Root tips / Zygisk Next + Vector

Field fixes from our own Fold 6 — locked bootloader, temp root loaded after boot ("late-load"). If Zygisk Next or Vector is misbehaving on a late-load setup, start here.

Tested on SM-F956B, One UI 8.5 / Android 16, KernelSU-Next 3.4.2, Zygisk Next 1.5.2 (864), Vector 2.2 (3080). Every symptom below comes from one fact: Zygisk and LSPosed expect to be running before zygote and system_server start.

quick triage

Check	What it tells you
`zygiskd64 status \| grep zygote_states`	`0` = Zygisk is not in zygote, so no Xposed module can work. `1` = injection is live.
`grep -E "Failed to inject\|Restarting system_server" /data/adb/lspd/log/verbose_*.log`	Vector tried to restart system_server — the crash path below.
`getprop persist.sys.rescue_level`	Above 0 = RescueParty is escalating toward safe mode.
`unzip -p module.apk META-INF/xposed/scope.list`	Contains `system`? That module loads into system_server — risky here.

1. modules never activate (`zygote_states:0`)

With late-load root, KernelSU's post-fs-data and service stages run long after zygote is up. Replay them, then restart zygote so the new one loads libzygisk.so:

su -c 'ksud post-fs-data'      # starts zygiskd
su -c 'ksud services'          # starts vectord
su -c 'setprop ctl.restart zygote'
zygiskd64 status | grep -E 'zygote_states|modules64'

On a stock One UI 8.5 build this zygote restart can hit the system_server crash in §2. Install the stub first, then restart.

2. bootloop: `android.ext.services` missing

After the zygote restart, system_server may crash-loop with:

Required services extension package is missing,
config_servicesExtensionPackage had defined with android.ext.services

The package is not missing: Samsung ships com.google.android.ext.services and overrides the config through an RRO. Vector's injected system_server reads the base framework value (the AOSP default android.ext.services) instead, so the lookup fails and PackageManagerService aborts.

Important — we tested the obvious fix and it does not work. Installing a stub package named android.ext.services (so the lookup resolves) was tried on 2026-10-30: the stub installed, pm path android.ext.services resolved, it was enabled — and the crash still reproduced the moment Vector injected system_server. Our earlier 2026-10-29 "fixed" result was a false positive: in that run the framework was not actually injected into system_server.

What actually works: keep Vector out of system_server. On this build the only stable configurations are:

Root only, no Xposed — disable the Vector module and do not restart zygote: touch /data/adb/modules/zygisk_vector/disable. Root, KernelSU modules and ADB work normally; Xposed modules stay inert.
Root-only theming — use PolyQon's fabricated overlays (no Xposed), which work fine on this build.
Wait for upstream — Vector needs a late-load mode that injects apps without injecting system_server (JingMatrix/Vector #1015 / #996).

The stub APK is kept below only as a diagnostic artefact — it does not fix the bootloop. Do not install it expecting a fix.

android.ext.services stub

diagnostic only

APK · no code · no permissions

Tested 2026-10-30 — does not stop the crash. Kept for reproduction and upstream debugging. sha256 d57cd1e6fc25393de24cd8f0712c372afff2a21af8266e4925be28161356257c

Download (diagnostic)

3. the daemon restarts system_server

On late-load, Vector's daemon can never attach to the already-running system_server. With a retry count above zero it restarts it — which is the crash in §2. Run the daemon with the retry disabled and an absolute path (the relative path causes an UnsatisfiedLinkError):

# /data/adb/modules/zygisk_vector/service.sh
MODDIR=${0%/*}
cd "$MODDIR" || exit 1
nohup "$MODDIR/daemon" --system-server-max-retry=0 > /tmp/vec.log 2>&1 </dev/null &

4. safe mode after a crash loop

Repeated system_server deaths trip RescueParty into safe mode (reboot,rescueparty_by_bootchecker). A normal reboot exits safe mode; then, with root:

su -c 'setprop persist.sys.rescue_level 0'
su -c 'setprop sys.rescue_boot_count 0'

Leave the phone alone for 5–10 minutes so the level resets on its own.

5. `modules ls` says "No records found"

A stale module database after install/uninstall churn. Stop the daemon, delete the DB, start it again — it rebuilds clean:

su -c 'pkill -f vectord'
su -c 'rm -f /data/adb/lspd/config/modules_config.db*'
su -c 'sh /data/adb/modules/zygisk_vector/service.sh'

6. system-scoped modules are landmines

If META-INF/xposed/scope.list contains system, the module loads into system_server. On a build where injection is already fragile, remove it. CorePatch N-1.0, Hide My Applist 3.8.3 and Enable Screenshot 5.0.1 all declare it.

7. do not soft-reboot on late-load

ksud soft-reboot unloads the KernelSU LKM and loses root. Use ksud services plus killall com.android.systemui when only the UI needs a repaint. With the stub installed, a zygote restart is safe; without it, it is the crash in §2.

The full write-up with log excerpts lives in our research notes. Related upstream threads: JingMatrix/Vector #1015 (system_server attach cannot recover) and #996 (late-load KernelSU daemon/injection failures).

All downloads Unlock status