Track B history — the root journey (EZIH → DZI1 → persist end state)

CVE-2026-43499 (GhostLock) device-specific port. Full recipe in temp-root.md; this is the chronology of how it got reliable.

Milestones

1. EZIH root proven — payload v5 (5CD46863…, EZIH offsets, mm_struct_sz 0x400). First stable temp root on the stock bit-4 build.
2. DZI1 port (after the downgrade): rebuilt payload with mm_struct_sz 0x3c0 → 0x400 for the DZI1 kernel entry + removed umh_skip_pre_drain from the offsets entry. Result: leak + CFI + pipe write + SELinux permissive + UMH helper all verified on kernel 6.1.145-android14-11-33418572-abF956BXXS4DZI1 with FOPS_DELAY_USEC=30000 (payload 27AF758B…).
3. Helper socket-steal fix — the su daemon accepted non-root entry; added the root-only guard in daemon_main (helper 918BBE6D…).
4. The persist build — SU_PERSIST_ONE_SHOT=1 (su_daemon_persist.c): after the one-shot handoff shell exits, the daemon stays alive. Any adb shell can then run pompomsu-helper <cmd> → uid 0, kernel context, until the next reboot (helper 772A04BF…).

Archive note (2026-10-28): the builds named above (5CD46863…, 27AF758B…, 918BBE6D…, 772A04…) are historical and are not present in the public archive. The reproducible set is listed in the verification note.

Timing knowledge (earned the hard way)

• Fresh boot + unlocked screen → first or second attempt hits, almost always.
• One attempt per boot. In-boot retries corrupt futex state → panics. (Matches the Kitploit S26 warning: reboot before retrying.)
• Do not quiesce the system. Airplane mode and load-gating (loadavg waits) made the race miss consistently — normal scheduler/modem activity is part of the timing window. Busy boots (SIM provisioning, Play churn) also degrade the hit rate → reboot.
• The winning loop: reboot → settle ~30 s → wake/stayon → one shot → check uid → if miss, reboot (automated; see temp-root.md).

Quirks worth knowing (generic)

• Kernel-context root shells (u:r:kernel:s0) cannot look up binder services and cannot write persist.* properties. runcon u:r:shell:s0 keeps uid 0 and restores servicemanager access — but runcon itself only works while SELinux is permissive.
• ksud (KernelSU daemon) is build-specific: the EZIH ksud was refused by DZI1. Root-shell mode doesn't need it.
• The helper's client argv-mode is broken on this build — pipe commands into the no-arg helper (root shell reads stdin) instead.