009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/patches/009-kernel-hardening/fortify-clang/README.md

@@ -0,0 +1,36 @@
+# FORTIFY Clang port for msm-4.14 (LOS sunfish)
+
+Based on Kees Cook *fortify: Add Clang support* (upstream ~2022), adapted
+to 4.14’s in-`string.h` FORTIFY (no `fortify-string.h` yet).
+
+**Not** AXP `0004` (strict-string). **Not** `BUG()` link stubs.
+
+See `docs/009-fortify-clang-port.md`.
+
+## Apply
+
+```bash
+# on rom-dev01, after git reset of msm-4.14:
+python3 apply_fortify_clang.py /path/to/msm-4.14
+patch -p1 -d /path/to/msm-4.14 < 0001-driver-bounds-rtac-fils.patch
+```
+
+`ksync-one.sh` with `CONFIG_FORTIFY_SOURCE` runs both automatically.
+
+Then enable `CONFIG_FORTIFY_SOURCE=y` and build **without**
+`ALLOW_FORTIFY_BUG_STUBS`.
+
+## Nested strlen (required)
+
+With Clang `__pass_object_size`, fortified `strlcpy`/`strcpy` must call
+`__underlying_strlen(q)`, not fortified `strlen(q)`. Otherwise a known
+source object size makes `strlen` panic at boot (LAB: `strlen+strlcpy`
+fail; `strlen+strncpy` OK). `apply_fortify_clang.py` rewrites both.
+
+## Diag capture (v4)
+
+`apply_fortify_diag.py` — `early_ioremap` before `parse_early_param`, ordinary
+`ioremap` only after `mm_init`, never map from the failure handler; failure
+and milestone zones separated. See `docs/009-fortify-diag-capture-plan.md`
+and `docs/009-fortify-diag-v3-review-20260927.md`. Control:
+`PSTORE_ALT_PLAIN=1` / `scripts/009-bisect-ksync-pstore-alt-plain.sh`.