Both audits need hardware and emulator evidence of the original kernelcache that is not in any repository. Their recorded results (AES method addresses, accelerator base class layout) ship with the scripts and are used when the evidence is absent. They belong to the kernelcache pinned in board.toml.
Bring the current NativeAdreno, NativeMetal, AdrenoFirmware, AdrenoPM4,
AirNir and ArmSmmu4K sources, the Mesa pipeline-cache and builtin-shader
patches, and the Turnip host cache tools.