CVE-2026-43499-ZFOLD4

Device-specific research port of CVE-2026-43499 (IonStack PI write-what-where) for the Canadian Galaxy Z Fold4 SM-F936W on firmware F936WVLU1AVGA.

This repository is the Fold4 counterpart of CVE-2026-43499-S24U and CVE-2026-43499-A36. It captures current incomplete progress: reclaim, leftover-stack UAF arming, and leftover.lock coverage are in place; the [7] lock.waiters insert never lands on the reclaimed page. CFI / physrw / root are not reached.

Offsets and layouts apply only to this firmware. Do not copy constants from S24U / S25 / A36 / S9180 / GRKU onto this target. In particular SKB_DATA_DELTA is -0xe80 here (S9180 is -0x1000).

Use only on devices you own or are explicitly authorized to test.

Supported target

Model:        SM-F936W
Codename:     q4q
Board:        taro (Snapdragon 8 Gen 1)
Android:      12 / One UI 4.1.1 (SDK 32)
AP / PDA:     F936WVLU1AVGA
Fingerprint:  samsung/q4qcsx/q4q:12/SP2A.220305.013/F936WVLU1AVGA:user/release-keys
Kernel:       5.10.81-android12-9-24709469-abF936WVLU1AVGA
Architecture: arm64 / 4K pages
Serial used:  RFCT70A6APD (authorized owner device)

Image SHA-256 9ec34bbfa6a732001ead04a3e6aea8a6ad2283e3280b8b7d024c47056003fe3d. Recovered vmlinux.elf SHA-256 a5a5fa849f3e47f185d8cf4d5796b2ada10d251153a5fcea51ba138e0c565a0c. The raw Image and vmlinux.elf are not shipped (see analysis/boot-unpack/SHA256SUMS).

Status (honest)

Latest live artifact: analysis/artifacts/cve-2026-43499-v104-resscan (SHA-256 dd7968e71f2c151be46b7c386cd1380ace191854d36c08c11283266b82c8656b), boot f5264a43-7544-460e-a70d-becf90960383, warranty_bit=0.

See docs/PROGRESS.md for the milestone matrix.

What this tree contains

• Target profile src/targets/q4q-F936WVLU1AVGA/ (Image-backed offsets).
• Diagnostic payload (src/): so1000 leftover plant, stamp-SP measure, residual-anywhere peek, DIAG_LOCK_MINIMAL.
• Fold4 analysis: boot-unpack text, disassembly, curated v93/v96/v101/v103/v104 logs, selected diagnostic binaries.
• Lineage payload targets / porting notes from Root-My-Galaxy-Payloads feature/grku-race-parity @ 749633c (not Fold4 constants).

It does not contain firmware tarballs, the raw kernel Image, vmlinux.elf, Android application source, or a Fold4 KernelSU module.

Build

export ANDROID_NDK_HOME=/path/to/android-ndk   # NDK r29 or compatible
make TARGET=q4q-F936WVLU1AVGA API=32

Outputs:

build/q4q-F936WVLU1AVGA/cve-2026-43499
build/q4q-F936WVLU1AVGA/cve-2026-43499-app.so
build/q4q-F936WVLU1AVGA/cve-2026-43499-root

Treat binaries as diagnostic. Do not treat a success=1 setattr as a completed [7] or [11] write.

Frozen knobs

Keep these unless a new Image fact forces a change:

DIAG_RECLAIM_PREDRAIN_SENDS=768
DIAG_RECLAIM_SENDS=1
DIAG_WRITE_SHAPE=3
DIAG_SELF_WRITE_OFF=0x6000
DIAG_PERF_RESIDUAL=1
DIAG_RECLAIM_PEEK=1

Notes

• Deepening spray, defer-all32, or restoring ASHMEM_MISC_FOPS before a skb-peek self-write HIT (self_src == fake_fops) is not useful on this firmware.
• Setting leftover.task to init_task or the page fake_task suppresses [7]. Punching leftover.task, empty-leftmost, or prio=0 also fails.
• Same-core remote setattr reboots the device.
• Do not copy another device's numeric constants.

Documentation

Reference

• IonStack / CVE-2026-43499 lineage (NebuSec CyberMeowfia and related ports)
• Payload framework: BuSung-dev/Root-My-Galaxy-Payloads
• A36 standalone: fusiondrive/CVE-2026-43499-A36
• S24U research: fusiondrive/CVE-2026-43499-S24U

Apache License 2.0: LICENSE.