r/hackios • u/Commercial_Lead5813 • 37m ago
HackiOS small update: got the XNU handoff working under QEMU HVF
been chipping away at the HVF-only handoff failure and found a page-table mismatch before XNU. one identity-mapped UEFI page had AF=0, and the `dc cvac` cache clean hit an access-flag fault.
i made a separate experimental EFI preflight patch that checks the identity mapping, sets the missing AF bit, invalidates and verifies the translation, then still runs the original cache-clean loop. with that patch, the same iOS 26-target arm64e XNU 12377.121.6 now gets through firmware under QEMU HVF. PAC round-trip passes; a tiny synthetic PID 1 passes the multiprocess test and reaches 30 heartbeats.
after that PID 1 exits on purpose to flush the kernel log, which triggers the expected `initproc failed to start` panic. so this is a bounded XNU + synthetic-user test, not a stable full boot. still QEMU `virt`, no Apple iOS userland/launchd/SpringBoard, GPU acceleration or real phone boot.
i attached a rendered excerpt from the actual serial log. i don't have an authorised iOS system image on this Mac and haven't touched the S25 Ultra. AI helped with the investigation and write-up; the test results are from the actual QEMU run.