+#
+# Full bacon with this pack ships matching vendor modules (Wi-Fi). Boot-only
+# flash onto an older vendor can break wlan CRC — prefer sideload of the zip.
+set -e
+
+K=${1:?kernel tree}
+HERE=$(cd "$(dirname "$0")" && pwd)
+
+test -d "$K/include/linux"
+test -x "$HERE/apply_stage1.sh" || chmod +x "$HERE/apply_stage1.sh"
+test -x "$HERE/apply_combo4_fortify.sh" || chmod +x "$HERE/apply_combo4_fortify.sh"
+
+bash "$HERE/apply_stage1.sh" "$K"
+
+# Historical Stage1 slab/0014 misfuzz: if is_root_cache was corrupted, restore.
+python3 - <<'PY' "$K"
+from pathlib import Path
+import sys
+p = Path(sys.argv[1]) / "mm/slab.h"
+t = p.read_text()
+bad = """static inline bool is_root_cache(struct kmem_cache *s)
+{
+#ifdef CONFIG_SLAB_HARDENED
+\treturn p == s;
+#else
+\treturn true;
+#endif
+}"""
+good = """static inline bool is_root_cache(struct kmem_cache *s)
+{
+\treturn true;
+}"""
+if bad in t:
+    p.write_text(t.replace(bad, good, 1))
+    print("OK: reverted Stage1 slab/0014 misfuzz in is_root_cache")
+else:
+    print("OK: is_root_cache looks unmisfuzzed (no BUILD-FIXES edit)")
+PY
+
+bash "$HERE/apply_combo4_fortify.sh" "$K"
+echo "OK: Stage1 + combo4+FORTIFY applied on $K"
@@ -0,0 +1,12 @@
+#!/bin/bash
+# Stage1 + combo4+FORTIFY + AXP CVE strict allowlist on clean msm-4.14.
+# Boot-OK baseline first (LAB 2026-09-29), then CVE mega that compiled 2026-09-18.
+# FR-018: no location lockdown — keep GPS precise/fast (LOS defaults).
+set -e
+K=${1:?kernel tree}
+HERE=$(cd "$(dirname "$0")" && pwd)
+
+test -d "$K/include/linux"
+bash "$HERE/apply_stage1_combo4.sh" "$K"
+bash "$HERE/apply_cve_strict.sh" "$K"
+echo "OK: Stage1 + combo4+FORTIFY + CVE-strict applied on $K (no location lockdown)"
@@ -0,0 +1,31 @@
+#!/bin/bash
+# US-S5-1 — enable remaining Graphene/AXP-class defconfig knobs on msm-4.14.
+#
+# Oracle: AXP/Graphene kernel hardening expects Yama + slab freelist random
+# (combo4 already ships SLAB_FREELIST_HARDENED). LOS sunfish_defconfig left both
+# off; CONFIG_LSM already lists yama but SECURITY_YAMA was unset so the LSM
+# never built.
+#
+# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped) or
+# CVE-2022-49980 (denylist until lock-scope port).
+#
+# Usage: apply_uss5_1_defconfig.sh <kernel-tree>
+set -euo pipefail
+
+K=${1:?kernel tree}
+DEF="$K/arch/arm64/configs/sunfish_defconfig"
+test -f "$DEF"
+test -f "$K/security/yama/Kconfig"
+
+for k in SECURITY_YAMA SLAB_FREELIST_RANDOM; do
+  sed -i "/CONFIG_${k}/d" "$DEF"
+  # drop "# CONFIG_FOO is not set" lines too (sed above only matches CONFIG_FOO=)
+  sed -i "/# CONFIG_${k} is not set/d" "$DEF"
+done
+
+{
+  echo "CONFIG_SECURITY_YAMA=y"
+  echo "CONFIG_SLAB_FREELIST_RANDOM=y"
+} >> "$DEF"
+
+echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM) on $K"
@@ -0,0 +1 @@
+CVE-2022-49980/ANY/0001.patch
@@ -0,0 +1,215 @@
+0003-syzkaller-Misc/ANY/0008.patch
+CVE-2015-7837/ANY/0001.patch
+CVE-2016-3695/ANY/0001.patch
+CVE-2017-5754/^4.19/0157.patch
+CVE-2017-18232/4.14/0002.patch
+CVE-2018-5897/ANY/0001.patch
+CVE-2018-9415/ANY/0005.patch
+CVE-2018-20855/^4.18/0001.patch
+CVE-2019-3874/^5.1/0002.patch
+CVE-2019-9444/ANY/0001.patch
+CVE-2019-10520/ANY/0001.patch
+CVE-2019-11191/^5.0/0001.patch
+CVE-2019-12378/^5.1.5/0001.patch
+CVE-2019-12455/^5.2/0001.patch
+CVE-2019-12456/^5.1.5/0002.patch
+CVE-2019-15291/4.14/0004.patch
+CVE-2019-16921/^4.16/0001.patch
+CVE-2019-18786/4.14/0002.patch
+CVE-2019-19051/4.14/0008.patch
+CVE-2019-19068/4.14/0002.patch
+CVE-2019-19602/^5.4/0001.patch
+CVE-2019-20908/^5.2/0001.patch
+CVE-2020-0255/^5.6/0001.patch
+CVE-2020-8832/^4.14/0001.patch
+CVE-2020-15780/^5.8/0001.patch
+CVE-2020-16119/^5.10/0002.patch
+CVE-2020-BleedingToothExtras/^5.10/0001.patch
+CVE-2021-3493/^5.10/0001.patch
+CVE-2021-28039/^5.11/0001.patch
+CVE-2021-28950/4.14/0002.patch
+CVE-2021-29154/^5.12/0002.patch
+CVE-2021-30337/4.14/0018.patch
+CVE-2021-46912/^5.12/0001.patch
+CVE-2021-46958/^5.12/0001.patch
+CVE-2021-46999/^5.12/0001.patch
+CVE-2021-47010/^5.12/0001.patch
+CVE-2021-47058/^5.12/0001.patch
+CVE-2021-47173/4.14/0003.patch
+CVE-2021-47234/^5.13/0001.patch
+CVE-2021-47266/^5.13/0001.patch
+CVE-2021-47346/^5.13/0001.patch
+CVE-2021-47430/^5.15/0001.patch
+CVE-2021-47472/4.14/0003.patch
+CVE-2021-47583/^5.15/0001.patch
+CVE-2021-47616/^5.16/0001.patch
+CVE-2021-47618/^5.16/0001.patch
+CVE-2021-47636/ANY/0001.patch
+CVE-2022-3061/^5.18/0001.patch
+CVE-2022-3903/^6.0/0001.patch
+CVE-2022-4382/^6.2/0001.patch
+CVE-2022-21546/ANY/0001.patch
+CVE-2022-27950/^5.16/0001.patch
+CVE-2022-48674/^6.0/0001.patch
+CVE-2022-48713/^5.17/0001.patch
+CVE-2022-48781/^5.17/0001.patch
+CVE-2022-48785/^5.17/0001.patch
+CVE-2022-48966/4.14/0002.patch
+CVE-2022-49034/ANY/0002.patch
+CVE-2022-49061/4.14/0002.patch
+CVE-2022-49073/ANY/0001.patch
+CVE-2022-49078/ANY/0001.patch
+CVE-2022-49146/ANY/0001.patch
+CVE-2022-49194/ANY/0001.patch
+CVE-2022-49205/ANY/0001.patch
+CVE-2022-49209/ANY/0001.patch
+CVE-2022-49285/ANY/0001.patch
+CVE-2022-49318/ANY/0001.patch
+CVE-2022-49363/ANY/0001.patch
+CVE-2022-49364/ANY/0001.patch
+CVE-2022-49380/ANY/0001.patch
+CVE-2022-49425/ANY/0001.patch
+CVE-2022-49428/ANY/0001.patch
+CVE-2022-49433/ANY/0001.patch
+CVE-2022-49500/ANY/0001.patch
+CVE-2022-49513/ANY/0001.patch
+CVE-2022-49563/ANY/0001.patch
+CVE-2022-49564/ANY/0001.patch
+CVE-2022-49566/ANY/0001.patch
+CVE-2022-49642/ANY/0001.patch
+CVE-2022-49705/ANY/0001.patch
+CVE-2022-49710/ANY/0001.patch
+CVE-2022-49777/ANY/0001.patch
+CVE-2022-49779/ANY/0001.patch
+CVE-2022-49784/ANY/0001.patch
+CVE-2022-49823/ANY/0001.patch
+CVE-2022-49824/ANY/0001.patch
+CVE-2022-49825/ANY/0001.patch
+CVE-2022-49839/ANY/0001.patch
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49980/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
+CVE-2022-50248/ANY/0001.patch
+CVE-2022-50273/ANY/0001.patch
+CVE-2022-50326/ANY/0001.patch
+CVE-2022-50358/ANY/0001.patch
+CVE-2022-50364/ANY/0001.patch
+CVE-2022-50397/ANY/0001.patch
+CVE-2022-50473/ANY/0001.patch
+CVE-2022-50522/4.14/0003.patch
+CVE-2022-50537/ANY/0001.patch
+CVE-2023-1989/4.14/0003.patch
+CVE-2023-21657/4.14/0005.patch
+CVE-2023-23000/^5.16/0001.patch
+CVE-2023-28554/ANY/0002.patch
+CVE-2023-33070/ANY/0001.patch
+CVE-2023-52523/^6.6/0001.patch
+CVE-2023-52595/^6.6/0001.patch
+CVE-2023-52604/4.14/0009.patch
+CVE-2023-52746/^6.2/0001.patch
+CVE-2023-52884/^6.5/0001.patch
+CVE-2023-52979/4.14/0003.patch
+CVE-2023-53001/ANY/0001.patch
+CVE-2023-53016/ANY/0001.patch
+CVE-2023-53098/ANY/0001.patch
+CVE-2023-53125/4.14/0003.patch
+CVE-2023-53131/ANY/0001.patch
+CVE-2023-53137/ANY/0001.patch
+CVE-2023-53214/ANY/0001.patch
+CVE-2023-53227/4.14/0003.patch
+CVE-2023-53250/ANY/0001.patch
+CVE-2023-53259/ANY/0002.patch
+CVE-2023-53265/4.14/0003.patch
+CVE-2023-53288/ANY/0001.patch
+CVE-2023-53312/ANY/0001.patch
+CVE-2023-53436/4.14/0003.patch
+CVE-2023-53443/ANY/0001.patch
+CVE-2023-53487/ANY/0002.patch
+CVE-2023-53537/ANY/0001.patch
+CVE-2023-53599/ANY/0001.patch
+CVE-2023-53641/ANY/0001.patch
+CVE-2023-53693/ANY/0001.patch
+CVE-2023-53695/ANY/0001.patch
+CVE-2023-53712/ANY/0001.patch
+CVE-2023-53719/ANY/0001.patch
+CVE-2024-26645/^6.8/0001.patch
+CVE-2024-26720/4.14/0009.patch
+CVE-2024-26760/^6.8/0001.patch
+CVE-2024-26920/4.14/0009.patch
+CVE-2024-26961/^6.7/0001.patch
+CVE-2024-26972/^6.8/0001.patch
+CVE-2024-27009/^6.9/0001.patch
+CVE-2024-27033/^6.8/0001.patch
+CVE-2024-27393/^6.9/0001.patch
+CVE-2024-33032/ANY/0002.patch
+CVE-2024-34027/^6.9/0001.patch
+CVE-2024-35812/4.14/0009.patch
+CVE-2024-35824/^6.8/0001.patch
+CVE-2024-35879/^6.9/0001.patch
+CVE-2024-35933/4.14/0008.patch
+CVE-2024-35950/^6.9/0001.patch
+CVE-2024-35954/^6.9/0001.patch
+CVE-2024-35962/^6.9/0001.patch
+CVE-2024-40996/^6.10/0001.patch
+CVE-2024-41041/^6.10/0001.patch
+CVE-2024-42077/^6.10/0001.patch
+CVE-2024-42102/4.14/0009.patch
+CVE-2024-42296/^6.10/0001.patch
+CVE-2024-43894/^6.11/0001.patch
+CVE-2024-44938/^6.9/0001.patch
+CVE-2024-44939/^6.9/0001.patch
+CVE-2024-44952/4.14/0008.patch
+CVE-2024-46681/^6.11/0001.patch
+CVE-2024-47747/^6.11/0001.patch
+CVE-2024-50017/^6.11/0001.patch
+CVE-2024-50019/^6.12/0001.patch
+CVE-2024-50184/^6.11/0001.patch
+CVE-2024-50195/3.17-^6.12/0001.patch
+CVE-2024-50201/^6.12/0001.patch
+CVE-2024-50210/3.17-^6.6/0001.patch
+CVE-2024-50265/^6.12/0001.patch
+CVE-2024-50267/^6.12/0001.patch
+CVE-2024-50269/^6.12/0001.patch
+CVE-2024-50279/^6.12/0001.patch
+CVE-2024-50287/^6.12/0001.patch
+CVE-2024-50290/^6.12/0001.patch
+CVE-2024-50292/^6.12/0001.patch
+CVE-2024-50295/^6.12/0001.patch
+CVE-2024-50299/^6.12/0001.patch
+CVE-2024-50301/^6.12/0001.patch
+CVE-2024-52332/ANY/0002.patch
+CVE-2024-53045/^6.12/0001.patch
+CVE-2024-53101/^6.12/0001.patch
+CVE-2024-53103/^6.12/0001.patch
+CVE-2024-53112/^6.12/0001.patch
+CVE-2024-53127/^6.12/0001.patch
+CVE-2024-53140/^6.12/0001.patch
+CVE-2024-53141/^6.12/0001.patch
+CVE-2024-53156/ANY/0002.patch
+CVE-2024-53157/ANY/0002.patch
+CVE-2024-53165/ANY/0002.patch
+CVE-2024-53171/ANY/0001.patch
+CVE-2024-53172/ANY/0002.patch
+CVE-2024-53183/ANY/0002.patch
+CVE-2024-53190/ANY/0001.patch
+CVE-2024-53194/ANY/0002.patch
+CVE-2024-53214/ANY/0002.patch
+CVE-2024-53227/ANY/0002.patch
+CVE-2024-53239/ANY/0001.patch
+CVE-2024-53680/ANY/0002.patch
+CVE-2024-53690/ANY/0001.patch
+CVE-2024-56531/ANY/0002.patch
+CVE-2024-56532/ANY/0002.patch
+CVE-2024-56536/ANY/0001.patch
+CVE-2024-56539/ANY/0002.patch
+CVE-2024-56548/ANY/0002.patch
+CVE-2024-56570/ANY/0001.patch
+CVE-2024-56586/ANY/0001.patch
+CVE-2024-56587/ANY/0002.patch
+CVE-2024-56593/ANY/0001.patch
+CVE-2024-56595/ANY/0002.patch
+CVE-2024-56597/ANY/0002.patch
@@ -0,0 +1,108 @@
+0003-syzkaller-Misc/ANY/0008.patch
+CVE-2015-7837/ANY/0001.patch
+CVE-2016-3695/ANY/0001.patch
+CVE-2017-5754/^4.19/0157.patch
+CVE-2017-18232/4.14/0002.patch
+CVE-2018-5897/ANY/0001.patch
+CVE-2018-9415/ANY/0005.patch
+CVE-2018-20855/^4.18/0001.patch
+CVE-2019-3874/^5.1/0002.patch
+CVE-2019-9444/ANY/0001.patch
+CVE-2019-10520/ANY/0001.patch
+CVE-2019-11191/^5.0/0001.patch
+CVE-2019-12378/^5.1.5/0001.patch
+CVE-2019-12455/^5.2/0001.patch
+CVE-2019-12456/^5.1.5/0002.patch
+CVE-2019-15291/4.14/0004.patch
+CVE-2019-16921/^4.16/0001.patch
+CVE-2019-18786/4.14/0002.patch
+CVE-2019-19051/4.14/0008.patch
+CVE-2019-19068/4.14/0002.patch
+CVE-2019-19602/^5.4/0001.patch
+CVE-2019-20908/^5.2/0001.patch
+CVE-2020-0255/^5.6/0001.patch
+CVE-2020-8832/^4.14/0001.patch
+CVE-2020-15780/^5.8/0001.patch
+CVE-2020-16119/^5.10/0002.patch
+CVE-2020-BleedingToothExtras/^5.10/0001.patch
+CVE-2021-3493/^5.10/0001.patch
+CVE-2021-28039/^5.11/0001.patch
+CVE-2021-28950/4.14/0002.patch
+CVE-2021-29154/^5.12/0002.patch
+CVE-2021-30337/4.14/0018.patch
+CVE-2021-46912/^5.12/0001.patch
+CVE-2021-46958/^5.12/0001.patch
+CVE-2021-46999/^5.12/0001.patch
+CVE-2021-47010/^5.12/0001.patch
+CVE-2021-47058/^5.12/0001.patch
+CVE-2021-47173/4.14/0003.patch
+CVE-2021-47234/^5.13/0001.patch
+CVE-2021-47266/^5.13/0001.patch
+CVE-2021-47346/^5.13/0001.patch
+CVE-2021-47430/^5.15/0001.patch
+CVE-2021-47472/4.14/0003.patch
+CVE-2021-47583/^5.15/0001.patch
+CVE-2021-47616/^5.16/0001.patch
+CVE-2021-47618/^5.16/0001.patch
+CVE-2021-47636/ANY/0001.patch
+CVE-2022-3061/^5.18/0001.patch
+CVE-2022-3903/^6.0/0001.patch
+CVE-2022-4382/^6.2/0001.patch
+CVE-2022-21546/ANY/0001.patch
+CVE-2022-27950/^5.16/0001.patch
+CVE-2022-48674/^6.0/0001.patch
+CVE-2022-48713/^5.17/0001.patch
+CVE-2022-48781/^5.17/0001.patch
+CVE-2022-48785/^5.17/0001.patch
+CVE-2022-48966/4.14/0002.patch
+CVE-2022-49034/ANY/0002.patch
+CVE-2022-49061/4.14/0002.patch
+CVE-2022-49073/ANY/0001.patch
+CVE-2022-49078/ANY/0001.patch
+CVE-2022-49146/ANY/0001.patch
+CVE-2022-49194/ANY/0001.patch
+CVE-2022-49205/ANY/0001.patch
+CVE-2022-49209/ANY/0001.patch
+CVE-2022-49285/ANY/0001.patch
+CVE-2022-49318/ANY/0001.patch
+CVE-2022-49363/ANY/0001.patch
+CVE-2022-49364/ANY/0001.patch
+CVE-2022-49380/ANY/0001.patch
+CVE-2022-49425/ANY/0001.patch
+CVE-2022-49428/ANY/0001.patch
+CVE-2022-49433/ANY/0001.patch
+CVE-2022-49500/ANY/0001.patch
+CVE-2022-49513/ANY/0001.patch
+CVE-2022-49563/ANY/0001.patch
+CVE-2022-49564/ANY/0001.patch
+CVE-2022-49566/ANY/0001.patch
+CVE-2022-49642/ANY/0001.patch
+CVE-2022-49705/ANY/0001.patch
+CVE-2022-49710/ANY/0001.patch
+CVE-2022-49777/ANY/0001.patch
+CVE-2022-49779/ANY/0001.patch
+CVE-2022-49784/ANY/0001.patch
+CVE-2022-49823/ANY/0001.patch
+CVE-2022-49824/ANY/0001.patch
+CVE-2022-49825/ANY/0001.patch
+CVE-2022-49839/ANY/0001.patch
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49980/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
+CVE-2022-50248/ANY/0001.patch
+CVE-2022-50273/ANY/0001.patch
+CVE-2022-50326/ANY/0001.patch
+CVE-2022-50358/ANY/0001.patch
+CVE-2022-50364/ANY/0001.patch
+CVE-2022-50397/ANY/0001.patch
+CVE-2022-50473/ANY/0001.patch
+CVE-2022-50522/4.14/0003.patch
+CVE-2022-50537/ANY/0001.patch
+CVE-2023-1989/4.14/0003.patch
+CVE-2023-21657/4.14/0005.patch
+CVE-2023-23000/^5.16/0001.patch
+CVE-2023-28554/ANY/0002.patch
@@ -0,0 +1,54 @@
+0003-syzkaller-Misc/ANY/0008.patch
+CVE-2015-7837/ANY/0001.patch
+CVE-2016-3695/ANY/0001.patch
+CVE-2017-5754/^4.19/0157.patch
+CVE-2017-18232/4.14/0002.patch
+CVE-2018-5897/ANY/0001.patch
+CVE-2018-9415/ANY/0005.patch
+CVE-2018-20855/^4.18/0001.patch
+CVE-2019-3874/^5.1/0002.patch
+CVE-2019-9444/ANY/0001.patch
+CVE-2019-10520/ANY/0001.patch
+CVE-2019-11191/^5.0/0001.patch
+CVE-2019-12378/^5.1.5/0001.patch
+CVE-2019-12455/^5.2/0001.patch
+CVE-2019-12456/^5.1.5/0002.patch
+CVE-2019-15291/4.14/0004.patch
+CVE-2019-16921/^4.16/0001.patch
+CVE-2019-18786/4.14/0002.patch
+CVE-2019-19051/4.14/0008.patch
+CVE-2019-19068/4.14/0002.patch
+CVE-2019-19602/^5.4/0001.patch
+CVE-2019-20908/^5.2/0001.patch
+CVE-2020-0255/^5.6/0001.patch
+CVE-2020-8832/^4.14/0001.patch
+CVE-2020-15780/^5.8/0001.patch
+CVE-2020-16119/^5.10/0002.patch
+CVE-2020-BleedingToothExtras/^5.10/0001.patch
+CVE-2021-3493/^5.10/0001.patch
+CVE-2021-28039/^5.11/0001.patch
+CVE-2021-28950/4.14/0002.patch
+CVE-2021-29154/^5.12/0002.patch
+CVE-2021-30337/4.14/0018.patch
+CVE-2021-46912/^5.12/0001.patch
+CVE-2021-46958/^5.12/0001.patch
+CVE-2021-46999/^5.12/0001.patch
+CVE-2021-47010/^5.12/0001.patch
+CVE-2021-47058/^5.12/0001.patch
+CVE-2021-47173/4.14/0003.patch
+CVE-2021-47234/^5.13/0001.patch
+CVE-2021-47266/^5.13/0001.patch
+CVE-2021-47346/^5.13/0001.patch
+CVE-2021-47430/^5.15/0001.patch
+CVE-2021-47472/4.14/0003.patch
+CVE-2021-47583/^5.15/0001.patch
+CVE-2021-47616/^5.16/0001.patch
+CVE-2021-47618/^5.16/0001.patch
+CVE-2021-47636/ANY/0001.patch
+CVE-2022-3061/^5.18/0001.patch
+CVE-2022-3903/^6.0/0001.patch
+CVE-2022-4382/^6.2/0001.patch
+CVE-2022-21546/ANY/0001.patch
+CVE-2022-27950/^5.16/0001.patch
+CVE-2022-48674/^6.0/0001.patch
+CVE-2022-48713/^5.17/0001.patch
@@ -0,0 +1,54 @@
+CVE-2022-48781/^5.17/0001.patch
+CVE-2022-48785/^5.17/0001.patch
+CVE-2022-48966/4.14/0002.patch
+CVE-2022-49034/ANY/0002.patch
+CVE-2022-49061/4.14/0002.patch
+CVE-2022-49073/ANY/0001.patch
+CVE-2022-49078/ANY/0001.patch
+CVE-2022-49146/ANY/0001.patch
+CVE-2022-49194/ANY/0001.patch
+CVE-2022-49205/ANY/0001.patch
+CVE-2022-49209/ANY/0001.patch
+CVE-2022-49285/ANY/0001.patch
+CVE-2022-49318/ANY/0001.patch
+CVE-2022-49363/ANY/0001.patch
+CVE-2022-49364/ANY/0001.patch
+CVE-2022-49380/ANY/0001.patch
+CVE-2022-49425/ANY/0001.patch
+CVE-2022-49428/ANY/0001.patch
+CVE-2022-49433/ANY/0001.patch
+CVE-2022-49500/ANY/0001.patch
+CVE-2022-49513/ANY/0001.patch
+CVE-2022-49563/ANY/0001.patch
+CVE-2022-49564/ANY/0001.patch
+CVE-2022-49566/ANY/0001.patch
+CVE-2022-49642/ANY/0001.patch
+CVE-2022-49705/ANY/0001.patch
+CVE-2022-49710/ANY/0001.patch
+CVE-2022-49777/ANY/0001.patch
+CVE-2022-49779/ANY/0001.patch
+CVE-2022-49784/ANY/0001.patch
+CVE-2022-49823/ANY/0001.patch
+CVE-2022-49824/ANY/0001.patch
+CVE-2022-49825/ANY/0001.patch
+CVE-2022-49839/ANY/0001.patch
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49980/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
+CVE-2022-50248/ANY/0001.patch
+CVE-2022-50273/ANY/0001.patch
+CVE-2022-50326/ANY/0001.patch
+CVE-2022-50358/ANY/0001.patch
+CVE-2022-50364/ANY/0001.patch
+CVE-2022-50397/ANY/0001.patch
+CVE-2022-50473/ANY/0001.patch
+CVE-2022-50522/4.14/0003.patch
+CVE-2022-50537/ANY/0001.patch
+CVE-2023-1989/4.14/0003.patch
+CVE-2023-21657/4.14/0005.patch
+CVE-2023-23000/^5.16/0001.patch
+CVE-2023-28554/ANY/0002.patch
@@ -0,0 +1,27 @@
+CVE-2022-48781/^5.17/0001.patch
+CVE-2022-48785/^5.17/0001.patch
+CVE-2022-48966/4.14/0002.patch
+CVE-2022-49034/ANY/0002.patch
+CVE-2022-49061/4.14/0002.patch
+CVE-2022-49073/ANY/0001.patch
+CVE-2022-49078/ANY/0001.patch
+CVE-2022-49146/ANY/0001.patch
+CVE-2022-49194/ANY/0001.patch
+CVE-2022-49205/ANY/0001.patch
+CVE-2022-49209/ANY/0001.patch
+CVE-2022-49285/ANY/0001.patch
+CVE-2022-49318/ANY/0001.patch
+CVE-2022-49363/ANY/0001.patch
+CVE-2022-49364/ANY/0001.patch
+CVE-2022-49380/ANY/0001.patch
+CVE-2022-49425/ANY/0001.patch
+CVE-2022-49428/ANY/0001.patch
+CVE-2022-49433/ANY/0001.patch
+CVE-2022-49500/ANY/0001.patch
+CVE-2022-49513/ANY/0001.patch
+CVE-2022-49563/ANY/0001.patch
+CVE-2022-49564/ANY/0001.patch
+CVE-2022-49566/ANY/0001.patch
+CVE-2022-49642/ANY/0001.patch
+CVE-2022-49705/ANY/0001.patch
+CVE-2022-49710/ANY/0001.patch
@@ -0,0 +1,27 @@
+CVE-2022-49777/ANY/0001.patch
+CVE-2022-49779/ANY/0001.patch
+CVE-2022-49784/ANY/0001.patch
+CVE-2022-49823/ANY/0001.patch
+CVE-2022-49824/ANY/0001.patch
+CVE-2022-49825/ANY/0001.patch
+CVE-2022-49839/ANY/0001.patch
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49980/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
+CVE-2022-50248/ANY/0001.patch
+CVE-2022-50273/ANY/0001.patch
+CVE-2022-50326/ANY/0001.patch
+CVE-2022-50358/ANY/0001.patch
+CVE-2022-50364/ANY/0001.patch
+CVE-2022-50397/ANY/0001.patch
+CVE-2022-50473/ANY/0001.patch
+CVE-2022-50522/4.14/0003.patch
+CVE-2022-50537/ANY/0001.patch
+CVE-2023-1989/4.14/0003.patch
+CVE-2023-21657/4.14/0005.patch
+CVE-2023-23000/^5.16/0001.patch
+CVE-2023-28554/ANY/0002.patch
@@ -0,0 +1,14 @@
+CVE-2022-49777/ANY/0001.patch
+CVE-2022-49779/ANY/0001.patch
+CVE-2022-49784/ANY/0001.patch
+CVE-2022-49823/ANY/0001.patch
+CVE-2022-49824/ANY/0001.patch
+CVE-2022-49825/ANY/0001.patch
+CVE-2022-49839/ANY/0001.patch
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49980/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
@@ -0,0 +1,7 @@
+CVE-2022-49777/ANY/0001.patch
+CVE-2022-49779/ANY/0001.patch
+CVE-2022-49784/ANY/0001.patch
+CVE-2022-49823/ANY/0001.patch
+CVE-2022-49824/ANY/0001.patch
+CVE-2022-49825/ANY/0001.patch
+CVE-2022-49839/ANY/0001.patch
@@ -0,0 +1,6 @@
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
@@ -0,0 +1,7 @@
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49980/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
@@ -0,0 +1,13 @@
+CVE-2022-50248/ANY/0001.patch
+CVE-2022-50273/ANY/0001.patch
+CVE-2022-50326/ANY/0001.patch
+CVE-2022-50358/ANY/0001.patch
+CVE-2022-50364/ANY/0001.patch
+CVE-2022-50397/ANY/0001.patch
+CVE-2022-50473/ANY/0001.patch
+CVE-2022-50522/4.14/0003.patch
+CVE-2022-50537/ANY/0001.patch
+CVE-2023-1989/4.14/0003.patch
+CVE-2023-21657/4.14/0005.patch
+CVE-2023-23000/^5.16/0001.patch
+CVE-2023-28554/ANY/0002.patch
@@ -0,0 +1,107 @@
+CVE-2023-33070/ANY/0001.patch
+CVE-2023-52523/^6.6/0001.patch
+CVE-2023-52595/^6.6/0001.patch
+CVE-2023-52604/4.14/0009.patch
+CVE-2023-52746/^6.2/0001.patch
+CVE-2023-52884/^6.5/0001.patch
+CVE-2023-52979/4.14/0003.patch
+CVE-2023-53001/ANY/0001.patch
+CVE-2023-53016/ANY/0001.patch
+CVE-2023-53098/ANY/0001.patch
+CVE-2023-53125/4.14/0003.patch
+CVE-2023-53131/ANY/0001.patch
+CVE-2023-53137/ANY/0001.patch
+CVE-2023-53214/ANY/0001.patch
+CVE-2023-53227/4.14/0003.patch
+CVE-2023-53250/ANY/0001.patch
+CVE-2023-53259/ANY/0002.patch
+CVE-2023-53265/4.14/0003.patch
+CVE-2023-53288/ANY/0001.patch
+CVE-2023-53312/ANY/0001.patch
+CVE-2023-53436/4.14/0003.patch
+CVE-2023-53443/ANY/0001.patch
+CVE-2023-53487/ANY/0002.patch
+CVE-2023-53537/ANY/0001.patch
+CVE-2023-53599/ANY/0001.patch
+CVE-2023-53641/ANY/0001.patch
+CVE-2023-53693/ANY/0001.patch
+CVE-2023-53695/ANY/0001.patch
+CVE-2023-53712/ANY/0001.patch
+CVE-2023-53719/ANY/0001.patch
+CVE-2024-26645/^6.8/0001.patch
+CVE-2024-26720/4.14/0009.patch
+CVE-2024-26760/^6.8/0001.patch
+CVE-2024-26920/4.14/0009.patch
+CVE-2024-26961/^6.7/0001.patch
+CVE-2024-26972/^6.8/0001.patch
+CVE-2024-27009/^6.9/0001.patch
+CVE-2024-27033/^6.8/0001.patch
+CVE-2024-27393/^6.9/0001.patch
+CVE-2024-33032/ANY/0002.patch
+CVE-2024-34027/^6.9/0001.patch
+CVE-2024-35812/4.14/0009.patch
+CVE-2024-35824/^6.8/0001.patch
+CVE-2024-35879/^6.9/0001.patch
+CVE-2024-35933/4.14/0008.patch
+CVE-2024-35950/^6.9/0001.patch
+CVE-2024-35954/^6.9/0001.patch
+CVE-2024-35962/^6.9/0001.patch
+CVE-2024-40996/^6.10/0001.patch
+CVE-2024-41041/^6.10/0001.patch
+CVE-2024-42077/^6.10/0001.patch
+CVE-2024-42102/4.14/0009.patch
+CVE-2024-42296/^6.10/0001.patch
+CVE-2024-43894/^6.11/0001.patch
+CVE-2024-44938/^6.9/0001.patch
+CVE-2024-44939/^6.9/0001.patch
+CVE-2024-44952/4.14/0008.patch
+CVE-2024-46681/^6.11/0001.patch
+CVE-2024-47747/^6.11/0001.patch
+CVE-2024-50017/^6.11/0001.patch
+CVE-2024-50019/^6.12/0001.patch
+CVE-2024-50184/^6.11/0001.patch
+CVE-2024-50195/3.17-^6.12/0001.patch
+CVE-2024-50201/^6.12/0001.patch
+CVE-2024-50210/3.17-^6.6/0001.patch
+CVE-2024-50265/^6.12/0001.patch
+CVE-2024-50267/^6.12/0001.patch
+CVE-2024-50269/^6.12/0001.patch
+CVE-2024-50279/^6.12/0001.patch
+CVE-2024-50287/^6.12/0001.patch
+CVE-2024-50290/^6.12/0001.patch
+CVE-2024-50292/^6.12/0001.patch
+CVE-2024-50295/^6.12/0001.patch
+CVE-2024-50299/^6.12/0001.patch
+CVE-2024-50301/^6.12/0001.patch
+CVE-2024-52332/ANY/0002.patch
+CVE-2024-53045/^6.12/0001.patch
+CVE-2024-53101/^6.12/0001.patch
+CVE-2024-53103/^6.12/0001.patch
+CVE-2024-53112/^6.12/0001.patch
+CVE-2024-53127/^6.12/0001.patch
+CVE-2024-53140/^6.12/0001.patch
+CVE-2024-53141/^6.12/0001.patch
+CVE-2024-53156/ANY/0002.patch
+CVE-2024-53157/ANY/0002.patch
+CVE-2024-53165/ANY/0002.patch
+CVE-2024-53171/ANY/0001.patch
+CVE-2024-53172/ANY/0002.patch
+CVE-2024-53183/ANY/0002.patch
+CVE-2024-53190/ANY/0001.patch
+CVE-2024-53194/ANY/0002.patch
+CVE-2024-53214/ANY/0002.patch
+CVE-2024-53227/ANY/0002.patch
+CVE-2024-53239/ANY/0001.patch
+CVE-2024-53680/ANY/0002.patch
+CVE-2024-53690/ANY/0001.patch
+CVE-2024-56531/ANY/0002.patch
+CVE-2024-56532/ANY/0002.patch
+CVE-2024-56536/ANY/0001.patch
+CVE-2024-56539/ANY/0002.patch
+CVE-2024-56548/ANY/0002.patch
+CVE-2024-56570/ANY/0001.patch
+CVE-2024-56586/ANY/0001.patch
+CVE-2024-56587/ANY/0002.patch
+CVE-2024-56593/ANY/0001.patch
+CVE-2024-56595/ANY/0002.patch
+CVE-2024-56597/ANY/0002.patch
@@ -0,0 +1,215 @@
+CVE-2024-56600/ANY/0001.patch
+CVE-2024-56602/ANY/0001.patch
+CVE-2024-56603/ANY/0002.patch
+CVE-2024-56619/ANY/0002.patch
+CVE-2024-56629/ANY/0001.patch
+CVE-2024-56637/ANY/0002.patch
+CVE-2024-56643/ANY/0002.patch
+CVE-2024-56659/ANY/0002.patch
+CVE-2024-56670/ANY/0002.patch
+CVE-2024-56681/ANY/0001.patch
+CVE-2024-56687/ANY/0001.patch
+CVE-2024-56700/ANY/0002.patch
+CVE-2024-56739/ANY/0002.patch
+CVE-2024-56747/ANY/0001.patch
+CVE-2024-56767/ANY/0002.patch
+CVE-2024-56769/ANY/0002.patch
+CVE-2024-57802/ANY/0002.patch
+CVE-2024-57850/ANY/0002.patch
+CVE-2024-57893/ANY/0001.patch
+CVE-2024-57901/ANY/0001.patch
+CVE-2024-57902/ANY/0001.patch
+CVE-2024-57904/ANY/0001.patch
+CVE-2024-57908/ANY/0001.patch
+CVE-2024-57912/ANY/0001.patch
+CVE-2024-57929/ANY/0001.patch
+CVE-2024-57938/ANY/0002.patch
+CVE-2024-57948/ANY/0001.patch
+CVE-2024-57973/ANY/0001.patch
+CVE-2024-58001/ANY/0001.patch
+CVE-2024-58010/ANY/0001.patch
+CVE-2024-58055/ANY/0001.patch
+CVE-2024-58094/ANY/0001.patch
+CVE-2024-58095/ANY/0001.patch
+CVE-2025-21664/ANY/0001.patch
+CVE-2025-21689/ANY/0001.patch
+CVE-2025-21699/ANY/0001.patch
+CVE-2025-21704/ANY/0001.patch
+CVE-2025-21718/ANY/0001.patch
+CVE-2025-21735/ANY/0001.patch
+CVE-2025-21736/ANY/0001.patch
+CVE-2025-21744/ANY/0001.patch
+CVE-2025-21772/ANY/0001.patch
+CVE-2025-21776/ANY/0001.patch
+CVE-2025-21781/ANY/0001.patch
+CVE-2025-21782/ANY/0001.patch
+CVE-2025-21785/ANY/0001.patch
+CVE-2025-21791/ANY/0001.patch
+CVE-2025-21835/ANY/0001.patch
+CVE-2025-21877/ANY/0001.patch
+CVE-2025-21904/ANY/0001.patch
+CVE-2025-21910/ANY/0001.patch
+CVE-2025-21916/ANY/0001.patch
+CVE-2025-21928/ANY/0001.patch
+CVE-2025-21934/ANY/0001.patch
+CVE-2025-21935/ANY/0001.patch
+CVE-2025-21948/ANY/0001.patch
+CVE-2025-21993/ANY/0001.patch
+CVE-2025-21996/ANY/0001.patch
+CVE-2025-22007/ANY/0001.patch
+CVE-2025-22018/ANY/0001.patch
+CVE-2025-22063/ANY/0001.patch
+CVE-2025-22073/ANY/0001.patch
+CVE-2025-22079/ANY/0001.patch
+CVE-2025-22086/ANY/0001.patch
+CVE-2025-23150/ANY/0001.patch
+CVE-2025-23163/ANY/0001.patch
+CVE-2025-37738/ANY/0001.patch
+CVE-2025-37739/ANY/0001.patch
+CVE-2025-37740/ANY/0001.patch
+CVE-2025-37741/ANY/0001.patch
+CVE-2025-37749/ANY/0001.patch
+CVE-2025-37757/ANY/0001.patch
+CVE-2025-37758/ANY/0001.patch
+CVE-2025-37780/ANY/0001.patch
+CVE-2025-37781/ANY/0001.patch
+CVE-2025-37782/ANY/0001.patch
+CVE-2025-37796/ANY/0001.patch
+CVE-2025-37797/ANY/0001.patch
+CVE-2025-37798/ANY/0001.patch
+CVE-2025-37817/ANY/0001.patch
+CVE-2025-37823/ANY/0001.patch
+CVE-2025-37825/ANY/0001.patch
+CVE-2025-37833/ANY/0001.patch
+CVE-2025-37838/ANY/0001.patch
+CVE-2025-37841/ANY/0001.patch
+CVE-2025-37851/ANY/0001.patch
+CVE-2025-37857/ANY/0001.patch
+CVE-2025-37858/ANY/0001.patch
+CVE-2025-37892/ANY/0001.patch
+CVE-2025-37925/ANY/0001.patch
+CVE-2025-37937/ANY/0002.patch
+CVE-2025-37982/ANY/0001.patch
+CVE-2025-37983/ANY/0001.patch
+CVE-2025-37990/ANY/0001.patch
+CVE-2025-38046/ANY/0001.patch
+CVE-2025-38058/ANY/0001.patch
+CVE-2025-38061/ANY/0001.patch
+CVE-2025-38066/ANY/0001.patch
+CVE-2025-38075/ANY/0001.patch
+CVE-2025-38090/ANY/0001.patch
+CVE-2025-38114/ANY/0001.patch
+CVE-2025-38115/ANY/0001.patch
+CVE-2025-38147/ANY/0001.patch
+CVE-2025-38157/ANY/0001.patch
+CVE-2025-38163/ANY/0001.patch
+CVE-2025-38174/ANY/0001.patch
+CVE-2025-38177/ANY/0001.patch
+CVE-2025-38180/ANY/0001.patch
+CVE-2025-38181/ANY/0001.patch
+CVE-2025-38184/ANY/0001.patch
+CVE-2025-38185/ANY/0001.patch
+CVE-2025-38190/ANY/0001.patch
+CVE-2025-38194/ANY/0001.patch
+CVE-2025-38203/ANY/0001.patch
+CVE-2025-38212/ANY/0001.patch
+CVE-2025-38213/ANY/0001.patch
+CVE-2025-38219/ANY/0001.patch
+CVE-2025-38222/ANY/0001.patch
+CVE-2025-38245/ANY/0001.patch
+CVE-2025-38251/ANY/0001.patch
+CVE-2025-38265/ANY/0001.patch
+CVE-2025-38312/ANY/0001.patch
+CVE-2025-38320/ANY/0001.patch
+CVE-2025-38324/ANY/0001.patch
+CVE-2025-38328/ANY/0001.patch
+CVE-2025-38336/ANY/0001.patch
+CVE-2025-38344/ANY/0001.patch
+CVE-2025-38345/ANY/0001.patch
+CVE-2025-38348/ANY/0001.patch
+CVE-2025-38386/ANY/0001.patch
+CVE-2025-38403/ANY/0001.patch
+CVE-2025-38406/ANY/0001.patch
+CVE-2025-38416/ANY/0001.patch
+CVE-2025-38420/ANY/0001.patch
+CVE-2025-38428/ANY/0001.patch
+CVE-2025-38445/ANY/0001.patch
+CVE-2025-38448/ANY/0001.patch
+CVE-2025-38458/ANY/0001.patch
+CVE-2025-38459/ANY/0001.patch
+CVE-2025-38460/ANY/0001.patch
+CVE-2025-38467/ANY/0001.patch
+CVE-2025-38468/ANY/0001.patch
+CVE-2025-38470/ANY/0001.patch
+CVE-2025-38474/ANY/0001.patch
+CVE-2025-38513/ANY/0001.patch
+CVE-2025-38514/ANY/0001.patch
+CVE-2025-38538/ANY/0001.patch
+CVE-2025-38542/ANY/0001.patch
+CVE-2025-38544/ANY/0001.patch
+CVE-2025-38546/ANY/0001.patch
+CVE-2025-38555/ANY/0001.patch
+CVE-2025-38574/ANY/0001.patch
+CVE-2025-38578/ANY/0001.patch
+CVE-2025-38581/ANY/0001.patch
+CVE-2025-38604/ANY/0001.patch
+CVE-2025-38611/ANY/0001.patch
+CVE-2025-38612/ANY/0001.patch
+CVE-2025-38618/ANY/0001.patch
+CVE-2025-38639/ANY/0001.patch
+CVE-2025-38691/ANY/0001.patch
+CVE-2025-38693/ANY/0001.patch
+CVE-2025-38694/ANY/0001.patch
+CVE-2025-38697/ANY/0001.patch
+CVE-2025-38698/ANY/0001.patch
+CVE-2025-38699/ANY/0001.patch
+CVE-2025-38701/ANY/0001.patch
+CVE-2025-38708/ANY/0001.patch
+CVE-2025-38712/ANY/0001.patch
+CVE-2025-38713/ANY/0001.patch
+CVE-2025-38717/ANY/0001.patch
+CVE-2025-39676/ANY/0001.patch
+CVE-2025-39691/ANY/0001.patch
+CVE-2025-39710/ANY/0001.patch
+CVE-2025-39714/ANY/0001.patch
+CVE-2025-39743/ANY/0001.patch
+CVE-2025-39756/ANY/0001.patch
+CVE-2025-39782/ANY/0001.patch
+CVE-2025-39794/ANY/0001.patch
+CVE-2025-39796/ANY/0001.patch
+CVE-2025-39808/ANY/0001.patch
+CVE-2025-39812/ANY/0001.patch
+CVE-2025-39817/ANY/0001.patch
+CVE-2025-39839/ANY/0001.patch
+CVE-2025-39846/ANY/0001.patch
+CVE-2025-39848/ANY/0001.patch
+CVE-2025-39885/ANY/0001.patch
+CVE-2025-39889/ANY/0001.patch
+CVE-2025-39898/ANY/0001.patch
+CVE-2025-39903/ANY/0001.patch
+CVE-2025-39913/ANY/0001.patch
+CVE-2025-39920/ANY/0001.patch
+CVE-2025-39945/ANY/0001.patch
+CVE-2025-39964/ANY/0001.patch
+CVE-2025-39967/ANY/0001.patch
+CVE-2025-39973/ANY/0001.patch
+CVE-2025-39996/ANY/0001.patch
+CVE-2025-40011/ANY/0001.patch
+CVE-2025-40020/ANY/0001.patch
+CVE-2025-40022/ANY/0001.patch
+CVE-2025-40028/ANY/0001.patch
+CVE-2025-40030/ANY/0001.patch
+CVE-2025-40035/ANY/0001.patch
+CVE-2025-40044/ANY/0001.patch
+CVE-2025-40049/ANY/0001.patch
+CVE-2025-40055/ANY/0001.patch
+CVE-2025-40082/ANY/0001.patch
+CVE-2019-12819/4.14/0006.patch
+CVE-2021-47472/4.14/0003.patch
+CVE-2023-53129/ANY/0001.patch
+CVE-2023-53626/ANY/0001.patch
+CVE-2024-26720/4.14/0009.patch
+CVE-2024-39501/4.14/0009.patch
+CVE-2024-42102/4.14/0009.patch
+CVE-2024-50195/3.17-^6.12/0001.patch
+CVE-2024-50210/3.17-^6.6/0001.patch
@@ -0,0 +1,429 @@
+0003-syzkaller-Misc/ANY/0008.patch
+CVE-2015-7837/ANY/0001.patch
+CVE-2016-3695/ANY/0001.patch
+CVE-2017-5754/^4.19/0157.patch
+CVE-2017-18232/4.14/0002.patch
+CVE-2018-5897/ANY/0001.patch
+CVE-2018-9415/ANY/0005.patch
+CVE-2018-20855/^4.18/0001.patch
+CVE-2019-3874/^5.1/0002.patch
+CVE-2019-9444/ANY/0001.patch
+CVE-2019-10520/ANY/0001.patch
+CVE-2019-11191/^5.0/0001.patch
+CVE-2019-12378/^5.1.5/0001.patch
+CVE-2019-12455/^5.2/0001.patch
+CVE-2019-12456/^5.1.5/0002.patch
+CVE-2019-15291/4.14/0004.patch
+CVE-2019-16921/^4.16/0001.patch
+CVE-2019-18786/4.14/0002.patch
+CVE-2019-19051/4.14/0008.patch
+CVE-2019-19068/4.14/0002.patch
+CVE-2019-19602/^5.4/0001.patch
+CVE-2019-20908/^5.2/0001.patch
+CVE-2020-0255/^5.6/0001.patch
+CVE-2020-8832/^4.14/0001.patch
+CVE-2020-15780/^5.8/0001.patch
+CVE-2020-16119/^5.10/0002.patch
+CVE-2020-BleedingToothExtras/^5.10/0001.patch
+CVE-2021-3493/^5.10/0001.patch
+CVE-2021-28039/^5.11/0001.patch
+CVE-2021-28950/4.14/0002.patch
+CVE-2021-29154/^5.12/0002.patch
+CVE-2021-30337/4.14/0018.patch
+CVE-2021-46912/^5.12/0001.patch
+CVE-2021-46958/^5.12/0001.patch
+CVE-2021-46999/^5.12/0001.patch
+CVE-2021-47010/^5.12/0001.patch
+CVE-2021-47058/^5.12/0001.patch
+CVE-2021-47173/4.14/0003.patch
+CVE-2021-47234/^5.13/0001.patch
+CVE-2021-47266/^5.13/0001.patch
+CVE-2021-47346/^5.13/0001.patch
+CVE-2021-47430/^5.15/0001.patch
+CVE-2021-47472/4.14/0003.patch
+CVE-2021-47583/^5.15/0001.patch
+CVE-2021-47616/^5.16/0001.patch
+CVE-2021-47618/^5.16/0001.patch
+CVE-2021-47636/ANY/0001.patch
+CVE-2022-3061/^5.18/0001.patch
+CVE-2022-3903/^6.0/0001.patch
+CVE-2022-4382/^6.2/0001.patch
+CVE-2022-21546/ANY/0001.patch
+CVE-2022-27950/^5.16/0001.patch
+CVE-2022-48674/^6.0/0001.patch
+CVE-2022-48713/^5.17/0001.patch
+CVE-2022-48781/^5.17/0001.patch
+CVE-2022-48785/^5.17/0001.patch
+CVE-2022-48966/4.14/0002.patch
+CVE-2022-49034/ANY/0002.patch
+CVE-2022-49061/4.14/0002.patch
+CVE-2022-49073/ANY/0001.patch
+CVE-2022-49078/ANY/0001.patch
+CVE-2022-49146/ANY/0001.patch
+CVE-2022-49194/ANY/0001.patch
+CVE-2022-49205/ANY/0001.patch
+CVE-2022-49209/ANY/0001.patch
+CVE-2022-49285/ANY/0001.patch
+CVE-2022-49318/ANY/0001.patch
+CVE-2022-49363/ANY/0001.patch
+CVE-2022-49364/ANY/0001.patch
+CVE-2022-49380/ANY/0001.patch
+CVE-2022-49425/ANY/0001.patch
+CVE-2022-49428/ANY/0001.patch
+CVE-2022-49433/ANY/0001.patch
+CVE-2022-49500/ANY/0001.patch
+CVE-2022-49513/ANY/0001.patch
+CVE-2022-49563/ANY/0001.patch
+CVE-2022-49564/ANY/0001.patch
+CVE-2022-49566/ANY/0001.patch
+CVE-2022-49642/ANY/0001.patch
+CVE-2022-49705/ANY/0001.patch
+CVE-2022-49710/ANY/0001.patch
+CVE-2022-49777/ANY/0001.patch
+CVE-2022-49779/ANY/0001.patch
+CVE-2022-49784/ANY/0001.patch
+CVE-2022-49823/ANY/0001.patch
+CVE-2022-49824/ANY/0001.patch
+CVE-2022-49825/ANY/0001.patch
+CVE-2022-49839/ANY/0001.patch
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
+CVE-2022-50248/ANY/0001.patch
+CVE-2022-50273/ANY/0001.patch
+CVE-2022-50326/ANY/0001.patch
+CVE-2022-50358/ANY/0001.patch
+CVE-2022-50364/ANY/0001.patch
+CVE-2022-50397/ANY/0001.patch
+CVE-2022-50473/ANY/0001.patch
+CVE-2022-50522/4.14/0003.patch
+CVE-2022-50537/ANY/0001.patch
+CVE-2023-1989/4.14/0003.patch
+CVE-2023-21657/4.14/0005.patch
+CVE-2023-23000/^5.16/0001.patch
+CVE-2023-28554/ANY/0002.patch
+CVE-2023-33070/ANY/0001.patch
+CVE-2023-52523/^6.6/0001.patch
+CVE-2023-52595/^6.6/0001.patch
+CVE-2023-52604/4.14/0009.patch
+CVE-2023-52746/^6.2/0001.patch
+CVE-2023-52884/^6.5/0001.patch
+CVE-2023-52979/4.14/0003.patch
+CVE-2023-53001/ANY/0001.patch
+CVE-2023-53016/ANY/0001.patch
+CVE-2023-53098/ANY/0001.patch
+CVE-2023-53125/4.14/0003.patch
+CVE-2023-53131/ANY/0001.patch
+CVE-2023-53137/ANY/0001.patch
+CVE-2023-53214/ANY/0001.patch
+CVE-2023-53227/4.14/0003.patch
+CVE-2023-53250/ANY/0001.patch
+CVE-2023-53259/ANY/0002.patch
+CVE-2023-53265/4.14/0003.patch
+CVE-2023-53288/ANY/0001.patch
+CVE-2023-53312/ANY/0001.patch
+CVE-2023-53436/4.14/0003.patch
+CVE-2023-53443/ANY/0001.patch
+CVE-2023-53487/ANY/0002.patch
+CVE-2023-53537/ANY/0001.patch
+CVE-2023-53599/ANY/0001.patch
+CVE-2023-53641/ANY/0001.patch
+CVE-2023-53693/ANY/0001.patch
+CVE-2023-53695/ANY/0001.patch
+CVE-2023-53712/ANY/0001.patch
+CVE-2023-53719/ANY/0001.patch
+CVE-2024-26645/^6.8/0001.patch
+CVE-2024-26720/4.14/0009.patch
+CVE-2024-26760/^6.8/0001.patch
+CVE-2024-26920/4.14/0009.patch
+CVE-2024-26961/^6.7/0001.patch
+CVE-2024-26972/^6.8/0001.patch
+CVE-2024-27009/^6.9/0001.patch
+CVE-2024-27033/^6.8/0001.patch
+CVE-2024-27393/^6.9/0001.patch
+CVE-2024-33032/ANY/0002.patch
+CVE-2024-34027/^6.9/0001.patch
+CVE-2024-35812/4.14/0009.patch
+CVE-2024-35824/^6.8/0001.patch
+CVE-2024-35879/^6.9/0001.patch
+CVE-2024-35933/4.14/0008.patch
+CVE-2024-35950/^6.9/0001.patch
+CVE-2024-35954/^6.9/0001.patch
+CVE-2024-35962/^6.9/0001.patch
+CVE-2024-40996/^6.10/0001.patch
+CVE-2024-41041/^6.10/0001.patch
+CVE-2024-42077/^6.10/0001.patch
+CVE-2024-42102/4.14/0009.patch
+CVE-2024-42296/^6.10/0001.patch
+CVE-2024-43894/^6.11/0001.patch
+CVE-2024-44938/^6.9/0001.patch
+CVE-2024-44939/^6.9/0001.patch
+CVE-2024-44952/4.14/0008.patch
+CVE-2024-46681/^6.11/0001.patch
+CVE-2024-47747/^6.11/0001.patch
+CVE-2024-50017/^6.11/0001.patch
+CVE-2024-50019/^6.12/0001.patch
+CVE-2024-50184/^6.11/0001.patch
+CVE-2024-50195/3.17-^6.12/0001.patch
+CVE-2024-50201/^6.12/0001.patch
+CVE-2024-50210/3.17-^6.6/0001.patch
+CVE-2024-50265/^6.12/0001.patch
+CVE-2024-50267/^6.12/0001.patch
+CVE-2024-50269/^6.12/0001.patch
+CVE-2024-50279/^6.12/0001.patch
+CVE-2024-50287/^6.12/0001.patch
+CVE-2024-50290/^6.12/0001.patch
+CVE-2024-50292/^6.12/0001.patch
+CVE-2024-50295/^6.12/0001.patch
+CVE-2024-50299/^6.12/0001.patch
+CVE-2024-50301/^6.12/0001.patch
+CVE-2024-52332/ANY/0002.patch
+CVE-2024-53045/^6.12/0001.patch
+CVE-2024-53101/^6.12/0001.patch
+CVE-2024-53103/^6.12/0001.patch
+CVE-2024-53112/^6.12/0001.patch
+CVE-2024-53127/^6.12/0001.patch
+CVE-2024-53140/^6.12/0001.patch
+CVE-2024-53141/^6.12/0001.patch
+CVE-2024-53156/ANY/0002.patch
+CVE-2024-53157/ANY/0002.patch
+CVE-2024-53165/ANY/0002.patch
+CVE-2024-53171/ANY/0001.patch
+CVE-2024-53172/ANY/0002.patch
+CVE-2024-53183/ANY/0002.patch
+CVE-2024-53190/ANY/0001.patch
+CVE-2024-53194/ANY/0002.patch
+CVE-2024-53214/ANY/0002.patch
+CVE-2024-53227/ANY/0002.patch
+CVE-2024-53239/ANY/0001.patch
+CVE-2024-53680/ANY/0002.patch
+CVE-2024-53690/ANY/0001.patch
+CVE-2024-56531/ANY/0002.patch
+CVE-2024-56532/ANY/0002.patch
+CVE-2024-56536/ANY/0001.patch
+CVE-2024-56539/ANY/0002.patch
+CVE-2024-56548/ANY/0002.patch
+CVE-2024-56570/ANY/0001.patch
+CVE-2024-56586/ANY/0001.patch
+CVE-2024-56587/ANY/0002.patch
+CVE-2024-56593/ANY/0001.patch
+CVE-2024-56595/ANY/0002.patch
+CVE-2024-56597/ANY/0002.patch
+CVE-2024-56600/ANY/0001.patch
+CVE-2024-56602/ANY/0001.patch
+CVE-2024-56603/ANY/0002.patch
+CVE-2024-56619/ANY/0002.patch
+CVE-2024-56629/ANY/0001.patch
+CVE-2024-56637/ANY/0002.patch
+CVE-2024-56643/ANY/0002.patch
+CVE-2024-56659/ANY/0002.patch
+CVE-2024-56670/ANY/0002.patch
+CVE-2024-56681/ANY/0001.patch
+CVE-2024-56687/ANY/0001.patch
+CVE-2024-56700/ANY/0002.patch
+CVE-2024-56739/ANY/0002.patch
+CVE-2024-56747/ANY/0001.patch
+CVE-2024-56767/ANY/0002.patch
+CVE-2024-56769/ANY/0002.patch
+CVE-2024-57802/ANY/0002.patch
+CVE-2024-57850/ANY/0002.patch
+CVE-2024-57893/ANY/0001.patch
+CVE-2024-57901/ANY/0001.patch
+CVE-2024-57902/ANY/0001.patch
+CVE-2024-57904/ANY/0001.patch
+CVE-2024-57908/ANY/0001.patch
+CVE-2024-57912/ANY/0001.patch
+CVE-2024-57929/ANY/0001.patch
+CVE-2024-57938/ANY/0002.patch
+CVE-2024-57948/ANY/0001.patch
+CVE-2024-57973/ANY/0001.patch
+CVE-2024-58001/ANY/0001.patch
+CVE-2024-58010/ANY/0001.patch
+CVE-2024-58055/ANY/0001.patch
+CVE-2024-58094/ANY/0001.patch
+CVE-2024-58095/ANY/0001.patch
+CVE-2025-21664/ANY/0001.patch
+CVE-2025-21689/ANY/0001.patch
+CVE-2025-21699/ANY/0001.patch
+CVE-2025-21704/ANY/0001.patch
+CVE-2025-21718/ANY/0001.patch
+CVE-2025-21735/ANY/0001.patch
+CVE-2025-21736/ANY/0001.patch
+CVE-2025-21744/ANY/0001.patch
+CVE-2025-21772/ANY/0001.patch
+CVE-2025-21776/ANY/0001.patch
+CVE-2025-21781/ANY/0001.patch
+CVE-2025-21782/ANY/0001.patch
+CVE-2025-21785/ANY/0001.patch
+CVE-2025-21791/ANY/0001.patch
+CVE-2025-21835/ANY/0001.patch
+CVE-2025-21877/ANY/0001.patch
+CVE-2025-21904/ANY/0001.patch
+CVE-2025-21910/ANY/0001.patch
+CVE-2025-21916/ANY/0001.patch
+CVE-2025-21928/ANY/0001.patch
+CVE-2025-21934/ANY/0001.patch
+CVE-2025-21935/ANY/0001.patch
+CVE-2025-21948/ANY/0001.patch
+CVE-2025-21993/ANY/0001.patch
+CVE-2025-21996/ANY/0001.patch
+CVE-2025-22007/ANY/0001.patch
+CVE-2025-22018/ANY/0001.patch
+CVE-2025-22063/ANY/0001.patch
+CVE-2025-22073/ANY/0001.patch
+CVE-2025-22079/ANY/0001.patch
+CVE-2025-22086/ANY/0001.patch
+CVE-2025-23150/ANY/0001.patch
+CVE-2025-23163/ANY/0001.patch
+CVE-2025-37738/ANY/0001.patch
+CVE-2025-37739/ANY/0001.patch
+CVE-2025-37740/ANY/0001.patch
+CVE-2025-37741/ANY/0001.patch
+CVE-2025-37749/ANY/0001.patch
+CVE-2025-37757/ANY/0001.patch
+CVE-2025-37758/ANY/0001.patch
+CVE-2025-37780/ANY/0001.patch
+CVE-2025-37781/ANY/0001.patch
+CVE-2025-37782/ANY/0001.patch
+CVE-2025-37796/ANY/0001.patch
+CVE-2025-37797/ANY/0001.patch
+CVE-2025-37798/ANY/0001.patch
+CVE-2025-37817/ANY/0001.patch
+CVE-2025-37823/ANY/0001.patch
+CVE-2025-37825/ANY/0001.patch
+CVE-2025-37833/ANY/0001.patch
+CVE-2025-37838/ANY/0001.patch
+CVE-2025-37841/ANY/0001.patch
+CVE-2025-37851/ANY/0001.patch
+CVE-2025-37857/ANY/0001.patch
+CVE-2025-37858/ANY/0001.patch
+CVE-2025-37892/ANY/0001.patch
+CVE-2025-37925/ANY/0001.patch
+CVE-2025-37937/ANY/0002.patch
+CVE-2025-37982/ANY/0001.patch
+CVE-2025-37983/ANY/0001.patch
+CVE-2025-37990/ANY/0001.patch
+CVE-2025-38046/ANY/0001.patch
+CVE-2025-38058/ANY/0001.patch
+CVE-2025-38061/ANY/0001.patch
+CVE-2025-38066/ANY/0001.patch
+CVE-2025-38075/ANY/0001.patch
+CVE-2025-38090/ANY/0001.patch
+CVE-2025-38114/ANY/0001.patch
+CVE-2025-38115/ANY/0001.patch
+CVE-2025-38147/ANY/0001.patch
+CVE-2025-38157/ANY/0001.patch
+CVE-2025-38163/ANY/0001.patch
+CVE-2025-38174/ANY/0001.patch
+CVE-2025-38177/ANY/0001.patch
+CVE-2025-38180/ANY/0001.patch
+CVE-2025-38181/ANY/0001.patch
+CVE-2025-38184/ANY/0001.patch
+CVE-2025-38185/ANY/0001.patch
+CVE-2025-38190/ANY/0001.patch
+CVE-2025-38194/ANY/0001.patch
+CVE-2025-38203/ANY/0001.patch
+CVE-2025-38212/ANY/0001.patch
+CVE-2025-38213/ANY/0001.patch
+CVE-2025-38219/ANY/0001.patch
+CVE-2025-38222/ANY/0001.patch
+CVE-2025-38245/ANY/0001.patch
+CVE-2025-38251/ANY/0001.patch
+CVE-2025-38265/ANY/0001.patch
+CVE-2025-38312/ANY/0001.patch
+CVE-2025-38320/ANY/0001.patch
+CVE-2025-38324/ANY/0001.patch
+CVE-2025-38328/ANY/0001.patch
+CVE-2025-38336/ANY/0001.patch
+CVE-2025-38344/ANY/0001.patch
+CVE-2025-38345/ANY/0001.patch
+CVE-2025-38348/ANY/0001.patch
+CVE-2025-38386/ANY/0001.patch
+CVE-2025-38403/ANY/0001.patch
+CVE-2025-38406/ANY/0001.patch
+CVE-2025-38416/ANY/0001.patch
+CVE-2025-38420/ANY/0001.patch
+CVE-2025-38428/ANY/0001.patch
+CVE-2025-38445/ANY/0001.patch
+CVE-2025-38448/ANY/0001.patch
+CVE-2025-38458/ANY/0001.patch
+CVE-2025-38459/ANY/0001.patch
+CVE-2025-38460/ANY/0001.patch
+CVE-2025-38467/ANY/0001.patch
+CVE-2025-38468/ANY/0001.patch
+CVE-2025-38470/ANY/0001.patch
+CVE-2025-38474/ANY/0001.patch
+CVE-2025-38513/ANY/0001.patch
+CVE-2025-38514/ANY/0001.patch
+CVE-2025-38538/ANY/0001.patch
+CVE-2025-38542/ANY/0001.patch
+CVE-2025-38544/ANY/0001.patch
+CVE-2025-38546/ANY/0001.patch
+CVE-2025-38555/ANY/0001.patch
+CVE-2025-38574/ANY/0001.patch
+CVE-2025-38578/ANY/0001.patch
+CVE-2025-38581/ANY/0001.patch
+CVE-2025-38604/ANY/0001.patch
+CVE-2025-38611/ANY/0001.patch
+CVE-2025-38612/ANY/0001.patch
+CVE-2025-38618/ANY/0001.patch
+CVE-2025-38639/ANY/0001.patch
+CVE-2025-38691/ANY/0001.patch
+CVE-2025-38693/ANY/0001.patch
+CVE-2025-38694/ANY/0001.patch
+CVE-2025-38697/ANY/0001.patch
+CVE-2025-38698/ANY/0001.patch
+CVE-2025-38699/ANY/0001.patch
+CVE-2025-38701/ANY/0001.patch
+CVE-2025-38708/ANY/0001.patch
+CVE-2025-38712/ANY/0001.patch
+CVE-2025-38713/ANY/0001.patch
+CVE-2025-38717/ANY/0001.patch
+CVE-2025-39676/ANY/0001.patch
+CVE-2025-39691/ANY/0001.patch
+CVE-2025-39710/ANY/0001.patch
+CVE-2025-39714/ANY/0001.patch
+CVE-2025-39743/ANY/0001.patch
+CVE-2025-39756/ANY/0001.patch
+CVE-2025-39782/ANY/0001.patch
+CVE-2025-39794/ANY/0001.patch
+CVE-2025-39796/ANY/0001.patch
+CVE-2025-39808/ANY/0001.patch
+CVE-2025-39812/ANY/0001.patch
+CVE-2025-39817/ANY/0001.patch
+CVE-2025-39839/ANY/0001.patch
+CVE-2025-39846/ANY/0001.patch
+CVE-2025-39848/ANY/0001.patch
+CVE-2025-39885/ANY/0001.patch
+CVE-2025-39889/ANY/0001.patch
+CVE-2025-39898/ANY/0001.patch
+CVE-2025-39903/ANY/0001.patch
+CVE-2025-39913/ANY/0001.patch
+CVE-2025-39920/ANY/0001.patch
+CVE-2025-39945/ANY/0001.patch
+CVE-2025-39964/ANY/0001.patch
+CVE-2025-39967/ANY/0001.patch
+CVE-2025-39973/ANY/0001.patch
+CVE-2025-39996/ANY/0001.patch
+CVE-2025-40011/ANY/0001.patch
+CVE-2025-40020/ANY/0001.patch
+CVE-2025-40022/ANY/0001.patch
+CVE-2025-40028/ANY/0001.patch
+CVE-2025-40030/ANY/0001.patch
+CVE-2025-40035/ANY/0001.patch
+CVE-2025-40044/ANY/0001.patch
+CVE-2025-40049/ANY/0001.patch
+CVE-2025-40055/ANY/0001.patch
+CVE-2025-40082/ANY/0001.patch
+CVE-2019-12819/4.14/0006.patch
+CVE-2021-47472/4.14/0003.patch
+CVE-2023-53129/ANY/0001.patch
+CVE-2023-53626/ANY/0001.patch
+CVE-2024-26720/4.14/0009.patch
+CVE-2024-39501/4.14/0009.patch
+CVE-2024-42102/4.14/0009.patch
+CVE-2024-50195/3.17-^6.12/0001.patch
+CVE-2024-50210/3.17-^6.6/0001.patch
@@ -0,0 +1,38 @@
+# relative to AXP kernel_patches
+# LAB 2026-10-01: alone ⇒ Google-logo hang (udc_lock recursive deadlock on
+# msm-4.14; needs lock-scope companion, not one-liner). Do not re-apply.
+CVE-2022-49980/ANY/0001.patch
+CVE-2017-15832/qcacld-3.0/0001.patch
+CVE-2021-29648/^5.11/0001.patch
+CVE-2022-33246/audio-kernel/0002.patch
+CVE-2022-49545/ANY/0001.patch
+CVE-2022-49552/ANY/0001.patch
+CVE-2022-49801/ANY/0001.patch
+CVE-2022-50421/ANY/0001.patch
+CVE-2023-33064/audio-kernel/0001.patch
+CVE-2023-33065/audio-kernel/0001.patch
+CVE-2023-43528/audio-kernel/0001.patch
+CVE-2023-52741/^6.2/0001.patch
+CVE-2023-53103/ANY/0001.patch
+CVE-2023-53660/ANY/0001.patch
+CVE-2024-21459/qca-wifi-host-cmn/0001.patch
+CVE-2024-38564/^6.9/0001.patch
+CVE-2024-56553/ANY/0001.patch
+CVE-2024-56554/ANY/0001.patch
+CVE-2024-56692/ANY/0001.patch
+CVE-2024-56780/ANY/0001.patch
+CVE-2025-21629/ANY/0001.patch
+CVE-2025-21653/ANY/0001.patch
+CVE-2025-21762/ANY/0001.patch
+CVE-2025-21764/ANY/0001.patch
+CVE-2025-21765/ANY/0001.patch
+CVE-2025-21859/ANY/0001.patch
+CVE-2025-21954/ANY/0001.patch
+CVE-2025-22035/ANY/0001.patch
+CVE-2025-37785/ANY/0001.patch
+CVE-2025-37960/ANY/0001.patch
+CVE-2025-38099/ANY/0001.patch
+CVE-2025-38253/ANY/0001.patch
+CVE-2025-38677/ANY/0001.patch
+CVE-2025-39770/ANY/0001.patch
+CVE-2025-39813/ANY/0001.patch
@@ -0,0 +1,9 @@
+# High-offset sunfish batch1 (fuzz=0 spot-checked). Applied with CVE_MAX_ABS_OFFSET=9999
+# after cve-clean-offset. Dropped CVE-2023-3777: nft_chain_is_bound missing on 4.14.
+CVE-2020-29372/^5.7/0001.patch
+CVE-2021-47209/^5.15/0001.patch
+CVE-2022-50246/ANY/0001.patch
+CVE-2023-53669/ANY/0001.patch
+CVE-2024-40954/^6.10/0001.patch
+CVE-2024-50186/^6.12/0001.patch
+CVE-2024-43879/^6.10/0001.patch
@@ -0,0 +1,10 @@
+# High-offset sunfish batch2 (after batch1 BOOT_OK #48). Elevated CVE_MAX_ABS_OFFSET=9999.
+# Prefer mm/sched/sysctl/f2fs/wifi/driver-core; skip nf_tables-style (missing helpers).
+CVE-2022-49641/ANY/0001.patch
+CVE-2023-52707/^6.2/0001.patch
+CVE-2023-53594/ANY/0001.patch
+CVE-2023-53709/ANY/0001.patch
+CVE-2024-40917/^6.10/0001.patch
+CVE-2024-56569/ANY/0001.patch
+CVE-2025-21909/ANY/0001.patch
+CVE-2025-38218/ANY/0001.patch
@@ -0,0 +1,11 @@
+# High-offset sunfish batch3 — remaining KEEP after batch1+2 BOOT_OK #49.
+# Skip CVE-2023-3777 / CVE-2024-26643 (nf_tables helpers missing on 4.14).
+CVE-2021-47299/^5.13/0001.patch
+CVE-2022-49341/ANY/0001.patch
+CVE-2022-49412/ANY/0001.patch
+CVE-2023-52676/^6.7/0001.patch
+CVE-2024-46754/^6.10/0001.patch
+CVE-2025-37923/ANY/0001.patch
+CVE-2025-38285/ANY/0001.patch
+CVE-2025-39751/ANY/0001.patch
+CVE-2025-40078/ANY/0001.patch
@@ -0,0 +1,73 @@
+CVE-2020-29372/^5.7/0001.patch
+CVE-2021-47209/^5.15/0001.patch
+CVE-2021-47299/^5.13/0001.patch
+CVE-2022-48825/^5.17/0001.patch
+CVE-2022-48969/^6.1/0001.patch
+CVE-2022-49086/ANY/0001.patch
+CVE-2022-49341/ANY/0001.patch
+CVE-2022-49412/ANY/0001.patch
+CVE-2022-49641/ANY/0001.patch
+CVE-2022-49687/ANY/0001.patch
+CVE-2022-49695/ANY/0001.patch
+CVE-2022-49715/ANY/0001.patch
+CVE-2022-50246/ANY/0001.patch
+CVE-2022-50304/ANY/0001.patch
+CVE-2023-3777/^6.5/0001.patch
+CVE-2023-52486/^6.7/0001.patch
+CVE-2023-52676/^6.7/0001.patch
+CVE-2023-52707/^6.2/0001.patch
+CVE-2023-52847/^6.6/0001.patch
+CVE-2023-53594/ANY/0001.patch
+CVE-2023-53669/ANY/0001.patch
+CVE-2023-53709/ANY/0001.patch
+CVE-2024-2201/^6.9/0001.patch
+CVE-2024-24855/^6.4/0001.patch
+CVE-2024-26643/^6.8/0001.patch
+CVE-2024-26900/^6.8/0001.patch
+CVE-2024-39296/^6.9/0001.patch
+CVE-2024-40917/^6.10/0001.patch
+CVE-2024-40923/^6.10/0001.patch
+CVE-2024-40954/^6.10/0001.patch
+CVE-2024-41014/^6.10/0001.patch
+CVE-2024-43879/^6.10/0001.patch
+CVE-2024-46754/^6.10/0001.patch
+CVE-2024-46830/^6.11/0001.patch
+CVE-2024-50186/^6.12/0001.patch
+CVE-2024-50273/^6.11/0001.patch
+CVE-2024-53066/^6.12/0001.patch
+CVE-2024-53173/ANY/0002.patch
+CVE-2024-53217/ANY/0002.patch
+CVE-2024-53240/ANY/0001.patch
+CVE-2024-56558/ANY/0001.patch
+CVE-2024-56569/ANY/0001.patch
+CVE-2024-56596/ANY/0002.patch
+CVE-2024-56598/ANY/0002.patch
+CVE-2024-56605/ANY/0002.patch
+CVE-2024-56779/ANY/0002.patch
+CVE-2024-57849/ANY/0002.patch
+CVE-2024-58009/ANY/0001.patch
+CVE-2024-58083/ANY/0001.patch
+CVE-2025-21671/ANY/0001.patch
+CVE-2025-21909/ANY/0001.patch
+CVE-2025-37789/ANY/0001.patch
+CVE-2025-37795/ANY/0001.patch
+CVE-2025-37839/ANY/0001.patch
+CVE-2025-37923/ANY/0001.patch
+CVE-2025-37932/ANY/0001.patch
+CVE-2025-38034/ANY/0001.patch
+CVE-2025-38044/ANY/0001.patch
+CVE-2025-38200/ANY/0001.patch
+CVE-2025-38204/ANY/0001.patch
+CVE-2025-38218/ANY/0001.patch
+CVE-2025-38285/ANY/0001.patch
+CVE-2025-38473/ANY/0001.patch
+CVE-2025-38495/ANY/0001.patch
+CVE-2025-38498/ANY/0002.patch
+CVE-2025-39742/ANY/0001.patch
+CVE-2025-39751/ANY/0001.patch
+CVE-2025-39824/ANY/0001.patch
+CVE-2025-39847/ANY/0001.patch
+CVE-2025-39874/ANY/0001.patch
+CVE-2025-39998/ANY/0001.patch
+CVE-2025-40078/ANY/0001.patch
+CVE-2025-40080/ANY/0001.patch
@@ -0,0 +1,26 @@
+CVE-2020-29372/^5.7/0001.patch
+CVE-2021-47209/^5.15/0001.patch
+CVE-2021-47299/^5.13/0001.patch
+CVE-2022-49341/ANY/0001.patch
+CVE-2022-49412/ANY/0001.patch
+CVE-2022-49641/ANY/0001.patch
+CVE-2022-50246/ANY/0001.patch
+CVE-2023-3777/^6.5/0001.patch
+CVE-2023-52676/^6.7/0001.patch
+CVE-2023-52707/^6.2/0001.patch
+CVE-2023-53594/ANY/0001.patch
+CVE-2023-53669/ANY/0001.patch
+CVE-2023-53709/ANY/0001.patch
+CVE-2024-26643/^6.8/0001.patch
+CVE-2024-40917/^6.10/0001.patch
+CVE-2024-40954/^6.10/0001.patch
+CVE-2024-43879/^6.10/0001.patch
+CVE-2024-46754/^6.10/0001.patch
+CVE-2024-50186/^6.12/0001.patch
+CVE-2024-56569/ANY/0001.patch
+CVE-2025-21909/ANY/0001.patch
+CVE-2025-37923/ANY/0001.patch
+CVE-2025-38218/ANY/0001.patch
+CVE-2025-38285/ANY/0001.patch
+CVE-2025-39751/ANY/0001.patch
+CVE-2025-40078/ANY/0001.patch
@@ -0,0 +1,47 @@
+CVE-2022-48825/^5.17/0001.patch  # no_live_path_match
+CVE-2022-48969/^6.1/0001.patch  # deadnet
+CVE-2022-49086/ANY/0001.patch  # deadnet
+CVE-2022-49687/ANY/0001.patch  # deadnet
+CVE-2022-49695/ANY/0001.patch  # deadnet
+CVE-2022-49715/ANY/0001.patch  # no_live_path_match
+CVE-2022-50304/ANY/0001.patch  # no_live_path_match
+CVE-2023-52486/^6.7/0001.patch  # no_live_path_match
+CVE-2023-52847/^6.6/0001.patch  # no_live_path_match
+CVE-2024-2201/^6.9/0001.patch  # offarch
+CVE-2024-24855/^6.4/0001.patch  # no_live_path_match
+CVE-2024-26900/^6.8/0001.patch  # no_live_path_match
+CVE-2024-39296/^6.9/0001.patch  # deadnet
+CVE-2024-40923/^6.10/0001.patch  # deadnet
+CVE-2024-41014/^6.10/0001.patch  # deadfs
+CVE-2024-46830/^6.11/0001.patch  # offarch
+CVE-2024-50273/^6.11/0001.patch  # deadfs
+CVE-2024-53066/^6.12/0001.patch  # deadfs
+CVE-2024-53173/ANY/0002.patch  # deadfs
+CVE-2024-53217/ANY/0002.patch  # deadfs
+CVE-2024-53240/ANY/0001.patch  # deadnet
+CVE-2024-56558/ANY/0001.patch  # deadfs
+CVE-2024-56596/ANY/0002.patch  # no_live_path_match
+CVE-2024-56598/ANY/0002.patch  # no_live_path_match
+CVE-2024-56605/ANY/0002.patch  # no_live_path_match
+CVE-2024-56779/ANY/0002.patch  # deadfs
+CVE-2024-57849/ANY/0002.patch  # offarch
+CVE-2024-58009/ANY/0001.patch  # no_live_path_match
+CVE-2024-58083/ANY/0001.patch  # no_live_path_match
+CVE-2025-21671/ANY/0001.patch  # no_live_path_match
+CVE-2025-37789/ANY/0001.patch  # deadnet
+CVE-2025-37795/ANY/0001.patch  # no_live_path_match
+CVE-2025-37839/ANY/0001.patch  # no_live_path_match
+CVE-2025-37932/ANY/0001.patch  # no_live_path_match
+CVE-2025-38034/ANY/0001.patch  # no_live_path_match
+CVE-2025-38044/ANY/0001.patch  # no_live_path_match
+CVE-2025-38200/ANY/0001.patch  # no_live_path_match
+CVE-2025-38204/ANY/0001.patch  # no_live_path_match
+CVE-2025-38473/ANY/0001.patch  # no_live_path_match
+CVE-2025-38495/ANY/0001.patch  # no_live_path_match
+CVE-2025-38498/ANY/0002.patch  # no_live_path_match
+CVE-2025-39742/ANY/0001.patch  # no_live_path_match
+CVE-2025-39824/ANY/0001.patch  # no_live_path_match
+CVE-2025-39847/ANY/0001.patch  # no_live_path_match
+CVE-2025-39874/ANY/0001.patch  # no_live_path_match
+CVE-2025-39998/ANY/0001.patch  # no_live_path_match
+CVE-2025-40080/ANY/0001.patch  # no_live_path_match
@@ -0,0 +1,503 @@
+0003-syzkaller-Misc/ANY/0008.patch
+CVE-2015-7837/ANY/0001.patch
+CVE-2016-3695/ANY/0001.patch
+CVE-2017-5754/^4.19/0157.patch
+CVE-2017-18232/4.14/0002.patch
+CVE-2018-5897/ANY/0001.patch
+CVE-2018-9415/ANY/0005.patch
+CVE-2018-20855/^4.18/0001.patch
+CVE-2019-3874/^5.1/0002.patch
+CVE-2019-9444/ANY/0001.patch
+CVE-2019-10520/ANY/0001.patch
+CVE-2019-11191/^5.0/0001.patch
+CVE-2019-12378/^5.1.5/0001.patch
+CVE-2019-12455/^5.2/0001.patch
+CVE-2019-12456/^5.1.5/0002.patch
+CVE-2019-15291/4.14/0004.patch
+CVE-2019-16921/^4.16/0001.patch
+CVE-2019-18786/4.14/0002.patch
+CVE-2019-19051/4.14/0008.patch
+CVE-2019-19068/4.14/0002.patch
+CVE-2019-19602/^5.4/0001.patch
+CVE-2019-20908/^5.2/0001.patch
+CVE-2020-0255/^5.6/0001.patch
+CVE-2020-8832/^4.14/0001.patch
+CVE-2020-15780/^5.8/0001.patch
+CVE-2020-16119/^5.10/0002.patch
+CVE-2020-29372/^5.7/0001.patch
+CVE-2020-BleedingToothExtras/^5.10/0001.patch
+CVE-2021-3493/^5.10/0001.patch
+CVE-2021-28039/^5.11/0001.patch
+CVE-2021-28950/4.14/0002.patch
+CVE-2021-29154/^5.12/0002.patch
+CVE-2021-30337/4.14/0018.patch
+CVE-2021-46912/^5.12/0001.patch
+CVE-2021-46958/^5.12/0001.patch
+CVE-2021-46999/^5.12/0001.patch
+CVE-2021-47010/^5.12/0001.patch
+CVE-2021-47058/^5.12/0001.patch
+CVE-2021-47173/4.14/0003.patch
+CVE-2021-47209/^5.15/0001.patch
+CVE-2021-47234/^5.13/0001.patch
+CVE-2021-47266/^5.13/0001.patch
+CVE-2021-47299/^5.13/0001.patch
+CVE-2021-47346/^5.13/0001.patch
+CVE-2021-47430/^5.15/0001.patch
+CVE-2021-47472/4.14/0003.patch
+CVE-2021-47583/^5.15/0001.patch
+CVE-2021-47616/^5.16/0001.patch
+CVE-2021-47618/^5.16/0001.patch
+CVE-2021-47636/ANY/0001.patch
+CVE-2022-3061/^5.18/0001.patch
+CVE-2022-3903/^6.0/0001.patch
+CVE-2022-4382/^6.2/0001.patch
+CVE-2022-21546/ANY/0001.patch
+CVE-2022-27950/^5.16/0001.patch
+CVE-2022-48674/^6.0/0001.patch
+CVE-2022-48713/^5.17/0001.patch
+CVE-2022-48781/^5.17/0001.patch
+CVE-2022-48785/^5.17/0001.patch
+CVE-2022-48825/^5.17/0001.patch
+CVE-2022-48966/4.14/0002.patch
+CVE-2022-48969/^6.1/0001.patch
+CVE-2022-49034/ANY/0002.patch
+CVE-2022-49061/4.14/0002.patch
+CVE-2022-49073/ANY/0001.patch
+CVE-2022-49078/ANY/0001.patch
+CVE-2022-49086/ANY/0001.patch
+CVE-2022-49146/ANY/0001.patch
+CVE-2022-49194/ANY/0001.patch
+CVE-2022-49205/ANY/0001.patch
+CVE-2022-49209/ANY/0001.patch
+CVE-2022-49285/ANY/0001.patch
+CVE-2022-49318/ANY/0001.patch
+CVE-2022-49341/ANY/0001.patch
+CVE-2022-49363/ANY/0001.patch
+CVE-2022-49364/ANY/0001.patch
+CVE-2022-49380/ANY/0001.patch
+CVE-2022-49412/ANY/0001.patch
+CVE-2022-49425/ANY/0001.patch
+CVE-2022-49428/ANY/0001.patch
+CVE-2022-49433/ANY/0001.patch
+CVE-2022-49500/ANY/0001.patch
+CVE-2022-49513/ANY/0001.patch
+CVE-2022-49563/ANY/0001.patch
+CVE-2022-49564/ANY/0001.patch
+CVE-2022-49566/ANY/0001.patch
+CVE-2022-49641/ANY/0001.patch
+CVE-2022-49642/ANY/0001.patch
+CVE-2022-49687/ANY/0001.patch
+CVE-2022-49695/ANY/0001.patch
+CVE-2022-49705/ANY/0001.patch
+CVE-2022-49710/ANY/0001.patch
+CVE-2022-49715/ANY/0001.patch
+CVE-2022-49777/ANY/0001.patch
+CVE-2022-49779/ANY/0001.patch
+CVE-2022-49784/ANY/0001.patch
+CVE-2022-49823/ANY/0001.patch
+CVE-2022-49824/ANY/0001.patch
+CVE-2022-49825/ANY/0001.patch
+CVE-2022-49839/ANY/0001.patch
+CVE-2022-49863/ANY/0001.patch
+CVE-2022-49980/ANY/0001.patch
+CVE-2022-49990/ANY/0001.patch
+CVE-2022-49993/4.14/0003.patch
+CVE-2022-50013/ANY/0001.patch
+CVE-2022-50062/ANY/0001.patch
+CVE-2022-50074/ANY/0001.patch
+CVE-2022-50246/ANY/0001.patch
+CVE-2022-50248/ANY/0001.patch
+CVE-2022-50273/ANY/0001.patch
+CVE-2022-50304/ANY/0001.patch
+CVE-2022-50326/ANY/0001.patch
+CVE-2022-50358/ANY/0001.patch
+CVE-2022-50364/ANY/0001.patch
+CVE-2022-50397/ANY/0001.patch
+CVE-2022-50473/ANY/0001.patch
+CVE-2022-50522/4.14/0003.patch
+CVE-2022-50537/ANY/0001.patch
+CVE-2023-1989/4.14/0003.patch
+CVE-2023-3777/^6.5/0001.patch
+CVE-2023-21657/4.14/0005.patch
+CVE-2023-23000/^5.16/0001.patch
+CVE-2023-28554/ANY/0002.patch
+CVE-2023-33070/ANY/0001.patch
+CVE-2023-52486/^6.7/0001.patch
+CVE-2023-52523/^6.6/0001.patch
+CVE-2023-52595/^6.6/0001.patch
+CVE-2023-52604/4.14/0009.patch
+CVE-2023-52676/^6.7/0001.patch
+CVE-2023-52707/^6.2/0001.patch
+CVE-2023-52746/^6.2/0001.patch
+CVE-2023-52847/^6.6/0001.patch
+CVE-2023-52884/^6.5/0001.patch
+CVE-2023-52979/4.14/0003.patch
+CVE-2023-53001/ANY/0001.patch
+CVE-2023-53016/ANY/0001.patch
+CVE-2023-53098/ANY/0001.patch
+CVE-2023-53125/4.14/0003.patch
+CVE-2023-53131/ANY/0001.patch
+CVE-2023-53137/ANY/0001.patch
+CVE-2023-53214/ANY/0001.patch
+CVE-2023-53227/4.14/0003.patch
+CVE-2023-53250/ANY/0001.patch
+CVE-2023-53259/ANY/0002.patch
+CVE-2023-53265/4.14/0003.patch
+CVE-2023-53288/ANY/0001.patch
+CVE-2023-53312/ANY/0001.patch
+CVE-2023-53436/4.14/0003.patch
+CVE-2023-53443/ANY/0001.patch
+CVE-2023-53487/ANY/0002.patch
+CVE-2023-53537/ANY/0001.patch
+CVE-2023-53594/ANY/0001.patch
+CVE-2023-53599/ANY/0001.patch
+CVE-2023-53641/ANY/0001.patch
+CVE-2023-53669/ANY/0001.patch
+CVE-2023-53693/ANY/0001.patch
+CVE-2023-53695/ANY/0001.patch
+CVE-2023-53709/ANY/0001.patch
+CVE-2023-53712/ANY/0001.patch
+CVE-2023-53719/ANY/0001.patch
+CVE-2024-2201/^6.9/0001.patch
+CVE-2024-24855/^6.4/0001.patch
+CVE-2024-26643/^6.8/0001.patch
+CVE-2024-26645/^6.8/0001.patch
+CVE-2024-26720/4.14/0009.patch
+CVE-2024-26760/^6.8/0001.patch
+CVE-2024-26900/^6.8/0001.patch
+CVE-2024-26920/4.14/0009.patch
+CVE-2024-26961/^6.7/0001.patch
+CVE-2024-26972/^6.8/0001.patch
+CVE-2024-27009/^6.9/0001.patch
+CVE-2024-27033/^6.8/0001.patch
+CVE-2024-27393/^6.9/0001.patch
+CVE-2024-33032/ANY/0002.patch
+CVE-2024-34027/^6.9/0001.patch
+CVE-2024-35812/4.14/0009.patch
+CVE-2024-35824/^6.8/0001.patch
+CVE-2024-35879/^6.9/0001.patch
+CVE-2024-35933/4.14/0008.patch
+CVE-2024-35950/^6.9/0001.patch
+CVE-2024-35954/^6.9/0001.patch
+CVE-2024-35962/^6.9/0001.patch
+CVE-2024-39296/^6.9/0001.patch
+CVE-2024-40917/^6.10/0001.patch
+CVE-2024-40923/^6.10/0001.patch
+CVE-2024-40954/^6.10/0001.patch
+CVE-2024-40996/^6.10/0001.patch
+CVE-2024-41014/^6.10/0001.patch
+CVE-2024-41041/^6.10/0001.patch
+CVE-2024-42077/^6.10/0001.patch
+CVE-2024-42102/4.14/0009.patch
+CVE-2024-42296/^6.10/0001.patch
+CVE-2024-43879/^6.10/0001.patch
+CVE-2024-43894/^6.11/0001.patch
+CVE-2024-44938/^6.9/0001.patch
+CVE-2024-44939/^6.9/0001.patch
+CVE-2024-44952/4.14/0008.patch
+CVE-2024-46681/^6.11/0001.patch
+CVE-2024-46754/^6.10/0001.patch
+CVE-2024-46830/^6.11/0001.patch
+CVE-2024-47747/^6.11/0001.patch
+CVE-2024-50017/^6.11/0001.patch
+CVE-2024-50019/^6.12/0001.patch
+CVE-2024-50184/^6.11/0001.patch
+CVE-2024-50186/^6.12/0001.patch
+CVE-2024-50195/3.17-^6.12/0001.patch
+CVE-2024-50201/^6.12/0001.patch
+CVE-2024-50210/3.17-^6.6/0001.patch
+CVE-2024-50265/^6.12/0001.patch
+CVE-2024-50267/^6.12/0001.patch
+CVE-2024-50269/^6.12/0001.patch
+CVE-2024-50273/^6.11/0001.patch
+CVE-2024-50279/^6.12/0001.patch
+CVE-2024-50287/^6.12/0001.patch
+CVE-2024-50290/^6.12/0001.patch
+CVE-2024-50292/^6.12/0001.patch
+CVE-2024-50295/^6.12/0001.patch
+CVE-2024-50299/^6.12/0001.patch
+CVE-2024-50301/^6.12/0001.patch
+CVE-2024-52332/ANY/0002.patch
+CVE-2024-53045/^6.12/0001.patch
+CVE-2024-53066/^6.12/0001.patch
+CVE-2024-53101/^6.12/0001.patch
+CVE-2024-53103/^6.12/0001.patch
+CVE-2024-53112/^6.12/0001.patch
+CVE-2024-53127/^6.12/0001.patch
+CVE-2024-53140/^6.12/0001.patch
+CVE-2024-53141/^6.12/0001.patch
+CVE-2024-53156/ANY/0002.patch
+CVE-2024-53157/ANY/0002.patch
+CVE-2024-53165/ANY/0002.patch
+CVE-2024-53171/ANY/0001.patch
+CVE-2024-53172/ANY/0002.patch
+CVE-2024-53173/ANY/0002.patch
+CVE-2024-53183/ANY/0002.patch
+CVE-2024-53190/ANY/0001.patch
+CVE-2024-53194/ANY/0002.patch
+CVE-2024-53214/ANY/0002.patch
+CVE-2024-53217/ANY/0002.patch
+CVE-2024-53227/ANY/0002.patch
+CVE-2024-53239/ANY/0001.patch
+CVE-2024-53240/ANY/0001.patch
+CVE-2024-53680/ANY/0002.patch
+CVE-2024-53690/ANY/0001.patch
+CVE-2024-56531/ANY/0002.patch
+CVE-2024-56532/ANY/0002.patch
+CVE-2024-56536/ANY/0001.patch
+CVE-2024-56539/ANY/0002.patch
+CVE-2024-56548/ANY/0002.patch
+CVE-2024-56558/ANY/0001.patch
+CVE-2024-56569/ANY/0001.patch
+CVE-2024-56570/ANY/0001.patch
+CVE-2024-56586/ANY/0001.patch
+CVE-2024-56587/ANY/0002.patch
+CVE-2024-56593/ANY/0001.patch
+CVE-2024-56595/ANY/0002.patch
+CVE-2024-56596/ANY/0002.patch
+CVE-2024-56597/ANY/0002.patch
+CVE-2024-56598/ANY/0002.patch
+CVE-2024-56600/ANY/0001.patch
+CVE-2024-56602/ANY/0001.patch
+CVE-2024-56603/ANY/0002.patch
+CVE-2024-56605/ANY/0002.patch
+CVE-2024-56619/ANY/0002.patch
+CVE-2024-56629/ANY/0001.patch
+CVE-2024-56637/ANY/0002.patch
+CVE-2024-56643/ANY/0002.patch
+CVE-2024-56659/ANY/0002.patch
+CVE-2024-56670/ANY/0002.patch
+CVE-2024-56681/ANY/0001.patch
+CVE-2024-56687/ANY/0001.patch
+CVE-2024-56700/ANY/0002.patch
+CVE-2024-56739/ANY/0002.patch
+CVE-2024-56747/ANY/0001.patch
+CVE-2024-56767/ANY/0002.patch
+CVE-2024-56769/ANY/0002.patch
+CVE-2024-56779/ANY/0002.patch
+CVE-2024-57802/ANY/0002.patch
+CVE-2024-57849/ANY/0002.patch
+CVE-2024-57850/ANY/0002.patch
+CVE-2024-57893/ANY/0001.patch
+CVE-2024-57901/ANY/0001.patch
+CVE-2024-57902/ANY/0001.patch
+CVE-2024-57904/ANY/0001.patch
+CVE-2024-57908/ANY/0001.patch
+CVE-2024-57912/ANY/0001.patch
+CVE-2024-57929/ANY/0001.patch
+CVE-2024-57938/ANY/0002.patch
+CVE-2024-57948/ANY/0001.patch
+CVE-2024-57973/ANY/0001.patch
+CVE-2024-58001/ANY/0001.patch
+CVE-2024-58009/ANY/0001.patch
+CVE-2024-58010/ANY/0001.patch
+CVE-2024-58055/ANY/0001.patch
+CVE-2024-58083/ANY/0001.patch
+CVE-2024-58094/ANY/0001.patch
+CVE-2024-58095/ANY/0001.patch
+CVE-2025-21664/ANY/0001.patch
+CVE-2025-21671/ANY/0001.patch
+CVE-2025-21689/ANY/0001.patch
+CVE-2025-21699/ANY/0001.patch
+CVE-2025-21704/ANY/0001.patch
+CVE-2025-21718/ANY/0001.patch
+CVE-2025-21735/ANY/0001.patch
+CVE-2025-21736/ANY/0001.patch
+CVE-2025-21744/ANY/0001.patch
+CVE-2025-21772/ANY/0001.patch
+CVE-2025-21776/ANY/0001.patch
+CVE-2025-21781/ANY/0001.patch
+CVE-2025-21782/ANY/0001.patch
+CVE-2025-21785/ANY/0001.patch
+CVE-2025-21791/ANY/0001.patch
+CVE-2025-21835/ANY/0001.patch
+CVE-2025-21877/ANY/0001.patch
+CVE-2025-21904/ANY/0001.patch
+CVE-2025-21909/ANY/0001.patch
+CVE-2025-21910/ANY/0001.patch
+CVE-2025-21916/ANY/0001.patch
+CVE-2025-21928/ANY/0001.patch
+CVE-2025-21934/ANY/0001.patch
+CVE-2025-21935/ANY/0001.patch
+CVE-2025-21948/ANY/0001.patch
+CVE-2025-21993/ANY/0001.patch
+CVE-2025-21996/ANY/0001.patch
+CVE-2025-22007/ANY/0001.patch
+CVE-2025-22018/ANY/0001.patch
+CVE-2025-22063/ANY/0001.patch
+CVE-2025-22073/ANY/0001.patch
+CVE-2025-22079/ANY/0001.patch
+CVE-2025-22086/ANY/0001.patch
+CVE-2025-23150/ANY/0001.patch
+CVE-2025-23163/ANY/0001.patch
+CVE-2025-37738/ANY/0001.patch
+CVE-2025-37739/ANY/0001.patch
+CVE-2025-37740/ANY/0001.patch
+CVE-2025-37741/ANY/0001.patch
+CVE-2025-37749/ANY/0001.patch
+CVE-2025-37757/ANY/0001.patch
+CVE-2025-37758/ANY/0001.patch
+CVE-2025-37780/ANY/0001.patch
+CVE-2025-37781/ANY/0001.patch
+CVE-2025-37782/ANY/0001.patch
+CVE-2025-37789/ANY/0001.patch
+CVE-2025-37795/ANY/0001.patch
+CVE-2025-37796/ANY/0001.patch
+CVE-2025-37797/ANY/0001.patch
+CVE-2025-37798/ANY/0001.patch
+CVE-2025-37817/ANY/0001.patch
+CVE-2025-37823/ANY/0001.patch
+CVE-2025-37825/ANY/0001.patch
+CVE-2025-37833/ANY/0001.patch
+CVE-2025-37838/ANY/0001.patch
+CVE-2025-37839/ANY/0001.patch
+CVE-2025-37841/ANY/0001.patch
+CVE-2025-37851/ANY/0001.patch
+CVE-2025-37857/ANY/0001.patch
+CVE-2025-37858/ANY/0001.patch
+CVE-2025-37892/ANY/0001.patch
+CVE-2025-37923/ANY/0001.patch
+CVE-2025-37925/ANY/0001.patch
+CVE-2025-37932/ANY/0001.patch
+CVE-2025-37937/ANY/0002.patch
+CVE-2025-37982/ANY/0001.patch
+CVE-2025-37983/ANY/0001.patch
+CVE-2025-37990/ANY/0001.patch
+CVE-2025-38034/ANY/0001.patch
+CVE-2025-38044/ANY/0001.patch
+CVE-2025-38046/ANY/0001.patch
+CVE-2025-38058/ANY/0001.patch
+CVE-2025-38061/ANY/0001.patch
+CVE-2025-38066/ANY/0001.patch
+CVE-2025-38075/ANY/0001.patch
+CVE-2025-38090/ANY/0001.patch
+CVE-2025-38114/ANY/0001.patch
+CVE-2025-38115/ANY/0001.patch
+CVE-2025-38147/ANY/0001.patch
+CVE-2025-38157/ANY/0001.patch
+CVE-2025-38163/ANY/0001.patch
+CVE-2025-38174/ANY/0001.patch
+CVE-2025-38177/ANY/0001.patch
+CVE-2025-38180/ANY/0001.patch
+CVE-2025-38181/ANY/0001.patch
+CVE-2025-38184/ANY/0001.patch
+CVE-2025-38185/ANY/0001.patch
+CVE-2025-38190/ANY/0001.patch
+CVE-2025-38194/ANY/0001.patch
+CVE-2025-38200/ANY/0001.patch
+CVE-2025-38203/ANY/0001.patch
+CVE-2025-38204/ANY/0001.patch
+CVE-2025-38212/ANY/0001.patch
+CVE-2025-38213/ANY/0001.patch
+CVE-2025-38218/ANY/0001.patch
+CVE-2025-38219/ANY/0001.patch
+CVE-2025-38222/ANY/0001.patch
+CVE-2025-38245/ANY/0001.patch
+CVE-2025-38251/ANY/0001.patch
+CVE-2025-38265/ANY/0001.patch
+CVE-2025-38285/ANY/0001.patch
+CVE-2025-38312/ANY/0001.patch
+CVE-2025-38320/ANY/0001.patch
+CVE-2025-38324/ANY/0001.patch
+CVE-2025-38328/ANY/0001.patch
+CVE-2025-38336/ANY/0001.patch
+CVE-2025-38344/ANY/0001.patch
+CVE-2025-38345/ANY/0001.patch
+CVE-2025-38348/ANY/0001.patch
+CVE-2025-38386/ANY/0001.patch
+CVE-2025-38403/ANY/0001.patch
+CVE-2025-38406/ANY/0001.patch
+CVE-2025-38416/ANY/0001.patch
+CVE-2025-38420/ANY/0001.patch
+CVE-2025-38428/ANY/0001.patch
+CVE-2025-38445/ANY/0001.patch
+CVE-2025-38448/ANY/0001.patch
+CVE-2025-38458/ANY/0001.patch
+CVE-2025-38459/ANY/0001.patch
+CVE-2025-38460/ANY/0001.patch
+CVE-2025-38467/ANY/0001.patch
+CVE-2025-38468/ANY/0001.patch
+CVE-2025-38470/ANY/0001.patch
+CVE-2025-38473/ANY/0001.patch
+CVE-2025-38474/ANY/0001.patch
+CVE-2025-38495/ANY/0001.patch
+CVE-2025-38498/ANY/0002.patch
+CVE-2025-38513/ANY/0001.patch
+CVE-2025-38514/ANY/0001.patch
+CVE-2025-38538/ANY/0001.patch
+CVE-2025-38542/ANY/0001.patch
+CVE-2025-38544/ANY/0001.patch
+CVE-2025-38546/ANY/0001.patch
+CVE-2025-38555/ANY/0001.patch
+CVE-2025-38574/ANY/0001.patch
+CVE-2025-38578/ANY/0001.patch
+CVE-2025-38581/ANY/0001.patch
+CVE-2025-38604/ANY/0001.patch
+CVE-2025-38611/ANY/0001.patch
+CVE-2025-38612/ANY/0001.patch
+CVE-2025-38618/ANY/0001.patch
+CVE-2025-38639/ANY/0001.patch
+CVE-2025-38691/ANY/0001.patch
+CVE-2025-38693/ANY/0001.patch
+CVE-2025-38694/ANY/0001.patch
+CVE-2025-38697/ANY/0001.patch
+CVE-2025-38698/ANY/0001.patch
+CVE-2025-38699/ANY/0001.patch
+CVE-2025-38701/ANY/0001.patch
+CVE-2025-38708/ANY/0001.patch
+CVE-2025-38712/ANY/0001.patch
+CVE-2025-38713/ANY/0001.patch
+CVE-2025-38717/ANY/0001.patch
+CVE-2025-39676/ANY/0001.patch
+CVE-2025-39691/ANY/0001.patch
+CVE-2025-39710/ANY/0001.patch
+CVE-2025-39714/ANY/0001.patch
+CVE-2025-39742/ANY/0001.patch
+CVE-2025-39743/ANY/0001.patch
+CVE-2025-39751/ANY/0001.patch
+CVE-2025-39756/ANY/0001.patch
+CVE-2025-39782/ANY/0001.patch
+CVE-2025-39794/ANY/0001.patch
+CVE-2025-39796/ANY/0001.patch
+CVE-2025-39808/ANY/0001.patch
+CVE-2025-39812/ANY/0001.patch
+CVE-2025-39817/ANY/0001.patch
+CVE-2025-39824/ANY/0001.patch
+CVE-2025-39839/ANY/0001.patch
+CVE-2025-39846/ANY/0001.patch
+CVE-2025-39847/ANY/0001.patch
+CVE-2025-39848/ANY/0001.patch
+CVE-2025-39874/ANY/0001.patch
+CVE-2025-39885/ANY/0001.patch
+CVE-2025-39889/ANY/0001.patch
+CVE-2025-39898/ANY/0001.patch
+CVE-2025-39903/ANY/0001.patch
+CVE-2025-39913/ANY/0001.patch
+CVE-2025-39920/ANY/0001.patch
+CVE-2025-39945/ANY/0001.patch
+CVE-2025-39964/ANY/0001.patch
+CVE-2025-39967/ANY/0001.patch
+CVE-2025-39973/ANY/0001.patch
+CVE-2025-39996/ANY/0001.patch
+CVE-2025-39998/ANY/0001.patch
+CVE-2025-40011/ANY/0001.patch
+CVE-2025-40020/ANY/0001.patch
+CVE-2025-40022/ANY/0001.patch
+CVE-2025-40028/ANY/0001.patch
+CVE-2025-40030/ANY/0001.patch
+CVE-2025-40035/ANY/0001.patch
+CVE-2025-40044/ANY/0001.patch
+CVE-2025-40049/ANY/0001.patch
+CVE-2025-40055/ANY/0001.patch
+CVE-2025-40078/ANY/0001.patch
+CVE-2025-40080/ANY/0001.patch
+CVE-2025-40082/ANY/0001.patch
+CVE-2019-12819/4.14/0006.patch
+CVE-2021-47472/4.14/0003.patch
+CVE-2023-53129/ANY/0001.patch
+CVE-2023-53626/ANY/0001.patch
+CVE-2024-26720/4.14/0009.patch
+CVE-2024-39501/4.14/0009.patch
+CVE-2024-42102/4.14/0009.patch
+CVE-2024-50195/3.17-^6.12/0001.patch
+CVE-2024-50210/3.17-^6.6/0001.patch
@@ -0,0 +1,27 @@
+--- a/techpack/audio/dsp/rtac.c
+++ b/techpack/audio/dsp/rtac.c
+@@ -652,6 +652,12 @@
+ 	pr_debug("%s\n", __func__);
+ 
+ 	mutex_lock(&rtac_voice_mutex);
+	if (rtac_voice_data.num_of_voice_combos > ARRAY_SIZE(rtac_voice_data.voice)) {
+		pr_err("%s: invalid voice count %u\n", __func__,
+		       rtac_voice_data.num_of_voice_combos);
+		mutex_unlock(&rtac_voice_mutex);
+		return;
+	}
+ 	/* look for device */
+ 	for (i = 0; i < rtac_voice_data.num_of_voice_combos; i++) {
+ 		if (rtac_voice_data.voice[i].cvs_handle == cvs_handle) {
+--- a/drivers/staging/qcacld-3.0/core/mac/src/pe/lim/lim_process_fils.c
+++ b/drivers/staging/qcacld-3.0/core/mac/src/pe/lim/lim_process_fils.c
+@@ -1092,6 +1092,9 @@
+ 		return false;
+ 	}
+ 
+	if (dot11f_ie_rsn.pmkid_count > ARRAY_SIZE(dot11f_ie_rsn.pmkid))
+		return false;
+
+ 	for (i = 0; i < dot11f_ie_rsn.pmkid_count; i++) {
+ 		if (qdf_mem_cmp(dot11f_ie_rsn.pmkid[i],
+ 		    pe_session->fils_info->fils_pmkid,
@@ -0,0 +1,36 @@
+# FORTIFY Clang port for msm-4.14 (LOS sunfish)
+
+Based on Kees Cook *fortify: Add Clang support* (upstream ~2022), adapted
+to 4.14’s in-`string.h` FORTIFY (no `fortify-string.h` yet).
+
+**Not** AXP `0004` (strict-string). **Not** `BUG()` link stubs.
+
+See `docs/009-fortify-clang-port.md`.
+
+## Apply
+
+```bash
+# on rom-dev01, after git reset of msm-4.14:
+python3 apply_fortify_clang.py /path/to/msm-4.14
+patch -p1 -d /path/to/msm-4.14 < 0001-driver-bounds-rtac-fils.patch
+```
+
+`ksync-one.sh` with `CONFIG_FORTIFY_SOURCE` runs both automatically.
+
+Then enable `CONFIG_FORTIFY_SOURCE=y` and build **without**
+`ALLOW_FORTIFY_BUG_STUBS`.
+
+## Nested strlen (required)
+
+With Clang `__pass_object_size`, fortified `strlcpy`/`strcpy` must call
+`__underlying_strlen(q)`, not fortified `strlen(q)`. Otherwise a known
+source object size makes `strlen` panic at boot (LAB: `strlen+strlcpy`
+fail; `strlen+strncpy` OK). `apply_fortify_clang.py` rewrites both.
+
+## Diag capture (v4)
+
+`apply_fortify_diag.py` — `early_ioremap` before `parse_early_param`, ordinary
+`ioremap` only after `mm_init`, never map from the failure handler; failure
+and milestone zones separated. See `docs/009-fortify-diag-capture-plan.md`
+and `docs/009-fortify-diag-v3-review-20260927.md`. Control:
+`PSTORE_ALT_PLAIN=1` / `scripts/009-bisect-ksync-pstore-alt-plain.sh`.
@@ -0,0 +1,244 @@
+#!/usr/bin/env python3
+"""Apply minimal Clang FORTIFY adaptations to msm-4.14 (Kees-style).
+
+Edits:
+  - include/linux/compiler-clang.h — __pass_object_size / __overloadable / __diagnose_as
+  - include/linux/string.h — __FORTIFY_INLINE + POS/POS0 on fortified params
+  - security/Kconfig — allow FORTIFY on Clang when this port is present
+    (tree lacks CC_IS_CLANG Kconfig symbols; !CC_IS_CLANG was a no-op)
+
+Idempotent. Exit 0 on success.
+"""
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+MARKER = "/* AXP_Resurection: fortify-clang port (Kees-style) */"
+
+
+def patch_compiler_clang(path: Path) -> None:
+    t = path.read_text()
+    if MARKER in t and "__pass_object_size" in t:
+        print(f"skip {path} (already patched)")
+        return
+    if "__pass_object_size" in t:
+        print(f"skip {path} (attrs already present)")
+        return
+    block = f"""
+{MARKER}
+/*
+ * Clang FORTIFY helpers (upstream fortify Clang support / Kees Cook).
+ * pass_object_size makes __builtin_object_size work through fortified inlines.
+ */
+#if __has_attribute(pass_object_size)
+# define __pass_object_size(type)	__attribute__((__pass_object_size__(type)))
+#else
+# define __pass_object_size(type)
+#endif
+#if __has_attribute(overloadable)
+# define __overloadable			__attribute__((__overloadable__))
+#else
+# define __overloadable
+#endif
+#if __has_attribute(diagnose_as_builtin)
+# define __diagnose_as(builtin...)	__attribute__((__diagnose_as_builtin__(builtin)))
+#else
+# define __diagnose_as(builtin...)
+#endif
+"""
+    path.write_text(t.rstrip() + "\n" + block + "\n")
+    print(f"patched {path}")
+
+
+def patch_kconfig(path: Path) -> None:
+    t = path.read_text()
+    old = (
+        "\t# https://bugs.llvm.org/show_bug.cgi?id=50322\n"
+        "\t# https://bugs.llvm.org/show_bug.cgi?id=41459\n"
+        "\tdepends on !CC_IS_CLANG\n"
+    )
+    new = (
+        "\t# Clang: upstream disabled FORTIFY until wrappers existed (LLVM 41459).\n"
+        "\t# This tree never defined CC_IS_CLANG, so !CC_IS_CLANG was a no-op.\n"
+        "\t# Fortify-clang port (vendor/.../fortify-clang) supplies Kees-style\n"
+        "\t# __pass_object_size / __overloadable wrappers for Clang 12+.\n"
+        "\t# https://bugs.llvm.org/show_bug.cgi?id=41459\n"
+    )
+    if MARKER.split()[2] in t and "Fortify-clang port" in t:
+        print(f"skip {path} (already patched)")
+        return
+    if old not in t:
+        if "depends on !CC_IS_CLANG" in t:
+            t2 = t.replace(
+                "\tdepends on !CC_IS_CLANG\n",
+                new,
+                1,
+            )
+            if t2 == t:
+                raise SystemExit(f"could not patch {path}")
+            path.write_text(t2)
+            print(f"patched {path} (depends line only)")
+            return
+        raise SystemExit(f"FORTIFY depends block not found in {path}")
+    path.write_text(t.replace(old, new, 1))
+    print(f"patched {path}")
+
+
+def patch_string_h(path: Path) -> None:
+    t = path.read_text()
+    if "AXP_Resurection: fortify-clang" in t and "POS0" in t:
+        print(f"skip {path} (already patched)")
+        return
+
+    old_inline = (
+        "#define __FORTIFY_INLINE extern __always_inline __attribute__((gnu_inline))\n"
+    )
+    # 4.14 fortify bodies all use __builtin_object_size(*, 0) (whole object).
+    # pass_object_size(N) must match that N or Clang returns -1 (no checking).
+    # Do NOT use pass_object_size(1) here — that is STRICT_STRING / type-1 policy
+    # (AXP 0004), a separate step. See docs/009-fortify-port-review-20260926.md.
+    new_inline = (
+        f"{MARKER}\n"
+        "/* Clang: __overloadable + __pass_object_size matching bos type 0. */\n"
+        "#ifdef __clang__\n"
+        "# define __FORTIFY_INLINE extern __always_inline __attribute__((gnu_inline)) __overloadable\n"
+        "# define POS  __pass_object_size(0)\n"
+        "# define POS0 __pass_object_size(0)\n"
+        "#else\n"
+        "# define __FORTIFY_INLINE extern __always_inline __attribute__((gnu_inline))\n"
+        "# define POS\n"
+        "# define POS0\n"
+        "#endif\n"
+    )
+    if old_inline not in t:
+        raise SystemExit("__FORTIFY_INLINE define not found")
+    t = t.replace(old_inline, new_inline, 1)
+
+    # Rewrite fortified prototypes to pass object size (Kees-style POS/POS0).
+    replacements = [
+        (
+            "__FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)",
+            "__FORTIFY_INLINE char *strncpy(char * const POS0 p, const char * const POS q, __kernel_size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE char *strcat(char *p, const char *q)",
+            "__FORTIFY_INLINE char *strcat(char * const POS0 p, const char * const POS q)",
+        ),
+        (
+            "__FORTIFY_INLINE __kernel_size_t strlen(const char *p)",
+            "__FORTIFY_INLINE __kernel_size_t strlen(const char * const POS p)",
+        ),
+        (
+            "__FORTIFY_INLINE __kernel_size_t strnlen(const char *p, __kernel_size_t maxlen)",
+            "__FORTIFY_INLINE __kernel_size_t strnlen(const char * const POS p, __kernel_size_t maxlen)",
+        ),
+        (
+            "__FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)",
+            "__FORTIFY_INLINE size_t strlcpy(char * const POS0 p, const char * const POS q, size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count)",
+            "__FORTIFY_INLINE char *strncat(char * const POS0 p, const char * const POS q, __kernel_size_t count)",
+        ),
+        (
+            "__FORTIFY_INLINE void *memset(void *p, int c, __kernel_size_t size)",
+            "__FORTIFY_INLINE void *memset(void * const POS0 p, int c, __kernel_size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size)",
+            "__FORTIFY_INLINE void *memcpy(void * const POS0 p, const void * const POS0 q, __kernel_size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size)",
+            "__FORTIFY_INLINE void *memmove(void * const POS0 p, const void * const POS0 q, __kernel_size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE void *memscan(void *p, int c, __kernel_size_t size)",
+            "__FORTIFY_INLINE void *memscan(void * const POS0 p, int c, __kernel_size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size)",
+            "__FORTIFY_INLINE int memcmp(const void * const POS0 p, const void * const POS0 q, __kernel_size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size)",
+            "__FORTIFY_INLINE void *memchr(const void * const POS0 p, int c, __kernel_size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE void *memchr_inv(const void *p, int c, size_t size)",
+            "__FORTIFY_INLINE void *memchr_inv(const void * const POS0 p, int c, size_t size)",
+        ),
+        (
+            "__FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp)",
+            "__FORTIFY_INLINE void *kmemdup(const void * const POS0 p, size_t size, gfp_t gfp)",
+        ),
+        (
+            "__FORTIFY_INLINE char *strcpy(char *p, const char *q)",
+            "__FORTIFY_INLINE char *strcpy(char * const POS0 p, const char * const POS q)",
+        ),
+    ]
+    for a, b in replacements:
+        if a not in t:
+            raise SystemExit(f"missing fortify prototype:\n{a}")
+        t = t.replace(a, b, 1)
+
+    # With Clang __pass_object_size, fortified strlen(q) sees a known object
+    # size and panics when the C string is not NUL-terminated within that
+    # bound. strlcpy/strcpy intentionally need the unbounded source length
+    # (same as the GCC path when bos was usually -1). Use the underlying
+    # strlen so enabling both wrappers does not brick boot.
+    # LAB bisect 2026-09-28: strlen+strlcpy fails; strlen+strncpy boots.
+    old_strlcpy_len = "\tret = strlen(q);\n"
+    new_strlcpy_len = (
+        "\t/* AXP_Resurection: fortify-clang — do not nest fortified strlen */\n"
+        "\tret = __underlying_strlen(q);\n"
+    )
+    if "ret = __underlying_strlen(q);" not in t:
+        if old_strlcpy_len not in t:
+            raise SystemExit("strlcpy strlen(q) probe not found")
+        t = t.replace(old_strlcpy_len, new_strlcpy_len, 1)
+
+    old_strcpy_len = "\tmemcpy(p, q, strlen(q) + 1);\n"
+    new_strcpy_len = (
+        "\tmemcpy(p, q, __underlying_strlen(q) + 1);\n"
+    )
+    if "memcpy(p, q, __underlying_strlen(q) + 1);" not in t:
+        if old_strcpy_len not in t:
+            raise SystemExit("strcpy strlen(q) probe not found")
+        t = t.replace(old_strcpy_len, new_strcpy_len, 1)
+
+    # Undef POS macros at end of fortify block (before #endif of FORTIFY_SOURCE)
+    end_marker = (
+        "#undef __underlying_strncpy\n"
+        "#endif\n"
+    )
+    end_repl = (
+        "#undef __underlying_strncpy\n"
+        "#undef POS\n"
+        "#undef POS0\n"
+        "#endif\n"
+    )
+    if end_marker not in t:
+        raise SystemExit("fortify #endif marker not found")
+    t = t.replace(end_marker, end_repl, 1)
+
+    path.write_text(t)
+    print(f"patched {path}")
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        print(f"usage: {sys.argv[0]} /path/to/msm-4.14", file=sys.stderr)
+        return 2
+    root = Path(sys.argv[1])
+    patch_compiler_clang(root / "include/linux/compiler-clang.h")
+    patch_string_h(root / "include/linux/string.h")
+    patch_kconfig(root / "security/Kconfig")
+    print("fortify-clang apply OK")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,597 @@
+#!/usr/bin/env python3
+"""Diagnostic overlays for FORTIFY / early boot capture (msm-4.14 sunfish LAB).
+
+v4 — docs/009-fortify-diag-v3-review-20260927.md:
+
+  - Never map from the failure handler.
+  - Early map: early_ioremap (FIXMAP_PAGE_IO) before setup_arch
+    parse_early_param — same device attrs as permanent/access-ramoops.
+  - Keep early map until after mm_init; ordinary ioremap only then
+    (needs slab/vmalloc). Clear VA before retiring early map.
+  - First-failure at offset 0; milestones at offset 2048 (no shared slots).
+  - Adopt prior failure only if a complete record (header + \\n + mirror).
+  - Atomic claim for first-failure; milestones never touch failure zone.
+
+Readable: dd if=/dev/access-ramoops | strings | grep AXPDIAG
+
+Idempotent via markers. Attempt id is bake-time only; wipe failure zone
+before repeating the same image (see capture plan).
+"""
+from __future__ import annotations
+
+import re
+import sys
+import time
+from pathlib import Path
+
+MARKER_PANIC = "/* AXP_Resurection: fortify-diag capture v4 */"
+MARKER_MAIN_MM = "/* AXP_Resurection: axp-diag mm_init */"
+MARKER_SETUP_EARLY = "/* AXP_Resurection: axp-diag early_map */"
+MARKER_MAKEFILE = "AXP_Resurection axp_diag_capture"
+ATTEMPT = time.strftime("%Y%m%dT%H%M%SZ", time.gmtime())
+
+# Sunfish DT: alt_ramoops_region@A4C1F000 size 0x400000 (no-map).
+SUNFISH_ALT_PHYS = "0xA4C1F000ULL"
+
+CAPTURE_C = r"""
+/* AXP_Resurection: axp_diag_capture — LAB early plaintext alt ramoops (v4) */
+#include <linux/kernel.h>
+#include <linux/io.h>
+#include <linux/init.h>
+#include <linux/export.h>
+#include <linux/notifier.h>
+#include <linux/atomic.h>
+#include <linux/types.h>
+#include <linux/mm.h>
+#include <asm/bug.h>
+#include <asm/early_ioremap.h>
+
+#define AXP_ALT_PHYS	__SUNFISH_ALT_PHYS__
+#define AXP_MAP_SIZE	PAGE_SIZE
+#define AXP_ATTEMPT	"__ATTEMPT__"
+
+/* Layout within the first mapped page (no shared slots). */
+#define AXP_FAIL_OFF	0U
+#define AXP_FAIL_MIRROR	128U
+#define AXP_FAIL_SPAN	1024U		/* primary + mirrors */
+#define AXP_MILE_OFF	2048U
+#define AXP_REC_MAX	120U
+
+static void __iomem *axp_alt_va;
+static bool axp_va_is_early;
+static atomic_t axp_first_latch = ATOMIC_INIT(0);
+
+static void notrace axp_bytes_out(void __iomem *dst, const char *src, size_t n)
+{
+	size_t i;
+
+	for (i = 0; i < n; i++)
+		writeb((u8)src[i], dst + i);
+}
+
+static void notrace axp_bytes_in(char *dst, const void __iomem *src, size_t n)
+{
+	size_t i;
+
+	for (i = 0; i < n; i++)
+		dst[i] = (char)readb(src + i);
+}
+
+static void axp_hex_u64(char *dst, unsigned long v)
+{
+	static const char hex[] = "0123456789abcdef";
+	int i;
+
+	dst[0] = '0';
+	dst[1] = 'x';
+	for (i = 0; i < 16; i++)
+		dst[2 + i] = hex[(v >> (60 - 4 * i)) & 0xf];
+	dst[18] = '\0';
+}
+
+/*
+ * Complete first-failure: AXPDIAG1,...\n at FAIL_OFF and matching mirror.
+ * A truncated header alone must NOT suppress later captures.
+ */
+static bool notrace axp_first_complete(void)
+{
+	char buf[AXP_REC_MAX];
+	char mir[AXP_REC_MAX];
+	size_t i, n;
+
+	if (!axp_alt_va)
+		return false;
+	axp_bytes_in(buf, axp_alt_va + AXP_FAIL_OFF, AXP_REC_MAX);
+	if (buf[0] != 'A' || buf[1] != 'X' || buf[2] != 'P' || buf[3] != 'D' ||
+	    buf[4] != 'I' || buf[5] != 'A' || buf[6] != 'G' || buf[7] != '1' ||
+	    buf[8] != ',')
+		return false;
+	n = 0;
+	for (i = 9; i < AXP_REC_MAX; i++) {
+		if (buf[i] == '\n') {
+			n = i + 1;
+			break;
+		}
+	}
+	if (!n)
+		return false;
+	axp_bytes_in(mir, axp_alt_va + AXP_FAIL_MIRROR, n);
+	for (i = 0; i < n; i++) {
+		if (mir[i] != buf[i])
+			return false;
+	}
+	return true;
+}
+
+static void notrace axp_adopt_prior_first(void)
+{
+	if (axp_first_complete())
+		atomic_set(&axp_first_latch, 1);
+}
+
+/* Failure-zone write: mirrors first, primary last (commit). */
+static void notrace axp_fail_commit(const char *rec, size_t n)
+{
+	size_t i;
+
+	if (!axp_alt_va || !rec || !n)
+		return;
+	if (n > AXP_REC_MAX)
+		n = AXP_REC_MAX;
+	for (i = AXP_FAIL_MIRROR; i + n <= AXP_FAIL_SPAN; i += AXP_FAIL_MIRROR)
+		axp_bytes_out(axp_alt_va + i, rec, n);
+	wmb();
+	axp_bytes_out(axp_alt_va + AXP_FAIL_OFF, rec, n);
+	wmb();
+	(void)readb(axp_alt_va + AXP_FAIL_OFF);
+}
+
+static void notrace axp_mile_write(const char *rec, size_t n)
+{
+	if (!axp_alt_va || !rec || !n)
+		return;
+	if (n > AXP_REC_MAX)
+		n = AXP_REC_MAX;
+	if (AXP_MILE_OFF + n > AXP_MAP_SIZE)
+		return;
+	axp_bytes_out(axp_alt_va + AXP_MILE_OFF, rec, n);
+	wmb();
+	(void)readb(axp_alt_va + AXP_MILE_OFF);
+}
+
+/*
+ * First durable failure. Format:
+ *   AXPDIAG1,<type>,<attempt>,<caller_hex>,<token>\n
+ * Never maps. Null VA => lost (blind / transition window).
+ */
+void notrace __attribute__((no_sanitize("cfi")))
+axp_diag_mark_event(char type, const char *token, void *caller)
+{
+	char rec[128];
+	char hex[20];
+	size_t n = 0;
+	size_t ti;
+	const char *tok;
+	void __iomem *va = READ_ONCE(axp_alt_va);
+
+	if (!va)
+		return;
+	if (atomic_read(&axp_first_latch))
+		return;
+	if (axp_first_complete()) {
+		atomic_set(&axp_first_latch, 1);
+		return;
+	}
+	if (atomic_cmpxchg(&axp_first_latch, 0, 1) != 0)
+		return;
+	/* Re-check after claim (prior complete may have raced). */
+	if (axp_first_complete())
+		return;
+
+	axp_hex_u64(hex, (unsigned long)caller);
+	tok = token ? token : "?";
+
+	{
+		static const char pfx[] = "AXPDIAG1,";
+		size_t i;
+
+		for (i = 0; i < sizeof(pfx) - 1; i++)
+			rec[n++] = pfx[i];
+	}
+	rec[n++] = type;
+	rec[n++] = ',';
+	{
+		size_t i;
+
+		for (i = 0; AXP_ATTEMPT[i] && n + 1 < sizeof(rec); i++)
+			rec[n++] = AXP_ATTEMPT[i];
+	}
+	rec[n++] = ',';
+	{
+		size_t i;
+
+		for (i = 0; i < 18 && n + 1 < sizeof(rec); i++)
+			rec[n++] = hex[i];
+	}
+	rec[n++] = ',';
+	for (ti = 0; tok[ti] && n + 1 < sizeof(rec); ti++)
+		rec[n++] = tok[ti];
+	rec[n++] = '\n';
+
+	{
+		int k;
+
+		for (k = 0; k < 4; k++)
+			axp_fail_commit(rec, n);
+	}
+}
+EXPORT_SYMBOL_GPL(axp_diag_mark_event);
+
+void notrace __attribute__((no_sanitize("cfi")))
+axp_diag_mark_panic(const char *why)
+{
+	axp_diag_mark_event('P', why, __builtin_return_address(0));
+}
+EXPORT_SYMBOL_GPL(axp_diag_mark_panic);
+
+/* Milestones: separate offset; never touch failure zone. */
+void notrace __attribute__((no_sanitize("cfi")))
+axp_diag_milestone(const char *name)
+{
+	char rec[96];
+	size_t n = 0;
+	size_t i;
+	static const char pfx[] = "AXPDIAG0,M,";
+	void __iomem *va = READ_ONCE(axp_alt_va);
+
+	if (!va)
+		return;
+	if (atomic_read(&axp_first_latch) || axp_first_complete()) {
+		axp_adopt_prior_first();
+		return;
+	}
+
+	for (i = 0; i < sizeof(pfx) - 1; i++)
+		rec[n++] = pfx[i];
+	for (i = 0; AXP_ATTEMPT[i] && n + 1 < sizeof(rec); i++)
+		rec[n++] = AXP_ATTEMPT[i];
+	rec[n++] = ',';
+	if (!name)
+		name = "?";
+	for (i = 0; name[i] && n + 1 < sizeof(rec); i++)
+		rec[n++] = name[i];
+	rec[n++] = '\n';
+
+	/* Abort if a first-failure claimed while we composed. */
+	if (atomic_read(&axp_first_latch) || axp_first_complete()) {
+		axp_adopt_prior_first();
+		return;
+	}
+	axp_mile_write(rec, n);
+}
+EXPORT_SYMBOL_GPL(axp_diag_milestone);
+
+/*
+ * Early: early_ioremap (device/IO attrs), before parse_early_param.
+ * Kept across early_ioremap_reset until mm_init retires it.
+ * Permanent: ordinary ioremap ONLY after mm_init (slab + vmalloc ready).
+ * Failure handlers never call these.
+ */
+void __init axp_diag_map_early(void)
+{
+	void __iomem *va;
+
+	if (axp_alt_va)
+		return;
+	/* FIXMAP_PAGE_IO — matches permanent ioremap / access-ramoops attrs. */
+	va = early_ioremap(AXP_ALT_PHYS, AXP_MAP_SIZE);
+	if (!va)
+		return;
+	WRITE_ONCE(axp_alt_va, va);
+	axp_va_is_early = true;
+	axp_adopt_prior_first();
+	if (!atomic_read(&axp_first_latch))
+		axp_diag_milestone("early_map");
+}
+
+void __init axp_diag_map_permanent(void)
+{
+	void __iomem *va;
+	void __iomem *old;
+
+	/*
+	 * Ordinary ioremap needs get_vm_area → kzalloc / vmalloc.
+	 * Call only after mm_init(). Never from setup_arch/paging_init.
+	 */
+	va = ioremap(AXP_ALT_PHYS, AXP_MAP_SIZE);
+	if (!va)
+		return;
+
+	old = READ_ONCE(axp_alt_va);
+	/* Publish permanent first so writers never see a stale early VA. */
+	WRITE_ONCE(axp_alt_va, va);
+	wmb();
+
+	if (axp_va_is_early && old) {
+		early_iounmap(old, AXP_MAP_SIZE);
+		axp_va_is_early = false;
+	} else if (old && old != va) {
+		iounmap(old);
+	}
+
+	axp_adopt_prior_first();
+	if (!atomic_read(&axp_first_latch))
+		axp_diag_milestone("perm_map");
+}
+
+void __init axp_diag_after_mm_init(void)
+{
+	axp_diag_map_permanent();
+	if (!atomic_read(&axp_first_latch))
+		axp_diag_milestone("mm_init");
+}
+
+static int __init axp_diag_pure_init(void)
+{
+	if (!READ_ONCE(axp_alt_va))
+		axp_diag_map_permanent();
+	if (!atomic_read(&axp_first_latch))
+		axp_diag_milestone("pure_init");
+	return 0;
+}
+pure_initcall(axp_diag_pure_init);
+
+static int __init axp_diag_core_init(void)
+{
+	if (!atomic_read(&axp_first_latch))
+		axp_diag_milestone("core_init");
+	return 0;
+}
+core_initcall(axp_diag_core_init);
+
+static int notrace axp_panic_notifier(struct notifier_block *nb,
+				      unsigned long action, void *data)
+{
+	axp_diag_mark_event('P', data ? (const char *)data : "notifier",
+			    __builtin_return_address(0));
+	return NOTIFY_OK;
+}
+
+static struct notifier_block axp_panic_nb = {
+	.notifier_call = axp_panic_notifier,
+	.priority = INT_MAX,
+};
+
+static int __init axp_diag_panic_reg(void)
+{
+	atomic_notifier_chain_register(&panic_notifier_list, &axp_panic_nb);
+	if (!atomic_read(&axp_first_latch))
+		axp_diag_milestone("panic_reg");
+	return 0;
+}
+postcore_initcall(axp_diag_panic_reg);
+"""
+
+
+def write_capture_c(root: Path) -> None:
+    path = root / "kernel" / "axp_diag_capture.c"
+    body = (
+        CAPTURE_C.replace("__SUNFISH_ALT_PHYS__", SUNFISH_ALT_PHYS)
+        .replace("__ATTEMPT__", ATTEMPT)
+    )
+    if body.startswith("\n"):
+        body = body[1:]
+    path.write_text(body)
+    print(f"wrote {path} attempt={ATTEMPT}")
+
+
+def patch_makefile(path: Path) -> None:
+    t = path.read_text()
+    if "axp_diag_capture.o" in t:
+        print(f"skip {path} (axp_diag_capture already listed)")
+        return
+    old = "obj-y     = fork.o exec_domain.o panic.o \\"
+    new = f"obj-y     = fork.o exec_domain.o panic.o axp_diag_capture.o \\"  # {MARKER_MAKEFILE}
+    if old not in t:
+        raise SystemExit(f"kernel/Makefile obj-y panic.o line not found in {path}")
+    path.write_text(t.replace(old, new, 1))
+    print(f"patched {path}")
+
+
+def patch_main_mm(path: Path) -> None:
+    t = path.read_text()
+    if "axp_diag_after_mm_init" in t:
+        print(f"skip {path} (already patched)")
+        return
+    old = "\tmm_init();\n"
+    if t.count(old) < 1:
+        raise SystemExit(f"mm_init(); not found in {path}")
+    new = f"""\tmm_init();
+{MARKER_MAIN_MM}
+	{{
+		extern void axp_diag_after_mm_init(void);
+		axp_diag_after_mm_init();
+	}}
+"""
+    path.write_text(t.replace(old, new, 1))
+    print(f"patched mm_init hook in {path}")
+
+
+def patch_arm64_setup(path: Path) -> None:
+    """Early IO map only — no ioremap before mm_init."""
+    t = path.read_text()
+
+    # Strip obsolete v3 permanent hook after paging_init if present.
+    perm_block = re.compile(
+        r"\tpaging_init\(\);\n"
+        r"/\* AXP_Resurection: axp-diag perm_map \*/\n"
+        r"\t\{\n"
+        r"\t\textern void axp_diag_map_permanent\(void\);\n"
+        r"\t\taxp_diag_map_permanent\(\);\n"
+        r"\t\}\n",
+    )
+    t2, n = perm_block.subn("\tpaging_init();\n", t, count=1)
+    if n:
+        t = t2
+        print(f"removed obsolete paging_init ioremap hook from {path}")
+
+    if "axp_diag_map_early" in t:
+        path.write_text(t)
+        print(f"skip early hook in {path} (already present)")
+        return
+
+    early_old = "\tjump_label_init();\n\tparse_early_param();\n"
+    early_new = f"""\tjump_label_init();
+{MARKER_SETUP_EARLY}
+	{{
+		extern void axp_diag_map_early(void);
+		axp_diag_map_early();
+	}}
+	parse_early_param();
+"""
+    if early_old not in t:
+        raise SystemExit(f"jump_label_init/parse_early_param block not found in {path}")
+    path.write_text(t.replace(early_old, early_new, 1))
+    print(f"patched arm64 setup early_ioremap in {path}")
+
+
+def _replace_fortify_panic(t: str) -> str:
+    if "fortify-diag capture v4" in t:
+        return t
+
+    new = f"""{MARKER_PANIC}
+extern void axp_diag_mark_event(char type, const char *token, void *caller);
+void fortify_panic(const char *name)
+{{
+	void *caller = __builtin_return_address(0);
+
+	/* Durable record FIRST — before printk/stack (may fault). Never maps. */
+	axp_diag_mark_event('F', name, caller);
+	pr_emerg("FORTIFY_DIAG: overflow in %s caller=%pS attempt=%s\\n",
+		 name, caller, "{ATTEMPT}");
+	dump_stack();
+	BUG();
+}}
+"""
+
+    stock = """void fortify_panic(const char *name)
+{
+	pr_emerg("detected buffer overflow in %s\\n", name);
+	BUG();
+}
+"""
+    if "AXP_Resurection: fortify-diag capture" in t:
+        pat = re.compile(
+            r"/\* AXP_Resurection: fortify-diag capture(?: v[0-9]+)? \*/.*?^void fortify_panic\(const char \*name\)\n\{.*?\n\}\n",
+            re.S | re.M,
+        )
+        m = pat.search(t)
+        if m:
+            return t[: m.start()] + new + t[m.end() :]
+    if stock in t:
+        return t.replace(stock, new, 1)
+    raise SystemExit("fortify_panic body not found / unrecognized")
+
+
+def patch_fortify_panic(path: Path) -> None:
+    t = path.read_text()
+    if "fortify-diag capture v4" in t:
+        print(f"skip {path} (already v4)")
+        return
+    path.write_text(_replace_fortify_panic(t))
+    print(f"patched fortify_panic v4 in {path}")
+
+
+def patch_sysrq(path: Path) -> None:
+    t = path.read_text()
+    if "axp-diag-sysrq-v4" in t:
+        print(f"skip {path} (already v4)")
+        return
+    if "sysrq_handle_crash" not in t:
+        raise SystemExit(f"sysrq_handle_crash missing in {path}")
+
+    new_crash = """/* AXP_Resurection: axp-diag-sysrq-v4 */
+extern void axp_diag_mark_event(char type, const char *token, void *caller);
+static void sysrq_handle_crash(int key)
+{
+	rcu_read_unlock();
+	axp_diag_mark_event('C', "sysrq-c", __builtin_return_address(0));
+	panic("sysrq triggered crash\\n");
+}
+
+static void sysrq_handle_axp_mark(int key)
+{
+	axp_diag_mark_event('X', "sysrq-x", __builtin_return_address(0));
+}
+static struct sysrq_key_op sysrq_axp_mark_op = {
+	.handler	= sysrq_handle_axp_mark,
+	.help_msg	= "axp-mark(x)",
+	.action_msg	= "AXP alt diag mark",
+	.enable_mask	= SYSRQ_ENABLE_DUMP,
+};
+"""
+
+    if "AXP_Resurection: axp-diag-sysrq" in t or "pstore-alt-plain-sysrq" in t:
+        pat = re.compile(
+            r"/\* AXP_Resurection: (?:axp-diag-sysrq-v[0-9]+|pstore-alt-plain-sysrq) \*/.*?"
+            r"(?:static struct sysrq_key_op sysrq_axp_mark_op = \{.*?\};\n|"
+            r"panic\(\"sysrq triggered crash\\n\"\);\n\})",
+            re.S,
+        )
+        m = pat.search(t)
+        if m:
+            t = t[: m.start()] + new_crash + t[m.end() :]
+        else:
+            raise SystemExit(f"could not replace prior sysrq axp block in {path}")
+    else:
+        stock = """static void sysrq_handle_crash(int key)
+{
+	/* release the RCU read lock before crashing */
+	rcu_read_unlock();
+
+	panic("sysrq triggered crash\\n");
+}
+"""
+        if stock not in t:
+            raise SystemExit(f"unrecognized sysrq_handle_crash form in {path}")
+        t = t.replace(stock, new_crash, 1)
+
+    if "axp_sysrq_mark_init" not in t:
+        t += """
+/* AXP_Resurection: axp-diag-sysrq-v4-reg */
+static int __init axp_sysrq_mark_init(void)
+{
+	register_sysrq_key('x', &sysrq_axp_mark_op);
+	return 0;
+}
+device_initcall(axp_sysrq_mark_init);
+"""
+    else:
+        t = re.sub(
+            r"axp-diag-sysrq-v[0-9]+-reg",
+            "axp-diag-sysrq-v4-reg",
+            t,
+            count=1,
+        )
+
+    path.write_text(t)
+    print(f"patched sysrq v4 in {path}")
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        print(f"usage: {sys.argv[0]} /path/to/msm-4.14", file=sys.stderr)
+        return 2
+    root = Path(sys.argv[1])
+    write_capture_c(root)
+    patch_makefile(root / "kernel" / "Makefile")
+    patch_arm64_setup(root / "arch" / "arm64" / "kernel" / "setup.c")
+    patch_main_mm(root / "init" / "main.c")
+    patch_fortify_panic(root / "lib" / "string.c")
+    patch_sysrq(root / "drivers" / "tty" / "sysrq.c")
+    print(f"fortify-diag v4 apply OK attempt={ATTEMPT}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,33 @@
+# Stage 1 — AXP Graphene/AH patches that apply clean on LOS msm-4.14 @ 28f9290ae067
+# Paths relative to /srv/rom/references/axp/kernel_patches
+# Source attribution: AXP/Divest kernel_patches @ df3cab2155b3 (GrapheneOS-derived series)
+0005-Graphene-Deny_USB/4.14/0003.patch
+0008-Graphene-Kernel_Hardening-allocsize/4.14/0002.patch
+0008-Graphene-Kernel_Hardening-allocsize/4.14/0011.patch
+0008-Graphene-Kernel_Hardening-allocsize/4.14/0016.patch
+0008-Graphene-Kernel_Hardening-allocsize/4.14/0021.patch
+0008-Graphene-Kernel_Hardening-bugon/4.14/0010.patch
+0008-Graphene-Kernel_Hardening-fortify/4.14/0004.patch
+0008-Graphene-Kernel_Hardening-misc/4.14/0001.patch
+0008-Graphene-Kernel_Hardening-misc/4.14/0005.patch
+0008-Graphene-Kernel_Hardening-misc/4.14/0010.patch
+0008-Graphene-Kernel_Hardening-misc/4.14/0018.patch
+0008-Graphene-Kernel_Hardening-random/4.14/0002.patch
+0008-Graphene-Kernel_Hardening-random/4.14/0007.patch
+0008-Graphene-Kernel_Hardening-random/4.14/0012.patch
+0008-Graphene-Kernel_Hardening-random/4.14/0017.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0002.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0012.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0017.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0028.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0030.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0032.patch
+0008-Graphene-Kernel_Hardening-ro/4.14/0038.patch
+0008-Graphene-Kernel_Hardening-sanitize/4.14/0005.patch
+0008-Graphene-Kernel_Hardening-sanitize/4.14/0009.patch
+0008-Graphene-Kernel_Hardening-sanitize/4.14/0015.patch
+0008-Graphene-Kernel_Hardening-sanitize/4.14/0017.patch
+0008-Graphene-Kernel_Hardening-slab/4.14/0006.patch
+0008-Graphene-Kernel_Hardening-slab/4.14/0014.patch
+0008-Graphene-Kernel_Hardening-unused/4.14/0001.patch
+0008-Graphene-Kernel_Hardening-unused/4.14/0002.patch
@@ -0,0 +1,42 @@
+# US-S5-1 — Yama + SLAB freelist random (defconfig)
+
+**Track**: AXP Resurection Pro Magisk, unlocked sunfish.  
+**On top of**: Stage1 + combo4 + FORTIFY + CVE clean-429 + hi-batch1–3.
+
+## Why
+
+High-offset KEEP CVEs are already on the ship pack. Remaining ge200 KEPT
+items were **nf_tables** (`CVE-2023-3777`, `CVE-2024-26643`) — skipped on
+purpose in batch3. Next attributable kernel depth without reopening CVE
+quarantine:
+
+| Knob | Before | After | Attribution |
+|------|--------|-------|-------------|
+| `CONFIG_SECURITY_YAMA` | unset (but `CONFIG_LSM` listed yama) | `=y` | Graphene/AXP LSM stack; ptrace scope |
+| `CONFIG_SLAB_FREELIST_RANDOM` | unset | `=y` | Graphene/AH slab hardening companion to existing `SLAB_FREELIST_HARDENED` |
+
+## Apply
+
+```bash
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh \
+  kernel/google/msm-4.14
+```
+
+Wired into `scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh` after
+Stage1+combo4+CVE apply.
+
+## LAB verify
+
+```text
+zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
+zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
+cat /proc/sys/kernel/yama/ptrace_scope   # expect 1 (default)
+pidof magiskd                            # still up
+```
+
+## Out of scope here
+
+- `CVE-2022-49980` lock-scope port (still denylist)
+- nf_tables high-offset CVEs
+- Stage1 slab FAIL patches (`0010`/`0018` still reject on this tree)
+- `hardened_malloc` / bootloader lock
@@ -0,0 +1,17 @@
+# US-S2 — project release keys (Gate G).
+# Soong requires paths inside ANDROID_BUILD_TOP (absolute $HOME/.android-certs panics).
+# Host: copy keys into vendor/sunfish-a16/certs/ (gitignored). See docs/009-hardening-signing-checklist.md
+
+_AXP_CERT_DIR := vendor/sunfish-a16/certs
+
+ifneq ($(wildcard $(_AXP_CERT_DIR)/releasekey.pk8),)
+  PRODUCT_DEFAULT_DEV_CERTIFICATE := $(_AXP_CERT_DIR)/releasekey
+  PRODUCT_OTA_PUBLIC_KEYS := $(_AXP_CERT_DIR)/releasekey.x509.pem
+  # Without this, non-Google BT apex keeps AOSP security/bluetooth.x509.pem in
+  # plat_mac_permissions while apps sign with $(_AXP_CERT_DIR)/bluetooth →
+  # seinfo=default → zygote setcontext fails → Bluetooth crash loop (LAB 2026-10-02).
+  PRODUCT_MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES := $(_AXP_CERT_DIR)
+endif
+
+# Host setup: also symlink certs/testkey.{pk8,x509.pem} -> releasekey.*
+# (system/sepolicy keys.conf @RELEASE still references testkey.x509.pem in this dir).