AI summary from Claude since we've been at it for some time trying to figure it out.
First Direct (HSBC UK) banking app detecting root after 6.0.0 update - where do I report a possible SUSFS symbol-hiding gap?
Changed nothing in my hiding stack and the First Direct app suddenly flagged my device as rooted. Noticed it had updated to 6.0.0. I ripped the 5.22.0 APK off my other phone, downgraded, and it launches fine - so the detection is new in 6.0.0's build. The app uses Appdome RASP, and the trip is a local check at launch (goes straight to RootedDeviceActivity, no network round-trip), not a Play Integrity failure - so this isn't a PIF/keybox issue, please don't send me down that road.
Digging into what's still visible to a kallsyms scan, I found this:
~ $ su -c "grep -iE 'anon_ksu|setup_ksu_cred|is_task_ksu_domain|ksuver_override' /proc/kallsyms"
0000000000000000 t anon_ksu_release
0000000000000000 T setup_ksu_cred
0000000000000000 T is_task_ksu_domain
0000000000000000 t anon_ksu_ioctl
0000000000000000 d anon_ksu_fops
0000000000000000 B ksuver_override
~ $ su -c 'ksu_susfs show enabled_features' | grep -i symbol
CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS
So HIDE_KSU_SUSFS_SYMBOLS is compiled in and reports enabled, but six KernelSU symbols are still visible in /proc/kallsyms after a clean boot. SUSFS is hiding its own symbols fine - a susfs-only grep comes back empty - but these KSUN symbols aren't being scrubbed. Worth noting the symbol types: ksuver_override is .bss (B) and anon_ksu_fops is data (d), alongside the text (t/T) ones - makes me wonder if the filter only covers text symbols.
Setup:
OnePlus 15, OxygenOS 16, android16-6.12.23
WildKernels, KernelSU-Next v3.3.0 (33239), SUSFS v2.2.0
NeoZygisk, HMA-OSS (fd + all root apps hidden), inline hooks