fix(scripts): use mach.development.bcm2837.unstripped (no .noctf suffix)

The kernel object produced by the ipados27 build tree is
mach.development.bcm2837.unstripped; the .noctf variant is not emitted.
Fix the reference in build-sheng-source-drivers.py and all other scripts
that contained the wrong suffix.

Also update submodule pointers for Adreno740 (preemption A1) and
AdrenoMetal (priority forwarding + pass reporter), and regenerate
turnip-gmem-mutable-swap.patch to include the NativeAdrenoAbiPriority
method-17 call in tu_knl_darwin.cc.

patches/mesa/turnip-gmem-mutable-swap.patch

@@ -284,7 +284,7 @@ index 62d1e43..7d59dc3 100644
  tu_cmd_fill_buffer_addr(VkCommandBuffer commandBuffer,
                          VkDeviceAddress dstAddr,
 diff --git a/src/freedreno/vulkan/tu_cmd_buffer.cc b/src/freedreno/vulkan/tu_cmd_buffer.cc
-index 33a22aa..bf21f25 100644
+index 33a22aa..b900555 100644
 --- a/src/freedreno/vulkan/tu_cmd_buffer.cc
 +++ b/src/freedreno/vulkan/tu_cmd_buffer.cc
 @@ -27,6 +27,8 @@
@@ -305,7 +305,7 @@ index 33a22aa..bf21f25 100644
  
        /* If FDM offset is used, the last row and column extend beyond the
         * framebuffer but are shifted over when storing. Expand the width and
-@@ -4056,7 +4060,153 @@ tu_cmd_render_sysmem(struct tu_cmd_buffer *cmd,
+@@ -4056,7 +4060,163 @@ tu_cmd_render_sysmem(struct tu_cmd_buffer *cmd,
   */
  static uint64_t tu_render_mode_counts[8];
  
@@ -336,6 +336,16 @@ index 33a22aa..bf21f25 100644
 +};
 +static_assert(sizeof(struct tu_pass_rec) == 48, "pass record");
 +static struct tu_pass_rec tu_pass_ring[512];
++
++/* The host's diagnostics switch (SHENG_DIAG, set by the plugin from sheng-diag=1): without it no pass is stamped or kept in the ring. */
++static bool
++tu_pass_trace_on(void)
++{
++   static int on = -1;
++   if (on < 0)
++      on = getenv("SHENG_DIAG") != NULL;
++   return on;
++}
 +static uint32_t tu_pass_seq;
 +static struct tu_device *tu_pass_ts_dev;
 +static struct tu_bo *tu_pass_ts_bo;
@@ -459,7 +469,7 @@ index 33a22aa..bf21f25 100644
  tu_note_render_mode(struct tu_cmd_buffer *cmd, bool sysmem)
  {
     const VkExtent2D extent = cmd->state.render_areas[0].extent;
-@@ -4066,8 +4216,9 @@ tu_note_render_mode(struct tu_cmd_buffer *cmd, bool sysmem)
+@@ -4066,8 +4226,9 @@ tu_note_render_mode(struct tu_cmd_buffer *cmd, bool sysmem)
        !sysmem ? 0 : reason && !strcmp(reason, "Autotune selected sysmem") ? 2 : 4;
     p_atomic_inc(&tu_render_mode_counts[slot]);
     p_atomic_add(&tu_render_mode_counts[slot + 1], kpx);
@@ -470,7 +480,7 @@ index 33a22aa..bf21f25 100644
     for (unsigned i = 0; i < cmd->state.pass->attachment_count; i++) {
        const struct tu_image_view *iview = cmd->state.attachments[i];
        if (iview && tu_attachment_unpadded(cmd, iview)) {
-@@ -4075,6 +4226,7 @@ tu_note_render_mode(struct tu_cmd_buffer *cmd, bool sysmem)
+@@ -4075,6 +4236,7 @@ tu_note_render_mode(struct tu_cmd_buffer *cmd, bool sysmem)
           break;
        }
     }
@@ -478,13 +488,13 @@ index 33a22aa..bf21f25 100644
  }
  
  extern "C" __attribute__((visibility("default"))) void tu_render_mode_stats(uint64_t out[8]);
-@@ -4097,11 +4249,16 @@ tu_cmd_render(struct tu_cmd_buffer *cmd_buffer,
+@@ -4097,11 +4259,16 @@ tu_cmd_render(struct tu_cmd_buffer *cmd_buffer,
  
     tu_autotune::rp_ctx_t rp_ctx = NULL;
     const bool sysmem = use_sysmem_rendering(cmd_buffer, &rp_ctx, rp_key);
 -   tu_note_render_mode(cmd_buffer, sysmem);
-+   const uint32_t seq = tu_note_render_mode(cmd_buffer, sysmem);
-+   const uint64_t stamps = tu_pass_ts_slot(cmd_buffer, seq);
++   const uint32_t seq = tu_pass_trace_on() ? tu_note_render_mode(cmd_buffer, sysmem) : 0;
++   const uint64_t stamps = seq ? tu_pass_ts_slot(cmd_buffer, seq) : 0;
 +   if (stamps)
 +      tu_pass_stamp<CHIP>(&cmd_buffer->cs, stamps);
     if (sysmem)
@@ -497,10 +507,33 @@ index 33a22aa..bf21f25 100644
  
  static void tu_reset_render_pass(struct tu_cmd_buffer *cmd_buffer)
 diff --git a/src/freedreno/vulkan/tu_knl_darwin.cc b/src/freedreno/vulkan/tu_knl_darwin.cc
-index 0209408..67b7e2c 100644
+index 0209408..a8589a0 100644
 --- a/src/freedreno/vulkan/tu_knl_darwin.cc
 +++ b/src/freedreno/vulkan/tu_knl_darwin.cc
-@@ -1283,11 +1283,57 @@ darwin_note_fence(uint32_t fence)
+@@ -213,6 +213,22 @@ dw_open_connection(struct tu_instance *instance)
+    dw.open = true;
+    dw.inflight_count = 0;
+    dw.last_fence = 0;
++
++   /* The GPU priority this process's Metal queues asked for, to the driver (NativeAdrenoMethodSetPriority): the plugin sets
++    * METAL2VULKAN_QUEUE_PRIORITY=high when the render server opens its device (Metal's MTLGPUPriorityHigh, its foreground queue),
++    * and the driver serves that process's work on the high ring. A process that sets nothing keeps the middle of the range. */
++   {
++      const char *want = getenv("METAL2VULKAN_QUEUE_PRIORITY");
++      NativeAdrenoAbiPriority priority = {.foreground = 1, .background = 3};
++      if (want && !strcmp(want, "high")) {
++         priority.foreground = 0;
++         priority.background = 2;
++      } else if (want && !strcmp(want, "low")) {
++         priority.foreground = 2;
++         priority.background = 2;
++      }
++      (void)dw_call(NativeAdrenoMethodSetPriority, &priority, sizeof(priority), NULL, 0);
++   }
+    return VK_SUCCESS;
+ }
+ 
+@@ -1283,11 +1299,67 @@ darwin_note_fence(uint32_t fence)
     dw.last_fence = fence;
  }
  
@@ -529,6 +562,16 @@ index 0209408..67b7e2c 100644
 +static struct tu_darwin_submit_rec darwin_submit_ring[512];
 +static uint32_t darwin_submit_seq;
 +
++/* The host's diagnostics switch (SHENG_DIAG, set by the plugin from sheng-diag=1): without it no submission is kept in the ring. */
++static bool
++darwin_submit_trace_on(void)
++{
++   static int on = -1;
++   if (on < 0)
++      on = getenv("SHENG_DIAG") != NULL;
++   return on;
++}
++
 +extern "C" __attribute__((visibility("default"))) uint32_t tu_darwin_submit_ring_read(uint32_t from, struct tu_darwin_submit_rec *out,
 +                                                                                    uint32_t max, uint32_t *newest);
 +extern "C" __attribute__((visibility("default"))) uint32_t
@@ -559,7 +602,7 @@ index 0209408..67b7e2c 100644
  {
     struct tu_device *dev = queue->device;
     NativeAdrenoAbiSubmit req = {};
-@@ -1298,21 +1344,26 @@ darwin_submit_chunk(struct tu_queue *queue, const NativeAdrenoAbiSubmitBuffer *e
+@@ -1298,21 +1370,26 @@ darwin_submit_chunk(struct tu_queue *queue, const NativeAdrenoAbiSubmitBuffer *e
  
     for (;;) {
        NativeAdrenoAbiSubmitReply reply = {};
@@ -586,7 +629,7 @@ index 0209408..67b7e2c 100644
     }
  }
  
-@@ -1330,12 +1381,15 @@ darwin_queue_submit(struct tu_queue *queue, void *_submit,
+@@ -1330,12 +1407,15 @@ darwin_queue_submit(struct tu_queue *queue, void *_submit,
      * fence is therefore met by the ring itself, as msm_gem_submit() skips fences of the submitting ring's own context: the CPU does
      * not wait for that work to complete. A sync not yet resolved (wait-before-signal) is waited for until it is submitted, never for
      * its completion. */
@@ -602,7 +645,7 @@ index 0209408..67b7e2c 100644
  
     uint32_t fence = 0;
     const unsigned total = util_dynarray_num_elements(&submit->commands, NativeAdrenoAbiSubmitBuffer);
-@@ -1345,20 +1399,29 @@ darwin_queue_submit(struct tu_queue *queue, void *_submit,
+@@ -1345,20 +1425,29 @@ darwin_queue_submit(struct tu_queue *queue, void *_submit,
        for (unsigned at = 0; at < total; at += NativeAdrenoAbiMaxBuffers) {
           unsigned count = MIN2(total - at, (unsigned)NativeAdrenoAbiMaxBuffers);
           uint32_t chunk_fence = 0;
@@ -624,7 +667,7 @@ index 0209408..67b7e2c 100644
     }
  
 +   rec.fence = fence;
-+   {
++   if (darwin_submit_trace_on()) {
 +      const uint32_t seq = p_atomic_inc_return(&darwin_submit_seq);
 +      rec.seq = seq;
 +      darwin_submit_ring[seq % 512] = rec;
@@ -633,3 +676,16 @@ index 0209408..67b7e2c 100644
     for (uint32_t i = 0; i < signal_count; i++) {
        struct vk_darwin_sync *s = container_of(signals[i].sync, struct vk_darwin_sync, vk);
        s->fence = fence;
+@@ -1569,7 +1658,11 @@ tu_knl_darwin_load(struct tu_instance *instance)
+    device->has_set_iova = !!(info->flags & NativeAdrenoDeviceClientIova);
+    device->va_start = info->va_start;
+    device->va_size = info->va_size;
+-   device->has_lazy_bos = true;   /* darwin_sparse_vma_init */
++   /* Lazily allocated memory only where passes may keep attachments in tile memory (darwin_sparse_vma_init). With every pass in system
++    * memory (TU_DEBUG=sysmem) a lazy BO is backed in full at the first pass, on the render thread: 40-112 MiB wired inside
++    * vkCmdEndRenderPass, up to 340 ms each (untagged-3f2bd680), and freed again with the memory. Without the type a memoryless
++    * attachment is ordinary device memory, which the runtime places and keeps spare for the next one. */
++   device->has_lazy_bos = !TU_DEBUG(SYSMEM);
+    device->has_sparse = false;
+    device->has_sparse_prr = false;
+    device->has_raytracing = false;

scripts/analyze-corecrypto-edges.py

@@ -12,7 +12,7 @@ import subprocess
 
 ROOT = Path(__file__).resolve().parents[1]
 stock = ROOT / '.cache/firmware/kernelcache.macho/kernelcache.release.ipad7.decompressed'
-baseline = ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf'
+baseline = ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped'
 parser = argparse.ArgumentParser(description=__doc__)
 parser.add_argument('--bundle', default='com.apple.kec.corecrypto')
 args = parser.parse_args()

scripts/audit-target-display-query.py

@@ -232,7 +232,7 @@ plan['thread_snapshot_layout'] = dict(
     attr_shift=member(objects / 'osfmk/DEVELOPMENT/pmap.o', 'page_table_attr', 'pta_page_shift'))
 plan['process_layout']['pmap_object_sha256'] = hashlib.sha256(
     (objects / 'osfmk/DEVELOPMENT/pmap.o').read_bytes()).hexdigest()
-native_path = objects / 'mach.development.bcm2837.unstripped.noctf'
+native_path = objects / 'mach.development.bcm2837.unstripped'
 native_symbols = subprocess.check_output(['xcrun', 'nm', '-U', native_path], text=True)
 if '"pmap_pt_attr"' in subprocess.check_output(['xcrun', 'dwarfdump', '--name=pmap', '--show-children',
         objects / 'osfmk/DEVELOPMENT/pmap.o'], text=True):

scripts/audit-target-kext-bindings.py

@@ -20,7 +20,7 @@ args = parser.parse_args()
 folder = ROOT / 'build/target-kexts' / args.bundle
 metadata = json.loads((folder / 'segments.json').read_text())
 stock = ROOT / '.cache/firmware/kernelcache.macho/kernelcache.release.ipad7.decompressed'
-baseline = ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf'
+baseline = ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped'
 data = stock.read_bytes()
 if hashlib.sha256(data).hexdigest() != 'f18b4df865405f2a287b84977d7aca745e056d656d9fc9df1662970ce2969de7':
     raise SystemExit('Wrong target kernelcache')

scripts/build-adreno-metal-bridge.py

@@ -59,7 +59,13 @@ PATCHES = [ROOT / 'drivers/AdrenoMetal/bridge/patches' / name for name in [
     '0021-spare-image-blocks-and-room-keeper.patch',
     # stage_trace.rs: each command buffer's stages from its commit to its completion (commit, lowering, recording, the scheduler's
     # holds, each submission, the completion waiter) and the scheduler's sleeps and wakes, read by the frontend (nmb_stage_ring_read).
-    '0022-command-buffer-stage-trace.patch']]
+    '0022-command-buffer-stage-trace.patch',
+    # The threads that bring command buffers to their handlers run at the user-interactive class and the compile threads at least at
+    # the user-initiated class on iOS too, not on macOS alone: on the iPad they ran at the default class and woke up to 50 ms late.
+    '0023-quality-of-service-on-ios.patch',
+    # The host's diagnostics switch (SHENG_DIAG, from the boot argument sheng-diag=1): without it the stage ring and the allocation sites
+    # keep nothing. The stage ring also marks the steps inside a batch's submission (SubmitStep: placed, gathered, vkQueueSubmit, changes).
+    '0024-diagnostics-switch-and-submit-steps.patch']]
 
 
 def git_tree(*steps):

scripts/build-sheng-source-drivers.py

@@ -102,7 +102,7 @@ def main():
     kernel_object = Path(record['directory']) / 'IOPlatformExpert.cpo'
     target.check_object(kernel_object.read_bytes(), 'Kernel compilation recipe')
     target.check_object((Path(c_record['directory']) / 'startup.o').read_bytes(), 'Kernel C compilation recipe')
-    kernel = tree / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf'
+    kernel = tree / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped'
     out = tree / 'build/sheng-source-drivers'
     out.mkdir(parents=True, exist_ok=True)
     manifest = out / 'report.json'

scripts/build-xnu-4k-baseline.sh

@@ -100,7 +100,7 @@ if not stamp.exists() or stamp.read_text() != identity:
                              ('bsd', ['bsd_init','kern_exec','kern_exit']), ('pexpert', ['pe_kprintf'])]:
         for name in names:
             (out / directory / 'DEVELOPMENT' / (name + '.o')).unlink(missing_ok=True)
-    (out / 'mach.development.bcm2837.unstripped.noctf').unlink(missing_ok=True)
+    (out / 'mach.development.bcm2837.unstripped').unlink(missing_ok=True)
     out.mkdir(parents=True, exist_ok=True)
     stamp.write_text(identity)
 PY
@@ -810,7 +810,7 @@ identity = '|'.join(mode + ':' + state(mode, archive) for mode, archive in zip(s
 if not stamp.exists() or stamp.read_text() != identity:
     # Make does not track selection of an older alternative external archive.
     # Rebuild the conditional personality and relink when this input changes.
-    for relative in ('mach.development.bcm2837.unstripped.noctf',
+    for relative in ('mach.development.bcm2837.unstripped',
                      'iokit/DEVELOPMENT/KernelConfigTables.cpo'):
         (directory / relative).unlink(missing_ok=True)
     directory.mkdir(parents=True, exist_ok=True)
@@ -829,5 +829,5 @@ make -C .cache/xnu-work "${XNU_BUILD_TARGET:-build}" SDKROOT="${XNU_SDKROOT:-iph
   OBJROOT="$ROOT/build/xnu/ios-obj" SYMROOT="$ROOT/build/xnu/ios-sym" DSTROOT="$ROOT/build/xnu/ios-dst"
 if [ "${XNU_SOURCE_CORECRYPTO14:-0}" = 1 ] && [ "$CRYPTO_BOOTSTRAP_MODE" = source ]; then
   python3 scripts/seal-source-crypto-kernel.py \
-    build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf
+    build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped
 fi

scripts/check-accelerator-abi.py

@@ -9,7 +9,7 @@ def require(v,s):
 def sha(p):return hashlib.sha256(p.read_bytes()).hexdigest()
 def load(p):return json.loads(p.read_text())
 base=ROOT/'build/xnu-prelink/native-owner-accelerator-abi-candidate';plan=load(base.with_suffix('.json'));raw=base.with_suffix('.macho').read_bytes();im=macho(raw)
-require(hashlib.sha256(raw).hexdigest()==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'],'Exact current native and immutable candidate')
+require(hashlib.sha256(raw).hexdigest()==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'],'Exact current native and immutable candidate')
 old=load(ROOT/'build/xnu-prelink/native-owner-offline-gpu-broker-cpu-candidate.json')
 require(plan['components']==old['components'] and plan['original_executable_sha256']==old['original_executable_sha256'] and plan['early_security_initializers']==old['early_security_initializers'],'Same original component/security initialization closure')
 for module,digest in plan['original_executable_sha256'].items():

scripts/check-native-legacy-display.py

@@ -37,7 +37,7 @@ plan = json.loads(candidate.with_suffix('.json').read_text())
 raw = candidate.read_bytes()
 image = macho(raw)
 require(sha(candidate) == plan['candidate_sha256'], 'Exact observed candidate')
-native = ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf'
+native = ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped'
 require(sha(native) == plan['native_sha256'], 'Current native source kernel')
 for family, digest in plan['original_executable_sha256'].items():
     extents = [e for e in plan['extents'] if e['module'] == family and e['segment'] == '__TEXT_EXEC']

scripts/check-native-legacy-logical-pm.py

@@ -19,7 +19,7 @@ require(sha(ROOT/'build/native-legacy-display/libNativeLegacyDisplay.late.a')==b
         'Exact compiled archive and qualified lifecycle overrides')
 kernel=ROOT/'build/xnu-prelink/native-owner-legacy-display-pm-candidate.macho';plan=load(kernel.with_suffix('.json'))
 raw=kernel.read_bytes();image=macho(raw)
-require(sha(kernel)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'], 'Exact current native candidate')
+require(sha(kernel)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'], 'Exact current native candidate')
 for module,digest in plan['original_executable_sha256'].items():
     e=next(e for e in plan['extents'] if e['module']==module and e['segment']=='__TEXT_EXEC')
     o=backed_offset(image['segments'],e['va'],e['size'],len(raw))

scripts/check-native-metal-vertex-inputs.py

@@ -17,7 +17,7 @@ d=load(fixture/'gdb-stop.json');host=load(folder/'host-enabled-report.json');pro
 build=load(folder/'build-report.json');data=load(folder/'data-report.json');manifest=load(folder/'test-inputs.json')
 base=a.candidate_base.resolve();plan=load(base.with_suffix('.json'));raw=base.with_suffix('.macho').read_bytes();segments=macho(raw)['segments']
 require(sha(base.with_suffix('.macho'))==plan['candidate_sha256']==d['kernel_sha256'],'Actual immutable candidate identity')
-require(sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'],'Exact current native kernel')
+require(sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'],'Exact current native kernel')
 broker_build=load(ROOT/'build/native-offline-gpu/build-report.json')
 for rel,digest in broker_build['source_sha256'].items():require(sha(ROOT/rel)==digest,'Exact compiled native broker source: '+rel)
 require(sha(ROOT/'build/native-offline-gpu/libNativeOfflineGPU.late.a')==broker_build['archive_sha256'],'Exact compiled private broker archive')

scripts/check-original-gpu-client-abi.py

@@ -10,7 +10,7 @@ def sha(p):return hashlib.sha256(p.read_bytes()).hexdigest()
 def require(ok,why):
  if not ok:raise SystemExit(why)
 base=ROOT/'build/xnu-prelink/native-owner-original-client-abi-candidate';plan=load(base.with_suffix('.json'));raw=base.with_suffix('.macho').read_bytes();segments=macho(raw)['segments']
-require(sha(base.with_suffix('.macho'))==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'],'Exact current native kernel/candidate')
+require(sha(base.with_suffix('.macho'))==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'],'Exact current native kernel/candidate')
 reference=load(ROOT/'build/xnu-prelink/native-owner-metal-shared-events-candidate.json');require(plan['components']==reference['components'] and plan['original_executable_sha256']==reference['original_executable_sha256'] and plan['early_security_initializers']==reference['early_security_initializers'],'Same 29 unchanged original components/security entry')
 for module,digest in plan['original_executable_sha256'].items():
  e=next(e for e in plan['extents'] if e['module']==module and e['segment']=='__TEXT_EXEC');o=backed_offset(segments,e['va'],e['size'],len(raw));require(hashlib.sha256(raw[o:o+e['size']]).hexdigest()==digest,'Actual whole original executable identity '+module)

scripts/check-original-gpu-provider.py

@@ -11,7 +11,7 @@ def require(ok,why):
  if not ok:raise SystemExit(why)
 p=argparse.ArgumentParser(description=__doc__);p.add_argument('--candidate-base',type=Path,default=ROOT/'build/xnu-prelink/native-owner-original-descriptor-refusal-candidate');args=p.parse_args()
 base=args.candidate_base.resolve();plan=load(base.with_suffix('.json'));raw=base.with_suffix('.macho').read_bytes();segments=macho(raw)['segments']
-require(sha(base.with_suffix('.macho'))==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'],'Exact current native kernel/candidate')
+require(sha(base.with_suffix('.macho'))==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'],'Exact current native kernel/candidate')
 reference=load(ROOT/'build/xnu-prelink/native-owner-metal-shared-events-candidate.json');require(plan['components']==reference['components'] and plan['original_executable_sha256']==reference['original_executable_sha256'] and plan['early_security_initializers']==reference['early_security_initializers'],'Same 29 unchanged original components/security entry')
 for module,digest in plan['original_executable_sha256'].items():
  e=next(e for e in plan['extents'] if e['module']==module and e['segment']=='__TEXT_EXEC');o=backed_offset(segments,e['va'],e['size'],len(raw));require(hashlib.sha256(raw[o:o+e['size']]).hexdigest()==digest,'Actual whole original executable identity '+module)

scripts/check-original-queue-completion.py

@@ -21,7 +21,7 @@ require(sha(OUT/'libNativeLegacyDisplay.late.a')==build['archive_sha256'] and
         'Actual archive and qualified original queue-kick override')
 kernel=ROOT/'build/xnu-prelink/native-owner-legacy-display-completion-candidate.macho';plan=load(kernel.with_suffix('.json'))
 raw=kernel.read_bytes();image=macho(raw)
-require(sha(kernel)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'],'Exact current native candidate')
+require(sha(kernel)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'],'Exact current native candidate')
 for module,digest in plan['original_executable_sha256'].items():
     e=next(e for e in plan['extents'] if e['module']==module and e['segment']=='__TEXT_EXEC')
     o=backed_offset(image['segments'],e['va'],e['size'],len(raw))

scripts/check-original-queue-transfer.py

@@ -20,7 +20,7 @@ require(sha(OUT/'libNativeLegacyDisplay.late.a')==build['archive_sha256'] and
         'Actual archive and qualified original queue-kick override')
 kernel=ROOT/'build/xnu-prelink/native-owner-legacy-display-transfer-ready-candidate.macho';plan=load(kernel.with_suffix('.json'))
 raw=kernel.read_bytes();image=macho(raw)
-require(sha(kernel)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'],'Exact current native candidate')
+require(sha(kernel)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'],'Exact current native candidate')
 for module,digest in plan['original_executable_sha256'].items():
     e=next(e for e in plan['extents'] if e['module']==module and e['segment']=='__TEXT_EXEC')
     o=backed_offset(image['segments'],e['va'],e['size'],len(raw))

scripts/check-renderbox-queue-priority.py

@@ -20,7 +20,7 @@ def require(value,message):
 subprocess.run(['python3',ROOT/'scripts/audit-target-renderbox-device.py'],check=True,timeout=60,capture_output=True)
 sys.path.insert(0,str(ROOT/'kits/XnuPrelink'));from native_prelink import macho,backed_offset
 kernel=ROOT/('build/xnu-prelink/native-owner-offline-gpu-texture-copy-candidate.macho' if a.stencil_texture_refusal else 'build/xnu-prelink/native-owner-offline-gpu-enqueue-candidate.macho' if a.enqueue else 'build/xnu-prelink/native-owner-offline-gpu-priority-candidate.macho');plan=load(kernel.with_suffix('.json'));raw=kernel.read_bytes();image=macho(raw)
-require(sha(kernel)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'],'Exact current native kernel and original-component candidate')
+require(sha(kernel)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'],'Exact current native kernel and original-component candidate')
 for module,digest in plan['original_executable_sha256'].items():
     e=next(e for e in plan['extents'] if e['module']==module and e['segment']=='__TEXT_EXEC');at=backed_offset(image['segments'],e['va'],e['size'],len(raw))
     require(hashlib.sha256(raw[at:at+e['size']]).hexdigest()==digest,'Whole original executable remains unchanged '+module)

scripts/check-system-framebuffer-client.py

@@ -31,7 +31,7 @@ require(int(build['bindings']['__ZTV25IOMobileFramebufferLegacy'],16)==int(audit
         'Apple-kext qualified super calls bind the real original vtable header')
 candidate=ROOT/('build/xnu-prelink/native-owner-legacy-display-'+args.profile+'-candidate.macho');plan=json.loads(candidate.with_suffix('.json').read_text())
 raw=candidate.read_bytes();image=macho(raw)
-require(sha(candidate)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')==plan['native_sha256'],
+require(sha(candidate)==plan['candidate_sha256'] and sha(ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')==plan['native_sha256'],
         'Exact current source kernel and original-family candidate')
 for module,digest in plan['original_executable_sha256'].items():
     extent=next(e for e in plan['extents'] if e['module']==module and e['segment']=='__TEXT_EXEC')

scripts/prepare-offline-gpu-candidate.py

@@ -9,7 +9,7 @@ ROOT=Path(__file__).resolve().parents[1]
 p=argparse.ArgumentParser(description=__doc__);p.add_argument('--output',required=True,type=Path);a=p.parse_args()
 def sha(path):return hashlib.sha256(path.read_bytes()).hexdigest()
 base=ROOT/'build/xnu-prelink/native-owner-offline-gpu-broker-cpu-candidate.json';old=json.loads(base.read_text())
-kernel=ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf'
+kernel=ROOT/'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped'
 original=ROOT/'.cache/firmware/kernelcache.macho/kernelcache.release.ipad7.decompressed';output=a.output.resolve()
 if output.exists() or output.with_suffix('.json').exists():raise SystemExit('Refuse to overwrite any existing candidate or report')
 if sha(original)!=old['original_sha256'] or sha(base.with_suffix('.macho'))!=old['candidate_sha256']:raise SystemExit('Exact original target and retained base candidate required')

scripts/probe-darwinboot-xnu.py

@@ -14,7 +14,7 @@ from unixnu.package import output_dir
 
 ROOT = Path(__file__).resolve().parents[1]
 parser = argparse.ArgumentParser(description=__doc__)
-parser.add_argument('--kernel', type=Path, default=ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')
+parser.add_argument('--kernel', type=Path, default=ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')
 parser.add_argument('--output', type=Path, default=ROOT / 'build/darwinboot-xnu')
 parser.add_argument('--timeout', type=int, choices=range(1, 1801), default=25, help='Bounded guest deadline: up to 300 seconds, or 1800 for explicit live HID control')
 parser.add_argument('--mutate-target-main-page', action='store_true', help='Negative input control: corrupt only the actual launchd LC_MAIN vnode page before genuine validation, preserving original files/signatures')

scripts/test-armdt-platform.py

@@ -22,7 +22,7 @@ args = parser.parse_args()
 
 configure = ROOT / 'build/darwinboot-armdt-platform'
 bsd = ROOT / 'build/darwinboot-armdt-bsd'
-kernel = ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf'
+kernel = ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped'
 
 if not args.check_existing:
     subprocess.run(['python3', ROOT / 'scripts/probe-darwinboot-xnu.py',

scripts/test-corecrypto14-post.py

@@ -10,7 +10,7 @@ import sys
 ROOT = Path(__file__).resolve().parents[1]
 parser = argparse.ArgumentParser(description=__doc__)
 parser.add_argument('--check-existing', action='store_true', help='Validate captured runs without repeating QEMU')
-parser.add_argument('--kernel', type=Path, default=ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped.noctf')
+parser.add_argument('--kernel', type=Path, default=ROOT / 'build/xnu/ios-obj/DEVELOPMENT_ARM64_BCM2837/mach.development.bcm2837.unstripped')
 args = parser.parse_args()
 kernel = args.kernel.resolve()
 original = kernel.read_bytes()