Temp root recipe (Track B) — per-boot, end state

CVE-2026-43499 (GhostLock) device-specific port for F956BXXS4DZI1 (kernel 6.1.145-android14-11-33418572-abF956BXXS4DZI1). Build details and offsets live in the device folder of the payload source; hashes here identify the working artifacts.

Working artifacts (DZI1)

payload (0x400 rebuilt, works): sha256 58139c7bbdb96a11e283a3e3a61955c50b9d43a62c6395d1b5cfa5cbdf33c239
su helper (EZIH build — patch to DZI1): sha256 b634d6f6fb6eb1b2451738b6ffba23a019fcd86f8d93655bdf71770ece966f46
su helper (DZI1 patched): sha256 1f69a881a34badf29bd23b7433bb5a249599d1a3d8c135cf83a83c0e6e5a9fd2
ksud (DZI1): sha256 20d5db05a7c4d9229442bc1e3566a8fc2d60b2fbe047a683ab670fdac7b107f0

The previously listed AB4726… payload and 772A04… helper are not in the public archive as of 2026-10-28 and are unverified. See the verification note.

Recipe (verified, one shot per boot)

sh

push payload + helper to /data/local/tmp, chmod 755, then:

cd /data/local/tmp
GHOSTLOCK_ROOT_SHELL=1 \
GHOSTLOCK_HOME=/data/local/tmp \
GHOSTLOCK_HELPER_PATH=/data/local/tmp/pompomsu-helper-dzi1 \
GHOSTLOCK_KSUD_PATH=/data/local/tmp/ksud-dzi1 \
./payload

FOPS_DELAY_USEC=30000 belongs to the missing 0x400 payload — omit it with the archived payload; it rotates its own delay index.

The handoff drops you into a root shell (`uid=0(root) gid=0(root)
context=u:r:kernel:s0`). SELinux ends Permissive until reboot. With the persist helper
build, the su daemon survives the payload exit:

```sh```
# any adb shell, until next reboot:
/data/local/tmp/pompomsu-helper-dzi1 &lt;command&gt;   # run &lt;command&gt; as root
/data/local/tmp/pompomsu-helper-dzi1             # root shell

Timing notes (empirically dialed)

CPU-70% limit must be OFF — the single biggest killer. Check every boot: settings get global restricted_device_performance must be 0,0 (settings put global restricted_device_performance 0,0 to fix; plain adb, no root). With it on (2.11 GHz cap) the race + collision scan are ~100x too slow and miss every time.
mm_struct stride = 0x400 on DZI1/DZH5 — /proc/slabinfo reports objsize 1024; the old 0x3c0 entries tested only 1 of 32 slab slots (the fix that took the hit rate from ~1-in-20 to 1/1).
Fresh boot + unlocked screen → hits on cycle 1-2 almost every time.
One attempt per boot. Retrying in the same boot corrupts futex state and can panic the device (matches the Kitploit S26 warning).
Do NOT quiesce the system. Airplane mode / load-gating made the race miss consistently on this kernel — normal scheduler/modem activity is part of the timing.
Busy boots (SIM re-provisioning, Play services churn) cause 10-miss streaks → reboot and retry.

Important

NEVER install the October 2026 SMR — it patches CVE-2026-43499. Keep OTA agents disabled (com.wssyncmldm, com.sec.android.soagent).
Root is per-boot. Nothing persists across a reboot except the files in /data/local/tmp.
Kernel-context shells can't reach servicemanager and can't set persist.* props — use runcon u:r:shell:s0 for binder calls while keeping uid 0.