009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/patches/009-kernel-hardening/BUILD-FIXES.md

@@ -0,0 +1,22 @@
+# Stage1 build fixes (FR-017)
+
+> **2026-09-26 audit:** The FORTIFY BUG stubs below are a historical link
+> workaround, **not an accepted fix**. The latest ksync FORTIFY image fails
+> boot according to the owner. Clang exclusion in Kconfig references an
+> undefined CC_IS_CLANG symbol. See
+> [the FORTIFY audit](../../../../docs/009-fortify-boot-audit-20260926.md)
+> before reusing this workaround.
+
+Applied on host `msm-4.14` when Stage1 Graphene/AH hit compile/link issues:
+
+1. **slab 0014 misfuzz** — Graphene patch targeted `slab_equal_or_root`;
+   fuzz applied to `is_root_cache`. Reverted `is_root_cache` to `return true`.
+   LOS already has `slab_equal_or_root` → `s == p`.
+2. **FORTIFY + Clang LTO (historical, invalid as ship fix)** —
+   `CONFIG_FORTIFY_SOURCE=y` caused modpost undefined `__read_overflow*` /
+   `__write_overflow` in qcacld/techpack. Temporary `BUG()` stubs were
+   added in `lib/string.c` to force a link; LAB then failed to boot.
+   **Do not reuse.** Real work: Clang FORTIFY port — see
+   `docs/009-fortify-clang-port.md` and `docs/009-fortify-boot-audit-20260926.md`.
+
+See `docs/009-kernel-hardening-map.md`.