Run a virtual iPhone on an Apple Silicon Mac.
This report summarizes scanner evidence for Lakr233/vphone-cli, a Swift project with 15,178 GitHub stars. SynthScan examined 252,262 lines of code across 1046 source files, recording 957 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 4.3 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 935 finding(s).
Are imports declared and package/API names verified? 3 finding(s).
Are wrappers, guards, and repeated structures necessary? 19 finding(s).
Which changes need focused human review? 957 finding(s).
Run additional scans to build a history of the legacy pattern signal. Score changes are not a measure of AI adoption or code quality.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 957 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Research/Firmware/iboot_patches.md | 301 | // Returns 0 on success, -1 on failure. | COMMENT |
| LOW | …able/VPhoneEscalator/VPhoneEscalator/VPhoneEscalator.c | 1 | // vphone-escalator — let an ad-hoc signed binary carry Apple-private | COMMENT |
| LOW | …able/VPhoneEscalator/VPhoneEscalator/VPhoneEscalator.c | 21 | // amfid, and reading and writing its memory | COMMENT |
| LOW | …able/VPhoneEscalator/VPhoneEscalator/VPhoneEscalator.c | 41 | // fault and kills amfid: CODESIGNING / "Invalid Page". The sysctl is read-only | COMMENT |
| LOW | …able/VPhoneEscalator/VPhoneEscalator/VPhoneEscalator.c | 61 | // is honoured again. | COMMENT |
| LOW | …able/VPhoneEscalator/VPhoneEscalator/VPhoneEscalator.c | 81 | // decoding +[AMFIRequirementsManager sharedManager] and testing each | COMMENT |
| LOW | …Executable/VPhoneEscalator/VPhoneEscalator/Escalator.h | 1 | // Shared declarations for vphone-escalator. See VPhoneEscalator.c for what | COMMENT |
| LOW | …Executable/VPhoneEscalator/VPhoneEscalator/AMFIDTask.c | 1 | // This process's view of AMFIRequirementsManager, and amfid's: attaching to | COMMENT |
| LOW | …ecutable/VPhoneEscalator/VPhoneEscalator/Preferences.c | 1 | // The coderequirements preference: reading, writing, reloading, and the | COMMENT |
| LOW | …eExecutable/VPhoneEscalator/VPhoneEscalator/Commands.c | 1 | // The status, allow, and off verbs. | COMMENT |
| LOW | …cutable/VPhoneEscalator/VPhoneEscalator/Requirements.c | 1 | // cdhash collection and the code requirement strings built from them. | COMMENT |
| LOW | …xecutable/VPhoneVirtualization/UI/VPhoneGuestApp.swift | 1 | import AppKit | COMMENT |
| LOW | …able/VPhoneVirtualization/UI/VPhoneHostKeyEvents.swift | 1 | import AppKit | COMMENT |
| LOW | …honeVirtualization/UI/VPhoneHostAutomationServer.swift | 1 | import AppKit | COMMENT |
| LOW | …honeVirtualization/UI/VPhoneHostAutomationServer.swift | 21 | /// Every response includes an `"image"` field with a compact base64-encoded | COMMENT |
| LOW | …ization/UI/GuestCommunication/VPhoneGuestControl.swift | 81 | /// nothing. | COMMENT |
| LOW | …zation/UI/GuestCommunication/VPhoneClipboardSync.swift | 1 | import AppKit | COMMENT |
| LOW | …ation/UI/VirtualMachine/VPhoneVirtualMachineView.swift | 41 | /// Center and half-gap of the two synthetic fingers used for pinch gestures. | COMMENT |
| LOW | …ation/UI/VirtualMachine/VPhoneVirtualMachineView.swift | 61 | /// dropped, and the release carries the final position. | COMMENT |
| LOW | …ation/UI/VirtualMachine/VPhoneVirtualMachineView.swift | 321 | /// Trackpad deltas expressed in the physical direction of the gesture so the | COMMENT |
| LOW | …ation/UI/VirtualMachine/VPhoneVirtualMachineView.swift | 341 | fromScreen: CGPoint(x: dx * Self.scrollToTouchScale, y: dy * Self.scrollToTouchScale), | COMMENT |
| LOW | …ation/UI/VirtualMachine/VPhoneVirtualMachineView.swift | 741 | COMMENT | |
| LOW | …VirtualMachine/VPhoneVirtualMachineHardwareModel.swift | 1 | import Dynamic | COMMENT |
| LOW | …irtualization/UI/UserInterface/VPhoneApplication.swift | 1 | import AppKit | COMMENT |
| LOW | …irtualization/UI/UserInterface/VPhoneHostHotKeys.swift | 1 | import Darwin | COMMENT |
| LOW | …Virtualization/UI/HostDevices/VPhoneCameraServer.swift | 1 | import CoreGraphics | COMMENT |
| LOW | …irtualization/UI/HostDevices/VPhoneFrameProducer.swift | 121 | COMMENT | |
| LOW | …zation/UI/HostDevices/VPhoneHostAudioLatencySync.swift | 1 | import CoreAudio | COMMENT |
| LOW | …zation/UI/HostDevices/VPhoneHostAudioLatencySync.swift | 41 | COMMENT | |
| LOW | …/VPhoneVirtualization/LocationHelperProcess/main.swift | 1 | // vphone-location — reads the Mac's location for vphone-vm. | COMMENT |
| LOW | …/VPhoneVirtualization/VirtualMachineProcess/main.swift | 1 | // vphone-vm — the process that actually runs a guest. | COMMENT |
| LOW | …mand/VPhoneSignTests/VPhoneSignEntitlementsTests.swift | 1 | import Foundation | COMMENT |
| LOW | …mand/VPhoneSignTests/VPhoneSignEntitlementsTests.swift | 121 | COMMENT | |
| LOW | …oneCommand/VPhoneSignTests/VPhoneSignParityTests.swift | 1 | import Foundation | COMMENT |
| LOW | …oneCommand/VPhoneSignTests/VPhoneSignParityTests.swift | 141 | /// The same, with an entitlements file on top: `ldid -S<ent> -M <file>` | COMMENT |
| LOW | …oneCommand/VPhoneSignTests/VPhoneSignParityTests.swift | 241 | let twice = try VPhoneSigner.sign(fileAt: file, options: .init(identifier: name)) | COMMENT |
| LOW | …VPhoneCommand/VPhoneSignTests/VPhoneSignFixtures.swift | 1 | // VPhoneSignFixtures.swift — the corpus, and the ldid digests frozen over it. | COMMENT |
| LOW | …VPhoneCommand/VPhoneSignTests/VPhoneSignFixtures.swift | 21 | // than ldid reserves and every CDHash moves. It is also the only bar that | COMMENT |
| LOW | …VPhoneCommand/VPhoneSignTests/VPhoneSignFixtures.swift | 41 | // integer.<spelling> after `ldid -S<one-key.plist> <file>` on | COMMENT |
| LOW | …VPhoneCommand/VPhoneSignTests/VPhoneSignFixtures.swift | 61 | // let file = try copy(fixture, into: directory, as: name) | COMMENT |
| LOW | …VPhoneCommand/VPhoneSign/Signing/VPhoneSignError.swift | 1 | import Foundation | COMMENT |
| LOW | …le/VPhoneCommand/VPhoneSign/Signing/VPhoneSigner.swift | 21 | public struct VPhoneSignOptions { | COMMENT |
| LOW | …le/VPhoneCommand/VPhoneSign/Signing/VPhoneSigner.swift | 61 | /// Signs Mach-O files the way `ldid` does, and reads entitlements back out | COMMENT |
| LOW | …le/VPhoneCommand/VPhoneSign/Signing/VPhoneSigner.swift | 81 | // below works: a temporary beside the file, then `rename(2)`. Rename | COMMENT |
| LOW | …honeCommand/VPhoneSign/Identity/VPhoneSignPKCS12.swift | 1 | import CommonCrypto | COMMENT |
| LOW | …neCommand/VPhoneSign/Identity/VPhoneSignIdentity.swift | 1 | import CryptoKit | COMMENT |
| LOW | …honeCommand/VPhoneSign/MachO/VPhoneCodeSignature.swift | 41 | var requirementsBlob = Data() | COMMENT |
| LOW | …/VPhoneCommand/VPhoneSign/MachO/VPhoneMachOImage.swift | 301 | COMMENT | |
| LOW | …d/VPhoneSign/Entitlements/VPhoneSignEntitlements.swift | 1 | import Foundation | COMMENT |
| LOW | …d/VPhoneSign/Entitlements/VPhoneSignEntitlements.swift | 21 | case integer(Integer) | COMMENT |
| LOW | …oneCommand/VPhoneSign/Entitlements/VPhoneSignDER.swift | 1 | import Foundation | COMMENT |
| LOW | …neSign/Entitlements/VPhoneSignEntitlementsReader.swift | 1 | import Foundation | COMMENT |
| LOW | …neSign/Entitlements/VPhoneSignEntitlementsReader.swift | 21 | /// the `-M` path (which re-reads canonical decimal) and the `-e`-then-`-S` | COMMENT |
| LOW | …neSign/Entitlements/VPhoneSignEntitlementsReader.swift | 301 | /// | COMMENT |
| LOW | …mand/VPhonePatchSetExample/VPhoneExamplePatchSet.swift | 1 | // VPhoneExamplePatchSet.swift — The template a `.vphonepatchset` is copied from. | COMMENT |
| LOW | …mand/VPhonePatchSetExample/VPhoneExamplePatchSet.swift | 21 | // | COMMENT |
| LOW | …herTests/Pipeline/FirmwarePipelineOriginalsTests.swift | 1 | // FirmwarePipelineOriginalsTests.swift — `fw patch` is re-runnable. | COMMENT |
| LOW | …d/FirmwarePatcherTests/Core/PatchComparisonTests.swift | 1 | // PatchComparisonTests.swift — Compare Swift patcher output against Python reference patches. | COMMENT |
| LOW | …mand/FirmwarePatcherTests/Core/ARM64EncoderTests.swift | 1 | // ARM64EncoderTests.swift — every ARM64Encoder output asserted against keystone. | COMMENT |
| LOW | …mand/FirmwarePatcherTests/Core/ARM64EncoderTests.swift | 61 | struct ARM64EncoderKeystoneParityTests { | COMMENT |
| 808 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …asePatches/Security/KernelPatchLaunchConstraints.swift | 31 | // Step 1: Locate the anchor string used inside the AMFI function. | COMMENT |
| LOW⚡ | …asePatches/Security/KernelPatchLaunchConstraints.swift | 37 | // Step 2: Find ADRP+ADD references from AMFI code into the string. | COMMENT |
| LOW⚡ | …asePatches/Security/KernelPatchLaunchConstraints.swift | 45 | // Step 3: Walk each reference and find the enclosing function start. | COMMENT |
| LOW⚡ | …asePatches/Security/KernelPatchLaunchConstraints.swift | 49 | // Step 4: Emit the two-instruction stub at the function entry point. | COMMENT |
| LOW⚡ | …/Kernel/BasePatches/Security/KernelPatchExcGuard.swift | 36 | // Step 1: locate the anchor string. | COMMENT |
| LOW⚡ | …/Kernel/BasePatches/Security/KernelPatchExcGuard.swift | 42 | // Step 2: find ADRP+ADD code reference (inside set_exception_behavior_allowed). | COMMENT |
| LOW⚡ | …/Kernel/BasePatches/Security/KernelPatchExcGuard.swift | 49 | // Step 3: scan the surrounding function for BL instructions to find | COMMENT |
| LOW | …/Kernel/BasePatches/Security/KernelPatchExcGuard.swift | 89 | // Step 4: patch thread_guard_violation → RET | COMMENT |
| LOW | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 27 | // Step 1: Find the "apfs_graft" null-terminated C string. | COMMENT |
| LOW⚡ | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 40 | // Step 2: Find ADRP+ADD code references to that string. | COMMENT |
| LOW⚡ | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 47 | // Step 3: Find the function start from the reference site. | COMMENT |
| LOW⚡ | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 53 | // Step 4: Locate validate_on_disk_root_hash via the `authenticate_root_hash` string. | COMMENT |
| LOW⚡ | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 59 | // Step 5: Scan _apfs_graft body for a BL whose target is vrhFunc. | COMMENT |
| LOW⚡ | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 63 | // Step 1: locate the anchor string. | COMMENT |
| LOW⚡ | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 69 | // Step 2: find ADRP+ADD references in code. | COMMENT |
| LOW⚡ | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 77 | // Step 3: scan forward from the ADD for BL _panic (up to 0x40 bytes). | COMMENT |
| LOW | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 92 | // Step 4: search backward from adrpOff for a conditional branch whose | COMMENT |
| LOW⚡ | …hes/Storage/KernelCustomFirmwarePatchBsdInitAuth.swift | 28 | // Step 1: Recover _bsd_init function start. | COMMENT |
| LOW⚡ | …hes/Storage/KernelCustomFirmwarePatchBsdInitAuth.swift | 34 | // Step 2: Find the panic string ref inside this function. | COMMENT |
| LOW⚡ | …hes/Storage/KernelCustomFirmwarePatchBsdInitAuth.swift | 40 | // Step 3: Find the BL to _panic near the ADD instruction. | COMMENT |
| LOW⚡ | …hes/Storage/KernelCustomFirmwarePatchBsdInitAuth.swift | 46 | // Step 4: Scan backward from the ADRP for a valid cbnz gate site. | COMMENT |
| LOW | …onents/VCamCaptured/Synthetic/VCamSourceInstallation.m | 224 | // Step 1: find `cmn x?, #0x1; b.ne <target>` and decode target. | COMMENT |
| LOW⚡ | …onents/VCamCaptured/Synthetic/VCamSourceInstallation.m | 247 | // Step 2: cold wrapper starts with `bl <cold.1>`. Decode. | COMMENT |
| LOW⚡ | …onents/VCamCaptured/Synthetic/VCamSourceInstallation.m | 255 | // Step 3: walk cold.1 looking for the LAST `adrp x1,...; add x1, | COMMENT |
| LOW | …onents/VCamCaptured/Synthetic/VCamSourceInstallation.m | 282 | // Step 4: read invoke pointer at offset 0x10 within the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …asePatches/Security/KernelPatchLaunchConstraints.swift | 31 | // Step 1: Locate the anchor string used inside the AMFI function. | COMMENT |
| LOW⚡ | …asePatches/Security/KernelPatchLaunchConstraints.swift | 37 | // Step 2: Find ADRP+ADD references from AMFI code into the string. | COMMENT |
| LOW⚡ | …asePatches/Security/KernelPatchLaunchConstraints.swift | 45 | // Step 3: Walk each reference and find the enclosing function start. | COMMENT |
| LOW⚡ | …asePatches/Security/KernelPatchLaunchConstraints.swift | 49 | // Step 4: Emit the two-instruction stub at the function entry point. | COMMENT |
| LOW⚡ | …/Kernel/BasePatches/Security/KernelPatchExcGuard.swift | 36 | // Step 1: locate the anchor string. | COMMENT |
| LOW⚡ | …/Kernel/BasePatches/Security/KernelPatchExcGuard.swift | 42 | // Step 2: find ADRP+ADD code reference (inside set_exception_behavior_allowed). | COMMENT |
| LOW⚡ | …/Kernel/BasePatches/Security/KernelPatchExcGuard.swift | 49 | // Step 3: scan the surrounding function for BL instructions to find | COMMENT |
| LOW | …/Kernel/BasePatches/Security/KernelPatchExcGuard.swift | 89 | // Step 4: patch thread_guard_violation → RET | COMMENT |
| LOW | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 27 | // Step 1: Find the "apfs_graft" null-terminated C string. | COMMENT |
| LOW⚡ | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 40 | // Step 2: Find ADRP+ADD code references to that string. | COMMENT |
| LOW⚡ | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 47 | // Step 3: Find the function start from the reference site. | COMMENT |
| LOW⚡ | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 53 | // Step 4: Locate validate_on_disk_root_hash via the `authenticate_root_hash` string. | COMMENT |
| LOW⚡ | …her/Kernel/BasePatches/APFS/KernelPatchApfsGraft.swift | 59 | // Step 5: Scan _apfs_graft body for a BL whose target is vrhFunc. | COMMENT |
| LOW⚡ | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 63 | // Step 1: locate the anchor string. | COMMENT |
| LOW⚡ | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 69 | // Step 2: find ADRP+ADD references in code. | COMMENT |
| LOW⚡ | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 77 | // Step 3: scan forward from the ADD for BL _panic (up to 0x40 bytes). | COMMENT |
| LOW | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 92 | // Step 4: search backward from adrpOff for a conditional branch whose | COMMENT |
| LOW⚡ | …hes/Storage/KernelCustomFirmwarePatchBsdInitAuth.swift | 28 | // Step 1: Recover _bsd_init function start. | COMMENT |
| LOW⚡ | …hes/Storage/KernelCustomFirmwarePatchBsdInitAuth.swift | 34 | // Step 2: Find the panic string ref inside this function. | COMMENT |
| LOW⚡ | …hes/Storage/KernelCustomFirmwarePatchBsdInitAuth.swift | 40 | // Step 3: Find the BL to _panic near the ADD instruction. | COMMENT |
| LOW⚡ | …hes/Storage/KernelCustomFirmwarePatchBsdInitAuth.swift | 46 | // Step 4: Scan backward from the ADRP for a valid cbnz gate site. | COMMENT |
| LOW | …onents/VCamCaptured/Synthetic/VCamSourceInstallation.m | 224 | // Step 1: find `cmn x?, #0x1; b.ne <target>` and decode target. | COMMENT |
| LOW⚡ | …onents/VCamCaptured/Synthetic/VCamSourceInstallation.m | 247 | // Step 2: cold wrapper starts with `bl <cold.1>`. Decode. | COMMENT |
| LOW⚡ | …onents/VCamCaptured/Synthetic/VCamSourceInstallation.m | 255 | // Step 3: walk cold.1 looking for the LAST `adrp x1,...; add x1, | COMMENT |
| LOW | …onents/VCamCaptured/Synthetic/VCamSourceInstallation.m | 282 | // Step 4: read invoke pointer at offset 0x10 within the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ldSharedCache/DyldSharedCacheLSDEmbeddedRegTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| HIGH | …dSharedCache/DyldSharedCacheMaxSlidePatcherTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| HIGH | …yldSharedCache/DyldSharedCacheCameraPatcherTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| HIGH | …dSharedCacheHypervisorVirtualMachinePatcherTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| HIGH | …redCache/DyldSharedCacheLockdownModePatcherTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| HIGH | …ldSharedCache/DyldSharedCacheXPCLWCRPatcherTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| HIGH | …s/DyldSharedCache/DyldSharedCacheFoundationTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| HIGH | …DyldSharedCache/DyldSharedCacheIOMFBSwapEndTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| HIGH | …ldSharedCache/DyldSharedCacheIOMFBForceKernTests.swift | 0 | the real arm64e shared cache is required — put it at \ ipsws/ref_extract/dsc_pristine, point vphone_dsc_pristine at it, | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ble/VPhoneCommand/FirmwarePatcher/TXM/TXMPatcher.swift | 91 | // ═══════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …ble/VPhoneCommand/FirmwarePatcher/TXM/TXMPatcher.swift | 110 | // ═══════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …rmwarePatcher/DeviceTree/DeviceTreeNodeAdditions.swift | 231 | // ── /product/iopm (Tier C — always-on technology) ──────────── | COMMENT |
| MEDIUM | …warePatcher/DeviceTree/DeviceTreePropertyPatches.swift | 107 | // ── Identity rewrite (Tier 1b) ──────────────────────────────── | COMMENT |
| MEDIUM | …warePatcher/DeviceTree/DeviceTreePropertyPatches.swift | 181 | // ── Identity rewrite (Tier 1c) ──────────────────────────────── | COMMENT |
| MEDIUM | …warePatcher/DeviceTree/DeviceTreePropertyPatches.swift | 236 | // ── Camera physical-offset rewrites (Tier B) ────────────────── | COMMENT |
| MEDIUM | …cutablePatches/DiskImage/CustomFirmwareDiskImage.swift | 8 | // ──────────────────── | COMMENT |
| MEDIUM | …cutablePatches/DiskImage/CustomFirmwareDiskImage.swift | 31 | // ───────────────────── | COMMENT |
| MEDIUM | …cutablePatches/DiskImage/CustomFirmwareDiskImage.swift | 56 | // ─────────────── | COMMENT |
| MEDIUM | …cutablePatches/DiskImage/CustomFirmwareDiskImage.swift | 65 | // ────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/DyldSharedCache/DyldSharedCacheFoundationTests.swift | 896 | #expect(second.alreadyAttested.count == 1, "and it has to say so, not just return nothing") | STRING |
| MEDIUM | …hes/Storage/KernelCustomFirmwarePatchDiskImages2.swift | 21 | // - GATE1/GATE2b (ABI reject NOP): version-robust — anchored on the C++ signature | COMMENT |
| MEDIUM | …hes/Storage/KernelCustomFirmwarePatchDiskImages2.swift | 125 | /// gate is skipped — the version-robust ABI gates (GATE1/GATE2b) are the essential | COMMENT |
| MEDIUM | …honeCoreKitTests/Network/VPhoneTCPForwarderTests.swift | 264 | try #require(harness.waitUntil("the SYN-ACK") { harness.ourISN != nil }) | CODE |
| MEDIUM | …honeCoreKitTests/Network/VPhoneTCPForwarderTests.swift | 265 | let isn = try #require(harness.ourISN) | CODE |
| MEDIUM | …honeCoreKitTests/Network/VPhoneTCPForwarderTests.swift | 321 | try #require(harness.waitUntil("the first burst") { harness.sentDataBytes > 0 }) | CODE |
| MEDIUM | …honeCoreKitTests/Network/VPhoneTCPForwarderTests.swift | 351 | #expect(harness.sentDataBytes >= total, "stalled at \(harness.sentDataBytes)B of \(total)B") | COMMENT |
| MEDIUM | …honeCoreKitTests/Network/VPhoneTCPForwarderTests.swift | 465 | let synAck = try #require(harness.sent.first { $0.hasSYN && $0.hasACK }) | CODE |
| MEDIUM | …honeCoreKitTests/Network/VPhoneTCPForwarderTests.swift | 479 | try #require(harness.waitUntil("a scaled window's worth") { harness.sentDataBytes > 512 * 8 }) | CODE |
| MEDIUM | …honeCoreKitTests/Network/VPhoneTCPForwarderTests.swift | 509 | try #require(harness.waitUntil("the first data") { harness.sentDataBytes > 0 }) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | AGENTS.md | 118 | ### Kernel patcher guardrails | COMMENT |
| MEDIUM | …mand/VPhonePatchSetExample/VPhoneExamplePatchSet.swift | 28 | // guardrails in AGENTS.md. | COMMENT |
| MEDIUM | …ble/VPhoneCommand/VPhonePatchKit/ARM64/ARM64Inst.swift | 81 | /// kernel patcher guardrails exist to keep out. Callers confirm the value with | COMMENT |
| MEDIUM | …haredCache/Patchers/DyldSharedCacheCameraPatcher.swift | 38 | // mnemonic checked, per the patcher guardrails — an encoding of `pacibsp` | COMMENT |
| MEDIUM | …redCache/Patchers/DyldSharedCacheMaxSlidePatcher.swift | 61 | // On the CLAUDE.md patcher guardrails | COMMENT |
| MEDIUM | …er/Kernel/BasePatches/Startup/KernelPatchBsdInit.swift | 6 | // Allowed reveal flow (per CLAUDE.md guardrails): | COMMENT |
| MEDIUM | …Memory/KernelCustomFirmwarePatchSharedRegionSize.swift | 46 | // guardrails keep out (see `ARM64Inst.isORRImmW`'s comment for the same | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …stomFirmwareVirtualAudioGraphConfigurationsTests.swift | 112 | let url = try writeTemporary(["placeholder": true]) | CODE |
| LOW | …/CustomFirmwareVirtualAudioMicrophoneChainsTests.swift | 165 | "beamformed_mic_general": Self.configuration("placeholder"), | CODE |
| LOW | …stomFirmware/CustomFirmwarePostRestoreDeviceTree.swift | 449 | // The top bit of the length field is XNU's out-of-line "placeholder" | COMMENT |