iQOO Neo8 GhostLock Adaptation (CVE-2026-43499)

Device: iQOO Neo8 PD2301 · Snapdragon 8+ Gen1 · kernel 5.10.246-gki-gb142569a7856 Firmware: OriginOS PD2301_A_16.3.16.1.W10.V000L1 Vulnerability: CVE-2026-43499 (GhostLock lineage, futex PI UAF)

Contents

Path	Description
targets/	Neo8-specific 48-macro target.h ×2 + offsets.json
logs/	15 rounds of full empirical logs (345 lines, R8 version)
patches/	R7/R9 + fd_set patch diff + 7 compatibility notes
.github/workflows/	NDK one-click build pipeline

Empirical Status (2026-09-22 morning)

Stage	Status
kernelsnitch collision audit	✅ all hits
kernel page prepare	✅ attempt=1
pselect route setup	✅ LOCK=0x0E80 / W0=0x1180 / TASK=0x1280
requeue fallback	✅ R7 fix 15/15 no deadlock
PI write primitive	❌ calls=0 success=0 — 5.10 fd_set has no kernel write
root	not obtained

Conclusion

Local efforts exhausted; awaiting kinser R11 set_pselect_write or Yuehong Neo8 R12 full package to take over the final layer.

Citations / References (this repo does not include their code, only attribution)

All source code and ideas in this repo come from the following upstream repositories. This repo only collects Neo8-specific adaptation artifacts (target.h / offsets.json / empirical logs / patch diffs), out of respect and to avoid redundant mirroring. For the complete source code, please go to the original repositories:

Upstream repo	Role in this project
JoinChang/ghostlock-oneplus (GhostLock upstream, main payload carrier)	Main body of ghostlock source logic + full-chain execution of run_main_route_threads / pselect route
NebuSec/CyberMeowfia	Original intelligence on CVE-2026-43499 vulnerability details + IonStack version implementation route
x-spy/CVE-2026-43499-popsicle	Another CVE-2026-43499 reference implementation (drivers/cheese route)
YuKongA/payload_extract_rs	OTA payload parsing pipeline (source of the streaming Range approach that pulls only boot.img)
martinosevilla/vmlinux-to-elf	Extracted 176,599 kallsyms symbols from Neo8 stock boot.img, used for the 48-macro values in target.h
gitee.com/ytngtaoaaa/allroot	Community adaptation workflow three-stage framework (boot collection → AI compilation → log iteration)
kinser "CVE-2026-43499 Adaptation Analysis Report on iQOO Neo8" (blog /archives/report)	Intelligence source for R9 MM_STRUCT_SZ=0x3C0 / R10 PAGE_MM_STRUCT_SZ / R11 set_pselect_write — the final answer to the missing write layer is in here
Yuehong Privilege Escalation Assistant (community device .so package system; this project produces a Neo8 third-party slot for it)	Reference for naming/invocation conventions of 45 device .so packages · com.ghostlock.app built-in 65768B version (the only version empirically observed to reach spawn root_child)

If you are the author of any of the above repositories and are dissatisfied with this citation or request its removal, please open an Issue and I will remove the corresponding artifacts.

bin/ Binary Artifacts

File	Size	md5	Description
bin/boot.img	96 MB	f99884a6…	Neo8 stock boot (PD2301_A_16.3.16.1.W10.V000L1, kernel 5.10.246), source for kallsyms values
bin/preload.so	91 KB	3b84a04f…	R8 preload payload (triggered via LD_PRELOAD=/data/local/tmp/preload.so /system/bin/id)
bin/offsets.json	0.9 KB	12c68c1b…	GhostLock external offsets (the one kernelsnitch fully hits)

boot.img at 96 MB exceeds GitHub's recommended 50 MB per-file limit; push works (hard limit 100 MB), so please be patient if it is slow.