David Strnadel / CVE-2026-65398
Selected evidence excerpts / 30 October 2026

These are selected excerpts from retained research records, not the complete
submission, raw panic archive, or a runnable PoC. No fresh device run was
performed in preparing this article.

Source file SHA-256 (original files, not this editorial excerpt):
APPLE_REPORT.md: 654720ffb73188bde5f6798f70d7e80dbeb600a48508e0b4dc7133245d30b757
TECHNICAL_NOTE.md: 97b2c48af01a08a94cebef2ea797a3fb10c00ee4d1d5be352c64f12dc8dc3949

E1 / Original report: root cause

The sibling selector 93 handler at unslid `0xfffffff009a868b8` validates the
same array index:

```asm
fffffff009a868d8: cmp  w2, #0xbc
fffffff009a868dc: b.hi 0xfffffff009a8699c
```

Selector 95 enters the adjacent handler at `0xfffffff009a869e8` and omits that
check. It computes:

```text
slot_base = provider + 0x1740
product   = (uint64_t)(uint32_t)index * 0x38
slot      = slot_base + signed_low32(product), or a 0x2bad-poisoned pointer
```

It then calls the helper at `0xfffffff009a86670`. The helper contains:

```asm
fffffff009a866a4: ldur x0, [x3, #0xc]   ; full app qword
fffffff009a866a8: cbz  x0, 0xfffffff009a867f0
fffffff009a866ac: mov  w21, #0
fffffff009a866b0: ldr  w9, [x19, #0x28] ; first invalid OOB operation
```

No instruction modifies `x0` between the full-width load and the OOB fault.

The selector-95 external-method dispatch record is one scalar input, a
20-byte structure input, no outputs, and no entitlement requirement. Its
wrapper is at unslid `0xfffffff009ab4698`.

E2 / Supplement: escalated value flow

**CONFIRMED:**

1. The app performs three volatile 64-bit loads from fixed Apple ABI address
   `0x0000000fffffc338` (`_COMM_PAGE_ASB_TARGET_KERN_ADDRESS`) and stops unless
   the three current-boot values are equal and nonzero.
2. `_kern_SwapDebugInfo` stores that qword at transaction offset `+0x48`.
3. `_kern_SwapEnd` submits the legitimate transaction through selector 5.
4. The beta-4 DCP path copies transaction bytes `+0x40..+0x4f` to swap-node
   bytes `+0xc40..+0xc4f`.
5. Layer-2 completion copies `node+0xc48` to `provider+0x45b8`.
6. Unchecked selector-95 index `0xd4` selects slot `provider+0x45a0`, placing
   the qword at `slot+0x18`.
7. The common helper loads `x0 = [slot+0x18]` at unslid
   `0xfffffff009a867f4`.
8. The next operation is `ldr x16,[x0]` at unslid
   `0xfffffff009a867fc`.

The security boundary is crossed when selector 95 accepts the out-of-range
index and reinterprets out-of-bounds provider state as an object pointer.

E2 / Supplement: claim boundary

**CONFIRMED:** The matching same-boot witness and panic establish that the
vulnerable kernel executed a load from the dynamically captured
`_COMM_PAGE_ASB_TARGET_KERN_ADDRESS`, as required by Apple's kernel arbitrary-
read Target-Flag demonstration.

**NOT CLAIMED:** The fault does not return mapped kernel data to the app and is
not presented as a disclosure oracle. This package does not establish
arbitrary write, PC control, code execution, or a second vulnerability.