<!-- Status: parallel KernelSU track — see docs/007-parallel-on-009.md -->

> **Status: parallel KernelSU / SusFS track** (kept). Bridge to current Magisk ROM: [`007-parallel-on-009.md`](007-parallel-on-009.md). Magisk ship resume: [`009-handoff-20261008.md`](009-handoff-20261008.md).

# SusFS + ReSukiSU on sunfish LOS 23.2 — full attempt log (for external review)

> **Audit correction (2026-09-16):** See [source and artifact audit](007-susfs-source-audit.md).
> The claims below that missing MANUAL_HOOK caused the vibrator hang, or that
> the upstream hook choice is intrinsically broken, are hypotheses, not proven
> causes. The audit confirms incompatible installed/vendor module CRCs, an
> exec post-hook use-after-free, and incomplete/mismatched SUSFS API wrappers.
> The exact early-panic cause still requires a trace or controlled experiment.

**Date compiled:** 2026-09-16  
**Project:** `sunfish-a16-rom` (independent; not SSYSTEMS)  
**Device (LAB only):** Pixel 4a `sunfish`, serial `11231JEC207477`  
**ROM base:** LineageOS **23.2** / Android **16** (`lineage-23.2-20260915-UNOFFICIAL-sunfish`)  
**Goal:** ReSukiSU root **plus** SusFS hide addon on **our** `msm-4.14` tree (A16), using abu/GOLDEN as **behavioural oracles**, not as flash images.

**Ask for help:** Why do MANUAL_HOOK + AUTO_* + CONFIG_KSU_SUSFS builds still `kernel_panic` before userspace on this tree, while (1) penúltimo ReSukiSU-without-SusFS boots, and (2) an earlier SusFS-without-MANUAL build reached Android (then hung on vibrator)? What remaining XOR / composition bugs exist in ReSukiSU when treating SusFS as an addon like KernelSU-Next?

---

## 1. Concepts (do not confuse)

| Name | What it is |
|------|------------|
| **KernelSU (KSU)** | Generic root-in-kernel project family |
| **ReSukiSU** | Fork we ship (kernel driver + Manager). Version code **35153**, `v4.2.0-rc2-…@ReSukiSU` |
| **KernelSU-Next** | Different fork; what **abu** wires in their reference tree |
| **SusFS** | Kernel **addon** (simonpunk) for path/mount/uname/cmdline hide. **Not** a replacement for ReSukiSU. Should sit **on top** of a KSU-family driver |

**Intended product stack:**

```
apps / banks
    ↑
 SusFS          ← optional hide (compile into boot)
    ↑
 ReSukiSU       ← root
    ↑
 msm-4.14 + LOS 23.2 system
```

**abu product habit:** two boots (root-only vs root+SusFS). Same idea: SusFS on/off at **compile time** in the boot image, not a runtime “activate SusFS” without the code in the kernel.

---

## 2. Important paths (host `rom-dev01` + laptop)

### Host

| Path | Role |
|------|------|
| `/srv/rom/src/lineage/` | LOS 23.2 tree |
| `/srv/rom/src/lineage/kernel/google/msm-4.14/` | Our kernel (dirty: ReSukiSU + SusFS + patches) |
| `/srv/rom/src/lineage/kernel/google/msm-4.14/drivers/kernelsu/` | ReSukiSU kernel module sources (in-tree) |
| `/srv/rom/src/lineage/kernel/google/msm-4.14/fs/susfs.c` | SusFS implementation |
| `/srv/rom/src/lineage/kernel/google/msm-4.14/arch/arm64/configs/sunfish_defconfig` | Defconfig (KSU/SusFS/debug knobs) |
| `/srv/rom/src/lineage/device/google/sunfish/BoardConfig-common.mk` | `BOARD_KERNEL_CMDLINE`; optional `SUNFISH_DEBUG_PANIC_SCREEN=1` → `panic=0 console=tty0` |
| `/srv/rom/artifacts/007-kernelsu/` | Boot images + managers + RCA |
| `/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/` | ikconfig diffs, notes, abu checklist |
| `/srv/rom/artifacts/007-kernelsu/run-susfs-bootimage.sh` | Normal SusFS bootimage builder |
| `/srv/rom/artifacts/007-kernelsu/run-susfs-bootimage-debug.sh` | DEBUG builder (`SUNFISH_DEBUG_PANIC_SCREEN=1`) |
| `/srv/rom/logs/007-build/susfs-bootimage.log` | Cumulative build log (script tee) |
| `/srv/rom/logs/007-build/susfs-bootimage-debug.log` | Debug build log |
| `/srv/rom/artifacts/detach-*.log` | Per-session `rom-detach` logs |
| `/srv/rom/references/abu-msm-4.14-ksu/` | **abu reference kernel** (A15-era). `drivers/kernelsu` → symlink `KernelSU-Next/kernel` |
| `/srv/rom/references/resukisu/` | ReSukiSU git reference (non-shallow; version from `rev-list`) |
| `/srv/rom/references/susfs4ksu/` | Upstream SusFS project reference |
| `/srv/rom/artifacts/007-kernelsu/abu-reference/` | Owner-supplied abu `boot-abu` / `dtbo-abu` (reference only; **do not flash as ours**) |

### Laptop workspace

| Path | Role |
|------|------|
| `/home/aventura/Workspaces/sunfish-a16-rom/` | Git project |
| `.local-artifacts/007-kernelsu/` | Copied boots, klog dumps, Manager APKs |
| `docs/007-kernelsu-runbook.md` | Runbook |
| `docs/007-abu-vs-ours-susfs.md` | abu vs ours checklist |
| `docs/007-debug-boot-panic-screen.md` | Debug boot / photo Oops notes |
| `specs/007-kernelsu-sunfish/` | Feature spec/tasks |

**SSH:** `ssh a16-build` → `android-build@rom-dev01` (see `docs/ssh/config`).

---

## 3. Boot image changelog (chronological)

All under `/srv/rom/artifacts/007-kernelsu/` (and laptop `.local-artifacts/007-kernelsu/` when copied).

| Stamp / file | uname / notes | Config essence | LAB result |
|--------------|---------------|----------------|------------|
| **Penúltimo** `boot-resukisu-our-20260915T183729Z.img` | `#1 … Tue Sep 15 18:06:17 UTC 2026` | `MANUAL_HOOK=y` + all **AUTO_***=y; **SusFS off** | **GOOD** — daily LAB root |
| `boot-005-known-good.img` | Stock bacon kernel (no KSU in practice for root) | LOS boot from zip | Emergency recovery when slots broken |
| **SusFS #1** `…-susfs-20260916T004038Z.img` | `#3 … Wed Sep 16 00:43:54` | `CONFIG_KSU_SUSFS=y`, **`MANUAL_HOOK` unset** (choice XOR) | Kernel up, **adb alive**, bootanim forever: `system_server` stuck in **VibratorManagerService.nativeGetVibratorIds** (~66s watchdog) |
| **SusFS #2** `…-susfs-20260916T091211Z.img` | `#4 … Wed Sep 16 09:21:41` | After Kconfig patch: `MANUAL_HOOK=y` + SusFS; **AUTO_* all unset** | **Google logo → reboot loop** (earlier than #1) |
| **SusFS #3** `…-susfs-20260916T104649Z.img` | `#6 … Wed Sep 16 10:51:09` | `MANUAL` + **AUTO_***=y + SusFS; `susfs_init` in MANUAL path; link fix for `ksu_init_rc_hook` | Still logo→reboot. Proven on **slot a** (same system as penúltimo) → **not A/B system_b** |
| **SusFS #4 sigfix** `…-susfs-20260916T112839Z.img` | `#7 … Wed Sep 16 11:32:09` sha `472a32d8…` | + sucompat **faccessat/stat** signatures: SusFS `struct filename**` only if `SUSFS && !MANUAL` | **Worse** — returns to fastboot **faster** |
| **SusFS #5 DEBUG** (building at doc time) | `susfs-boot-debug` session | #4 macros fix (`susfs_*` privilege macros only if `!MANUAL`) + `PANIC_TIMEOUT=0`, no `QCOM_FORCE_WDOG_BITE_ON_PANIC`, `VT`+`FRAMEBUFFER_CONSOLE`, cmdline `panic=0 console=tty0`, `SPOOF_CMDLINE` off | Pending |

**Known-good rollback always:**  
`boot-resukisu-our-20260915T183729Z.img` on `boot_a` + `--set-active=a`.

**Manager matching 35153:**  
`ReSukiSU_v4.2.0-rc2-spoofed_35153-arm64-v8a-release.apk`  
(without Manager, `su` missing even if kernel has KSU).

---

## 4. Root-cause chain (what we learned)

### 4.1 ReSukiSU upstream treats SusFS as a **hooking method** (XOR)

Kconfig `choice "KernelSU Hooking Method"` originally included `KSU_SUSFS` alongside `KSU_MANUAL_HOOK` / `KSU_TRACEPOINT_HOOK`.

Enabling SusFS in defconfig → warning `override: KSU_SUSFS changes choice state` → **MANUAL_HOOK off**.

**ikconfig proof (T004038Z vs penúltimo):** see  
`/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/ikconfig.diff`.

**abu / KernelSU-Next model (correct for addon):** SusFS is a separate `bool` menu under KSU, **not** in the hook choice. Hooks = KPROBES (or manual). `susfs_init()` under `#ifdef CONFIG_KSU_SUSFS` always.

### 4.2 First LAB symptom (T004038Z) — vibrator watchdog

- Not an early panic: Android mostly up, adb works.  
- `WATCHDOG KILLING SYSTEM PROCESS` blocked in `VibratorManagerService.nativeGetVibratorIds`.  
- Interpreted as fallout of **missing MANUAL_HOOK** (broken input/LSM hook path / module vermagic issues discussed; drv2624 is vendor module).

### 4.3 After forcing MANUAL+SusFS — early `kernel_panic`

Builds with MANUAL (+ later AUTO) + SusFS die at **Google logo**, reboot, often land in **fastboot** after retries.

**Logging reality on Pixel 4a:**

- Bootloader **does not support** `fastboot fetch`.  
- `/dev/block/by-name/klog` and `logfs` dumps show many `PM: Reason: kernel_panic` / `HARD RESET by PS_HOLD` but **no Oops / Call trace**.  
- `/sys/fs/pstore` empty after successful penúltimo boot; Pixel ramoops often encrypted (`/vendor/bin/ramoops`, keys under CE — missing/unusable in our tries).  
- Console default: `console=ttyMSM0` only; `# CONFIG_VT is not set` historically → **no Oops text on panel** (only logo).

### 4.4 Composition bugs fixed in-tree (still not enough for a clean boot)

Patches applied under `drivers/kernelsu/` (and defconfig / BoardConfig):

| # | File(s) | Change |
|---|---------|--------|
| 1 | `Kconfig` + `Kbuild` | SusFS **out of** hook `choice`; SusFS addon + MANUAL together (abu-like). Snapshot: `susfs-fail-rca/kconfig-fix-20260916T090322Z/` |
| 2 | `arch/.../sunfish_defconfig` | Re-enable `AUTO_SETUID/INITRC/INPUT=y` (T091211Z had them explicitly **unset**) |
| 3 | `runtime/ksud_integration.c` | `#elif CONFIG_KSU_SUSFS` → only if `&& !CONFIG_KSU_MANUAL_HOOK` so `ksu_init_rc_hook` is defined under MANUAL+AUTO (else **link error** `undefined symbol: ksu_init_rc_hook`) |
| 4 | `core/init.c` | In `MANUAL_HOOK` branch, also `#ifdef CONFIG_KSU_SUSFS susfs_init()` (abu always inits SusFS) |
| 5 | `feature/sucompat.h` + `.c` | `faccessat`/`stat`: SusFS `struct filename **` API **only** if `SUSFS && !MANUAL`. MANUAL call sites in `fs/open.c` / `fs/stat.c` pass `const char __user **` — with SusFS signatures → **ABI mismatch / panic** |
| 6 | `feature/sucompat.h` | Privilege macros: SusFS `susfs_is_current_proc_no_su` etc. **only** if `SUSFS && !MANUAL` (was still SusFS when both set — likely early panic) |
| 7 | defconfig + BoardConfig (DEBUG) | `PANIC_TIMEOUT=0`, disable `QCOM_FORCE_WDOG_BITE_ON_PANIC`, enable `VT`/`FRAMEBUFFER_CONSOLE`, cmdline `panic=0 console=tty0` when `SUNFISH_DEBUG_PANIC_SCREEN=1`; `SPOOF_CMDLINE` off |

** empirically:** fix #5 (sigfix T112839Z) made LAB failure **faster** to fastboot → either wrong direction for some other call path, or #6 was the dominant bug and #5 alone left broken macros. #6 is in the DEBUG build, **not yet LAB-proven**.

### 4.5 Slot / A/B lesson (not the SusFS root cause)

- After failed trials, `current-slot:b`, `slot-unbootable:a:yes` left LAB unbootable until **both** slots got `boot-005` + `--set-active=a`.  
- SusFS on **slot a** (same `system_a` as working penúltimo) **still** bootlooped → failure is **SusFS/MANUAL kernel composition**, not stale `system_b`.

**Flash discipline now:** penúltimo on `boot_a`, experiment on `boot_b`, `--set-active`; rollback = `--set-active=a` (and reflash `a` if needed).

---

## 5. Critical comparison: why T004038Z got further than MANUAL+SusFS

| | T004038Z (SusFS as hook choice) | T091211Z+ (MANUAL+SusFS addon attempts) |
|--|----------------------------------|----------------------------------------|
| MANUAL_HOOK | **off** | **on** (+ AUTO on later builds) |
| Early boot | Survives to userspace / adb | `kernel_panic`, logo loop |
| Later failure | Vibrator HAL / system_server watchdog | Never gets there |

**Hypothesis for reviewers:** ReSukiSU still has multiple `#ifdef CONFIG_KSU_SUSFS` paths written for **XOR** (SusFS *instead of* MANUAL). Turning both on without auditing every `elif` leaves:

- Wrong sucompat prototypes vs `fs/*.c` hooks  
- Wrong privilege helpers (`susfs_*` vs TIF flags)  
- Possibly more (execveat_sucompat, dispatch mark, input hooks, etc.)

abu avoids this by using **Next + KPROBES** and SusFS as a pure addon with `#ifdef CONFIG_KSU_SUSFS` init, not ReSukiSU’s choice XOR.

---

## 6. abu reference details (oracle, not flash path)

**Tree:** `/srv/rom/references/abu-msm-4.14-ksu/`  
**KSU:** `drivers/kernelsu` → `../KernelSU-Next/kernel`  

**Kconfig pattern (excerpt behaviour):**

- `CONFIG_KSU` tristate  
- `CONFIG_KSU_KPROBES_HOOK` (default y) — not ReSukiSU MANUAL choice  
- `menu "KernelSU - SUSFS"` → `CONFIG_KSU_SUSFS` bool addon + many `KSU_SUSFS_*` features  
- `ksu.c`: `#ifdef CONFIG_KSU_SUSFS` → `susfs_init();` **unconditional on SusFS**, independent of kprobes  

**Feature flags abu has that our ReSukiSU SusFS Kconfig may lack:**  
`HAS_MAGIC_MOUNT`, `AUTO_ADD_SUS_*`, `TRY_UMOUNT*`, `SUS_SU` (kprobes), etc.

**abu `sunfish_defconfig` in this mirror:** **0** `CONFIG_KSU*` lines — do not treat as the SusFS pin list.

**Owner note:** abu also ships separate ReSukiSU-oriented boots / managers under artifacts; still **reference**. Our flash path is only `/srv/rom/artifacts/007-kernelsu/boot-resukisu-*` built from **our** tree.

---

## 7. Parallel work same day (context, not SusFS)

- microG Location UI missing on LAB: we had staged official **`*-hw.apk`** (`versionName=…-hw`) which **omits** `NetworkLocationService` / `NetworkLocationProviderService`.  
- GOLDEN/abu show full Location options with **default** (non-hw) GmsCore.  
- Fixed: stage `com.google.android.gms-252432032.apk` (non-hw); LAB `adb install -r` restored NLP UI.  
- GOLDEN/abu = **A15 scheme oracle**; we keep **newer** packages on A16.

---

## 8. How we build / logs

```bash
# normal SusFS bootimage (host)
/srv/rom/artifacts/bin/rom-detach susfs-boot-NAME -- \
  bash -lc /srv/rom/artifacts/007-kernelsu/run-susfs-bootimage.sh

# DEBUG (panic freeze + tty0)
/srv/rom/artifacts/bin/rom-detach susfs-boot-debug -- \
  bash -lc /srv/rom/artifacts/007-kernelsu/run-susfs-bootimage-debug.sh
```

Always record:

- `/srv/rom/artifacts/detach-<session>-<TS>.log`  
- `/srv/rom/logs/007-build/susfs-bootimage.log` (or `-debug.log`)  
- `detach-<session>.status` (`exit=0` / `exit=1`)

Verify image before flash:

```bash
unpack_bootimg + lz4 -dc kernel + scripts/extract-ikconfig
# expect MANUAL_HOOK=y, three AUTO_*=y, KSU_SUSFS=y
```

---

## 9. LAB recovery / log capture protocol (4a)

```text
1. SusFS on boot_b, penúltimo on boot_a, --set-active=b, reboot
2. On logo loop: Vol- + Power → fastboot
3. fastboot fetch klog  → FAILS on this device (unsupported)
4. fastboot flash boot_a <penúltimo>; --set-active=a; reboot
5. IMMEDIATELY on adb:
   su -c 'dd if=/dev/block/by-name/klog …; dd if=/dev/block/by-name/logfs …'
   adb pull → lab-klog-*.bin / lab-logfs-*.bin
6. strings | grep kernel_panic|Oops|Call trace|susfs
```

Observed: step 6 usually only `PM: Reason: kernel_panic` — **insufficient for stack**. Hence DEBUG on-screen build.

---

## 10. Current tree intent (defconfig snapshot at doc time)

```
CONFIG_KSU=y
CONFIG_KSU_MANUAL_HOOK=y
CONFIG_KSU_MANUAL_HOOK_AUTO_SETUID_HOOK=y
CONFIG_KSU_MANUAL_HOOK_AUTO_INITRC_HOOK=y
CONFIG_KSU_MANUAL_HOOK_AUTO_INPUT_HOOK=y
CONFIG_KSU_SUSFS=y
CONFIG_KSU_SUSFS_SUS_PATH=y
CONFIG_KSU_SUSFS_SUS_MOUNT=y
CONFIG_KSU_SUSFS_SUS_KSTAT=y
# CONFIG_KSU_SUSFS_SPOOF_UNAME is not set
CONFIG_KSU_SUSFS_ENABLE_LOG=y
CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS=y
# CONFIG_KSU_SUSFS_SPOOF_CMDLINE_OR_BOOTCONFIG is not set
CONFIG_KSU_SUSFS_OPEN_REDIRECT=y
CONFIG_KSU_SUSFS_SUS_MAP=y
# DEBUG bring-up:
CONFIG_PANIC_TIMEOUT=0
# CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC is not set
CONFIG_VT=y
CONFIG_VT_CONSOLE=y
CONFIG_FRAMEBUFFER_CONSOLE=y
…
```

---

## 11. Open questions for a second opinion

1. Is ReSukiSU **fundamentally** unsafe to run with `CONFIG_KSU_MANUAL_HOOK=y` **and** `CONFIG_KSU_SUSFS=y` without a larger port from KernelSU-Next’s addon model (more than Kconfig)?  
2. Given T004038Z reached userspace with SusFS-as-choice (no MANUAL), should bring-up prefer that path and fix vibrator separately, vs insisting on MANUAL+AUTO+SusFS?  
3. Remaining `#ifdef CONFIG_KSU_SUSFS` sites to audit in ReSukiSU when MANUAL is also on (`sucompat.c` execveat_sucompat, `dispatch.c`, input, etc.)?  
4. Best way to get a **panic backtrace** on Pixel 4a 4.14 without UART cable (fbcon reliability? pstore decrypt? `CONFIG_PSTORE_CONSOLE`?)?  
5. Any known ReSukiSU + susfs4ksu commit/tag combo that officially supports “SusFS addon + manual hooks” on non-GKI 4.14?

---

## 12. Related docs in-repo

- `docs/007-abu-vs-ours-susfs.md`  
- `docs/007-debug-boot-panic-screen.md`  
- `docs/007-kernelsu-runbook.md`  
- `docs/session-20260916-handoff.md`  
- Host: `/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/SUMMARY.txt` and `NOTE-*.txt`

---

## 13. Non-goals / constraints

- No Magisk as production root.  
- Do not flash abu/torukk/Downloads boots as product.  
- LAB only; never GOLDEN.  
- Prefer small attributable patches; large Android builds on `rom-dev01` only, detached (`rom-detach`).

---

*End of brief — 2026-09-16 afternoon LAB session after T112839Z failure; DEBUG build in flight.*