009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/patches/009-kernel-hardening/README.md

@@ -0,0 +1,83 @@
+# 009 kernel hardening Stage 1 (FR-017)
+
+**Source**: AXP `kernel_patches` @ `df3cab2155b3` (GrapheneOS / AndroidHardening
+series in Divest-era layout).  
+**Base**: LOS `kernel/google/msm-4.14` @ `28f9290ae067` (`4.14.357-openela`).  
+**Map**: `docs/009-kernel-hardening-map.md`.
+
+## Files
+
+| File | Role |
+|------|------|
+| `stage1.list` | Ordered allowlist (30 patches) |
+| `apply_stage1.sh` | Applies list onto a kernel tree |
+
+## Host usage (`rom-dev01`)
+
+```bash
+# dry-run
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
+  /srv/rom/src/lineage/kernel/google/msm-4.14 --dry-run
+
+# apply (dirties the lineage kernel checkout)
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh \
+  /srv/rom/src/lineage/kernel/google/msm-4.14
+```
+
+Optional: `AXP_KERNEL_PATCHES=/path/to/kernel_patches`.
+
+After apply, flip `sunfish_defconfig` options that the new Kconfig allows
+(at least `CONFIG_FORTIFY_SOURCE=y`); see map `KH-CFG`.
+
+## Boot-OK pack (2026-09-28 LAB) — prefer for Magisk bacon
+
+Stage1 Graphene alone historically hung at the Google logo on LOS23/Clang.
+The pack that boots with Magisk-track `boot-make` is **combo4 + Clang FORTIFY**
+(no Stage1 mega-pack):
+
+```bash
+# on a reset msm-4.14 @ 28f9290ae067:
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh \
+  /path/to/msm-4.14
+```
+
+That applies `fortify-clang/` (incl. nested `__underlying_strlen` fix) +
+driver bounds + defconfig:
+`FORTIFY_SOURCE`, `INIT_ON_*`, `SECURITY_DMESG_RESTRICT`,
+`SLAB_FREELIST_HARDENED`. Bacon entrypoint:
+`scripts/009-bacon-axp-combo4-fortify.sh`.
+
+## Stage1 + combo4 (full bacon, Wi‑Fi coherent)
+
+```bash
+# reset msm-4.14 @ 28f9290ae067, then:
+bash vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1_combo4.sh \
+  /path/to/msm-4.14
+# bacon: scripts/009-bacon-axp-stage1-combo4.sh
+```
+
+Order: Stage1 (30) → slab BUILD-FIXES if needed → combo4+FORTIFY.
+Ship via **sideload of the zip** (matching vendor/`wlan.ko`). Do not flash
+only the new boot onto an old slot.
+
+**LAB accepted 2026-09-29:** see `docs/009-gate-g-kernel-attribution.md`.
+
+## GPS / location (FR-018 — do not regress)
+
+Owner wants **precise, fast GPS** (stock LOS behaviour). **Never** apply AXP
+location lockdown, SUPL/IMSI stripping that hurts TTFF, or extra location
+caps vs LOS 23.2. Stage1 list, `cve-strict.list`, and denylist must stay
+free of location-lockdown series (`KH-LOC` = skip). If a future CVE hunk
+touches GNSS/GPS paths only for a real security fix, keep LOS-equivalent
+behaviour and document; do not “harden location” as a side goal.
+
+## Not in Stage 1 alone
+
+- CVE mega — now staged via `apply_stage1_combo4_cve.sh` + `cve-strict.list`
+  (~503 AXP allowlist from 2026-09-18 strict pass; `cve-denylist.txt` skipped).
+  Bacon: `scripts/009-bacon-axp-stage1-combo4-cve.sh` (test-keys; after
+  boot-OK Stage1 pack). **Do not** flash `20260918*-axp-kh-cve/full`.
+- LinuxIncrementals
+- Failed probe patches (port later)
+- Location lockdown (FR-018)
+- Iodé kernel (no sunfish 4.14 fork found)