diff --git a/NOTICE b/NOTICE
index c24a0025d..c69d8bff3 100644
--- a/NOTICE
+++ b/NOTICE
@@ -88,6 +88,9 @@ Fetched at build time, never committed:
 - the phone's firmware (GPU, Wi-Fi, audio DSP, modem, haptics, cameras): the vendor's, pulled from the
   user's own phone (devices/redwood/pull-firmware.sh).
 - lzfse (Apple, BSD-3-Clause), built by xnuloader/mkidentity.sh when no LZFSE decoder is installed.
+- Android's list of access point names (device/sample etc/apns-full-conf.xml, The Android Open Source Project, Apache-2.0), for an
+  image that carries a table of them: fetched at a pinned commit, its SHA-256 checked, and made into the table by tools/apn-table.py,
+  entries unchanged. Neither the list nor the table is in this repository.
 - Mesa (for GL=1 images; Turnip for TURNIP=1, tools/mk-turnip.sh), Procursus and Sileo packages (tools/mk-jb.sh): their own licenses.
 - Mesa's PanVK (Mesa 25.0.7, MIT), for PANVK_DIR= images: fetched by tools/mk-panvk.sh, patched with tools/mesa/*.patch
   and tools/mesa/panvk/*.patch (Mesa's licence applies to the lines those add) and built into libvulkan_panfrost.dylib.
diff --git a/THIRD_PARTY_LICENSES.md b/THIRD_PARTY_LICENSES.md
index b02376257..2cc78e7a8 100644
--- a/THIRD_PARTY_LICENSES.md
+++ b/THIRD_PARTY_LICENSES.md
@@ -57,6 +57,7 @@ This supersedes the summary in `NOTICE`, which stays as the short, canonical lis
 | Mesa (GL=1 images) | `tools/mk-mesa.sh` | Mesa project | MIT and others |
 | Mesa's gfxstream guest Vulkan driver (`src/gfxstream`, with the Vulkan runtime it builds on) | `tools/gfxstream/mk-vk.sh` | Google / AOSP via the Mesa project | MIT |
 | gfxstream (codegen descriptions; host renderer for the Scion app) | `tools/gfxstream/fetch.sh`, `mk-host-android.sh` | Google | Apache-2.0 (some MIT) |
+| Android's list of access point names (data for an image's APN table; not in the repository) | `tools/apn-table.py` (fetched from android.googlesource.com/device/sample at a pinned commit, SHA-256 checked) | The Android Open Source Project | Apache-2.0 |
 | metal2vulkan (runtime, translator, AIR reader; METAL=vk images) | `tools/metal/mk-metal2vulkan.sh` (github.com/steelbrain/metal2vulkan at `720ef1ce9ae2`, with AdrenoMetal's patches and ours in `tools/metal/m2v/`) | Anees Iqbal | GPL-2.0-or-later OR LGPL-3.0-or-later; only ever in its own `libmetal2vulkan.dylib`, which can be replaced |
 | Rust toolchain and crates (ash, libc, sha2, serde ...) | `tools/metal/mk-metal2vulkan.sh` (rustup into `xnu-deps/rust`, crates.io) | the Rust project, crate authors | MIT / Apache-2.0 |
 | Turnip, Mesa's Vulkan driver (TURNIP=1) | `tools/mk-turnip.sh`, in `tools/mk-mesa.sh`'s tree | Mesa project, 25.0.7 | MIT and others |
diff --git a/configs/boot-args.lst b/configs/boot-args.lst
index d5040b5a9..5140ce5e5 100644
--- a/configs/boot-args.lst
+++ b/configs/boot-args.lst
@@ -183,6 +183,19 @@ cohtest_delay	k
 console_quiet	k
 core0	kl
 core1	l
+cp	k
+cp_apn	k
+cp_delay	k
+cp_ds	k
+cp_if	k
+cp_if_kb	k
+cp_nv	k
+cp_ping	k
+cp_rev	k
+cp_route	k
+cp_sim	k
+cp_vss	k
+cp_wait	k
 cpufreq	k
 cpufreq_gov	k
 cpufreq_gov_big_dual	k
diff --git a/configs/symbols.tsv b/configs/symbols.tsv
index 214128d22..f227ba4e6 100644
--- a/configs/symbols.tsv
+++ b/configs/symbols.tsv
@@ -173,6 +173,19 @@ COHTEST_DELAY	arg	cohtest_delay	User space	k	hakios.exynos_m3.c
 CONSOLE_QUIET	arg	console_quiet	User space	k	1003-avf-console-quiet.patch	
 CORE0	arg	core0	Loader	kl	loader.c,psci_smp.c	the kernel's box for this core (above), if it has one, and only with a kernel on another core to watch
 CORE1	arg	core1	Loader	l	loader.c	core 1, which S-Boot uses for its own display work, listed for the kernel all the same
+CP	arg	cp	User space	k	hakios.shannon.c	
+CP_APN	arg	cp_apn	User space	k	hakios.shannon.c	the access point name stage 6 asks the data context for (the operator's published default; none: no stage 6)
+CP_DELAY	arg	cp_delay	User space	k	hakios.shannon.c	seconds after the boot before the modem's driver does anything (30), so that its lines are in the log
+CP_DS	arg	cp_ds	User space	k	hakios.shannon.c	the dual SIM field told to the modem (0)
+CP_IF	arg	cp_if	User space	k	hakios.shannon.c	with cp=6 or 7 and cp_apn: the active data context becomes a network interface, pdp_ip0 (IPv4, point to point, the CP's address for it), and stays
+CP_IF_KB	arg	cp_if_kb	User space	k	hakios.shannon.c	with cp_if=1: at most N KB through pdp_ip0 in a boot, both ways (2048 by default; the owner's mobile plan), then it drops
+CP_NV	arg	cp_nv	User space	k	hakios.shannon.c	the phone's own NV data, a file nv_data.bin the image's builder put beside the kernel, is given to the modem (none: zeros, and no stage 4)
+CP_PING	arg	cp_ping	User space	k	hakios.shannon.c	the address stage 7 sends its one echo request to (none: the context's first DNS server)
+CP_REV	arg	cp_rev	User space	k	hakios.shannon.c	the board's revision told to the modem (26, this phone's)
+CP_ROUTE	arg	cp_route	User space	k	hakios.shannon.c	with cp_if=1: an IPv4 default route through pdp_ip0 (only when there is none yet: Wi-Fi's wins)
+CP_SIM	arg	cp_sim	User space	k	hakios.shannon.c	in low power mode, once the SIM is ready, one read of its administrative data file (EF_AD, 4 bytes: no identity) is asked, to see if the modem takes
+CP_VSS	arg	cp_vss	User space	k	hakios.shannon.c	the image's VSS part (the voice processor's) is not copied
+CP_WAIT	arg	cp_wait	User space	k	hakios.shannon.c	seconds the started modem is watched before it is put back in reset (20; 25 with the link)
 CPUFREQ_GOV	arg	cpufreq_gov	User space	k	hakios.exynos_cpufreq.c	run it (0, or none: the fixed rates of cpufreq_lit= and cpufreq_big=)
 CPUFREQ_GOV_BIG_DUAL	arg	cpufreq_gov_big_dual	User space	k	hakios.exynos_cpufreq.c	
 CPUFREQ_GOV_BIG_MAX	arg	cpufreq_gov_big_max	User space	k	hakios.exynos_cpufreq.c	
diff --git a/docs/boot-args.md b/docs/boot-args.md
index 1f6bbaa8a..4e8133bcb 100644
--- a/docs/boot-args.md
+++ b/docs/boot-args.md
@@ -2,7 +2,7 @@
 
 Made by `tools/boot-args.py --markdown`; CI fails if it is out of date with the source (`tools/boot-args.py --check`).
 
-Every argument that the kernel, the loader or user space of this port reads, and which file reads it. **675 arguments**: 584 read by the kernel, 23 by the loader, 85 by user space (one is read in more than one place).
+Every argument that the kernel, the loader or user space of this port reads, and which file reads it. **688 arguments**: 597 read by the kernel, 23 by the loader, 85 by user space (one is read in more than one place).
 
 This is a catalogue of what exists and who reads it, not a manual. What an argument means is in the head of the file that reads it. The stable switches have a symbol in the configuration (`tools/hakios-config.py help SYMBOL`, `docs/configs.md`); the rest are the knobs of bring-up (a driver's steps, pauses, traces, test modes) and can change with the driver. Any of them can be given in a configuration with `CONFIG_BOOTARGS="name=value ..."`, which checks that each name is in this list. What the arguments of the two Metal paths do: [Metal on the Adreno](reference/metal.md#boot-arguments).
 
@@ -593,7 +593,7 @@ Layers: **K** the kernel, **L** the loader, **U** user space (through `sysctl ke
 | `ufs_probe` | L | `loader.c` | `CONFIG_UFS_PROBE` |  |
 | `ufs_write_guid` | L | `loader.c` | `CONFIG_UFS_WRITE_GUID` |  |
 
-## User space (170)
+## User space (183)
 
 | Argument | Layer | Read by | Configuration | Set by |
 |---|---|---|---|---|
@@ -659,6 +659,19 @@ Layers: **K** the kernel, **L** the loader, **U** user space (through `sysctl ke
 | `cohtest` | K | `hakios.exynos_m3.c` | `CONFIG_COHTEST` |  |
 | `cohtest_delay` | K | `hakios.exynos_m3.c` | `CONFIG_COHTEST_DELAY` |  |
 | `console_quiet` | K | `1003-avf-console-quiet.patch` | `CONFIG_CONSOLE_QUIET` |  |
+| `cp` | K | `hakios.shannon.c` | `CONFIG_CP` |  |
+| `cp_apn` | K | `hakios.shannon.c` | `CONFIG_CP_APN` |  |
+| `cp_delay` | K | `hakios.shannon.c` | `CONFIG_CP_DELAY` |  |
+| `cp_ds` | K | `hakios.shannon.c` | `CONFIG_CP_DS` |  |
+| `cp_if` | K | `hakios.shannon.c` | `CONFIG_CP_IF` |  |
+| `cp_if_kb` | K | `hakios.shannon.c` | `CONFIG_CP_IF_KB` |  |
+| `cp_nv` | K | `hakios.shannon.c` | `CONFIG_CP_NV` |  |
+| `cp_ping` | K | `hakios.shannon.c` | `CONFIG_CP_PING` |  |
+| `cp_rev` | K | `hakios.shannon.c` | `CONFIG_CP_REV` |  |
+| `cp_route` | K | `hakios.shannon.c` | `CONFIG_CP_ROUTE` |  |
+| `cp_sim` | K | `hakios.shannon.c` | `CONFIG_CP_SIM` |  |
+| `cp_vss` | K | `hakios.shannon.c` | `CONFIG_CP_VSS` |  |
+| `cp_wait` | K | `hakios.shannon.c` | `CONFIG_CP_WAIT` |  |
 | `cpufreq_gov` | K | `hakios.exynos_cpufreq.c` | `CONFIG_CPUFREQ_GOV` |  |
 | `cpufreq_gov_big_dual` | K | `hakios.exynos_cpufreq.c` | `CONFIG_CPUFREQ_GOV_BIG_DUAL` |  |
 | `cpufreq_gov_big_max` | K | `hakios.exynos_cpufreq.c` | `CONFIG_CPUFREQ_GOV_BIG_MAX` |  |
diff --git a/docs/ios27/FULLROOT.md b/docs/ios27/FULLROOT.md
index 3bffd6645..d29f5c3cb 100644
--- a/docs/ios27/FULLROOT.md
+++ b/docs/ios27/FULLROOT.md
@@ -33,6 +33,8 @@ some Settings rows lack icons.
    `_PanicOnCrash` dropped; `lists/`; `DISABLE_HOGS=1` adds the opt-in CPU-hog list) | `30 overlay` (builder's userland shims,
    manifest-checked) | `40 prefs` (Reduce Motion / Reduce Transparency OFF, CA compression off, watchdogs off) |
    `50 xpc-disable` (MessagesBlastDoorService) |
+   `60 sileo` (the package manager: the Procursus bootstrap and Sileo as `/jb`, seeded to `/var/jb` at the first boot, kept and
+   flushed; default on, `ENABLE_SILEO=0` turns it off; needs `tools/ios27/sileo/prepare.sh` first; [SILEO.md](SILEO.md)) |
    `70 lsd-extkit` (ExtensionKit FeatureFlag off + LaunchServices store rebuild: the kernel has no AMFI trust cache, so the signed
    extension-point cache was rejected and no framework-declared extension point registered; `ENABLE_LSD_EXTKIT=0` turns it off).
 4. `check-root.sh`: required files, cache hard links, patched words, launchd plist sanity, prefs, Mach-O rewrite complete.
diff --git a/docs/ios27/METAL-ROTATION.md b/docs/ios27/METAL-ROTATION.md
new file mode 100644
index 000000000..318c4b143
--- /dev/null
+++ b/docs/ios27/METAL-ROTATION.md
@@ -0,0 +1,50 @@
+# iOS 27 on the Galaxy S9: the interface on its side under the Metal compositor (12 November 2026)
+
+With CoreAnimation's Metal renderer as the compositor ([LIQUID-GLASS.md](LIQUID-GLASS.md)) the panel kept its last upright
+picture whenever the interface turned to landscape, until it was upright again. The app underneath was running and took
+touches. Under the OpenGL ES compositor the same turn drew.
+
+## What CoreAnimation asks for
+
+The display's two swap surfaces never change: 828 x 1792 pixels, 3328 bytes a row, rows along the panel. When the display
+is to show the interface turned by a quarter, CoreAnimation's Metal renderer does not turn its own drawing. It asks Metal
+for a texture over each swap surface whose descriptor has the turned size, 1792 x 828, and a rotation (a private property
+of Metal's texture descriptor; 3 on a phone held in landscape, 0 otherwise), and then draws the interface into that
+texture the way it reads. A GPU with turned render targets stores the picture turned, so the surface still holds what the
+panel scans out. (The OpenGL ES renderer has no such texture and turns its drawing itself, which is why that path drew.)
+
+Seen on the phone, in a line the plug-in printed for the refusal: `want 1792x828 fmt 80 usage 0x5 rotation 3 | surface
+828x1792 bpr 3328`, asked from the renderer's "texture of this surface" step when it makes a buffer current, sixty times in
+the two seconds of the turn. The plug-in ignored the rotation, took the request for a texture 1792 pixels wide over rows
+of 3328 bytes, and refused it (`BufferTexture(RowPitch { bytes_per_row: 3328, row_bytes: 7168 })`). With no texture for
+its destination CoreAnimation drew nothing.
+
+## What the plug-in does now
+
+No Vulkan image can lie over the surface that way, so a texture asked for with a rotation is two textures
+(`tools/ios27/metal/patches/frontend-turned.diff`, "turned textures"):
+
+- the one the caller gets has the asked shape and lives in device memory. Everything drawn into it, sampled from it or
+  copied with it is as the caller means it; its `iosurface` and `rotation` answer what was asked;
+- the surface's own texture, unturned, which the caller never sees.
+
+Every command buffer that drew into the first (or into a view of it) ends with one more render pass, added at commit: a
+single triangle over the surface's texture whose fragment reads the picture through the turn
+(`tools/ios27/metal2/TurnShaders.metal`, one fragment function for each of the three turns, nearest sampling, texel for
+texel). The surface is written before the buffer completes, which is before the window server hands it to the display.
+The pass is built by the bundle's script with the Metal compiler of the same Xcode and compiled on the phone like any
+other pipeline (and kept in the pipeline cache).
+
+Cost: one pass over the screen for each frame while the interface is turned, and 6 MiB of device memory for each of the
+two swap surfaces. Upright, nothing changes: a descriptor without a rotation takes the path it always took.
+
+Only rotation 3 has been asked for by iOS 27 and only that one has been seen on a panel; 1 and 2 are written the same
+way and are untested. A texture with a rotation that is not a plain 2D, single-level, single-sample texture of the
+surface's turned size is refused with a line.
+
+## Seen
+
+Phone held on its long edge, Notes in front: landscape, then upright (the accelerometer answered by the console's
+`sensors fake 0 4096 0`), then landscape again, each drawn, with the glass of the search field and the round buttons that
+the OpenGL ES compositor does not draw. `native-metal: turned texture 1792x828 fmt 80 turn 3 over surface 1 (828x1792)`
+once for each swap surface, no refusal. The picture is the same way up as the OpenGL ES compositor's.
diff --git a/docs/ios27/MODEM-IOS.md b/docs/ios27/MODEM-IOS.md
new file mode 100644
index 000000000..5d506426a
--- /dev/null
+++ b/docs/ios27/MODEM-IOS.md
@@ -0,0 +1,84 @@
+# The Galaxy S9's modem on iOS 27: what iOS needs for SIM, carrier and bars
+
+Written 13 November 2026. This is a research note and plan. Nothing here is built yet, except the kernel side under
+"What the kernel gives today". Facts about iOS come from public documentation and published research. No Apple
+binary, offset or table is in this file.
+
+## What the kernel gives today (scion-kernel `drivers/modem/hakios.shannon.c`, all off by default)
+
+| Boot-arg | What it does |
+|---|---|
+| `cp=1`…`cp=7` | The S9's Shannon CP: loaded from RADIO, checked by the secure world, started, linked. Then low power mode, the SIM's state, normal mode (registration), one data context (`cp_apn=`), and three test packets through it |
+| `cp_nv=2` | The CP's non-volatile data read at boot from the EFS partition, `/nv_data.bin`, through a read-only ext4 reader (`hakios.ext4ro.h`). It is kept in RAM only. EFS is never mounted and never written; only its size and a CRC prefix are logged |
+| (with `cp_nv=2`) | The CP's file requests for its NV data (RFS NV read/write) are answered from that RAM copy. Its writes stay in RAM for the run and are never written back |
+| `cp_if=1` | The active data context becomes `pdp_ip0`: IPv4, point to point, with the context's address on it. The context stays up until `sysctl kern.hakios.cp.go=2` |
+| `cp_route=1` | An IPv4 default route through `pdp_ip0`, if there is none yet |
+| `cp_if_kb=N` | A per-boot byte budget on `pdp_ip0`, 2048 KB by default |
+
+Seen on phone 1 (SM-G960F, GoMo SIM on eir, 272-03), 13 Nov 2026:
+- SIM ready, registered HOME.
+- The NV data came from EFS, and the CP's NV writes were answered.
+- `pdp_ip0` came up with the context's address and a default route, and packets went both ways from user space.
+
+## What iOS has on top of a baseband, and why none of it sees ours
+
+- **CommCenter** (CoreTelephony's daemon) owns the baseband. It finds the modem through IOKit services that Apple's
+  baseband drivers publish. On an iPhone 11 (the identity this port uses, iPhone12,1) that is an Intel XMM modem over
+  PCIe, spoken to in Apple's ARI protocol ("Apple Remote Invocation"; reverse-engineered in public by the ARIstoteles
+  project, Kröll et al., WiSec 2021).
+- CommCenter does everything above the modem: SIM handling, registration, the operator's name (from the SIM, the
+  network and the carrier bundles), signal bars, data contexts, the cellular network service and its DNS, and SMS
+  and calls.
+- **Clients** (SpringBoard's status bar, Settings > Mobile Service, Preferences) ask CommCenter over private XPC
+  (CoreTelephony's `CTServerConnection`, the `com.apple.commcenter.*` services). They never see the modem.
+- **Data on iOS:** CommCenter brings a context up, configures `pdp_ipN`, and registers a cellular network service with
+  configd (the IPv4 and DNS state that IPMonitor turns into the routing table and the resolver). Without that service,
+  a kernel route through `pdp_ip0` carries traffic, but iOS's resolver has no DNS server for it, and iOS's own
+  reachability does not treat cellular as up.
+
+Our CP speaks Samsung IPC over SIPC5 rings, not ARI. CommCenter finds no baseband it knows, so iOS shows no SIM, no
+carrier and no bars.
+
+## The ways to the iOS side, in order of size
+
+1. **DNS and "cellular is up" for user space (small; next).**
+   - A root daemon in the package-manager prefix reads the kernel's modem state (new read-only sysctls:
+     registration, the context's address and DNS servers, signal).
+   - It publishes a network service for `pdp_ip0` into configd's dynamic store: `State:/Network/Service/<id>/IPv4`
+     (address, interface `pdp_ip0`, router) and `.../DNS` (the context's DNS servers).
+   - IPMonitor then makes the default route and the resolver as it does for any service. The kernel's own default
+     route (`cp_route=1`) is no longer needed.
+   - Wi-Fi keeps priority through service order (IPMonitor's rank).
+   - Gives: names resolve, and every app's traffic goes over cellular when Wi-Fi is off.
+   - Does not give: bars or a carrier name.
+2. **Bars and carrier name in the status bar (medium; cosmetic).**
+   - The port already injects dylibs into SpringBoard and backboardd (`sweetinject`).
+   - A small injected library in SpringBoard would feed the status bar's cellular entry (signal bars, operator name,
+     "4G"/"LTE") from the same sysctls: the registration state, the technology (33 = LTE seen), the signal reports,
+     and the network's name from the CP's operator notification (not decoded yet).
+   - Settings would still say "No SIM": that comes from CommCenter.
+   - This touches only our own injected code. No Apple binary changes.
+3. **A real CoreTelephony baseband (large).** Either:
+   - a shim that answers CommCenter as an ARI baseband would (the IOKit services, the ARI messages for SIM,
+     registration, signal and data) and translates them to Samsung IPC. This needs ARI's message set for the
+     iPhone12,1 firmware generation.
+   - or a replacement for CommCenter's XPC services. The private interface is large.
+
+   Either one gives SIM in Settings, the operator from the carrier bundle, bars, and data through iOS's own
+   path. Weeks of work, with real risk. Do not start without the owner's go.
+
+What stays out of every path:
+- No IMEI or NV change.
+- No unlock of any kind.
+- No calls or SMS without the owner's explicit say-so.
+- EFS read-only.
+- No Apple binary patched.
+
+## Next concrete steps
+
+1. Kernel: expose read-only sysctls `kern.hakios.cp.{reg,tech,signal,ip4,dns4}`. Decode the operator name
+   notification, group 0x0a number 0x52 seen, unconfirmed.
+2. A `scion-celld` root daemon (prefix, launchd job like `com.scion.jbseed`) publishing the pdp_ip0 service to configd
+   (step 1 above).
+3. Then the status-bar library (step 2).
+4. Then decide on step 3 with the owner.
diff --git a/docs/ios27/SILEO.md b/docs/ios27/SILEO.md
new file mode 100644
index 000000000..465b9870b
--- /dev/null
+++ b/docs/ios27/SILEO.md
@@ -0,0 +1,141 @@
+# iOS 27 on the S9: Sileo and the package manager's prefix
+
+The 16.5 line has had this by default for a while (`tools/mk-jb.sh`, `userland/src/jb_seed.c`, [apps](../apps.md)). The
+iOS 27 root did not: `tools/ios27/fullroot/` had no step for it, so a full root had no `/var/jb`, no Sileo and nothing in
+`/bin` but `df` and `ps`. It was never installed; nothing crashed and nothing wiped it. This page is the step that puts
+it there, what it leaves on the phone, how it is kept, and what "secure user data" means on this port today.
+
+"Jailbreak" is the word people use for this; here it only means the rootless prefix `/var/jb` with the
+[Procursus](https://github.com/ProcursusTeam/Procursus) bootstrap (dpkg, apt, a shell and the usual tools) and
+[Sileo](https://github.com/Sileo/Sileo) on a system whose kernel is ours. Nothing is broken into.
+
+## What the build does
+
+    tools/ios27/sileo/prepare.sh                  # no root; once; also run by tools/ios27/s9/prepare-root-inputs.sh
+    sudo tools/ios27/s9/build-root.sh inputs      # steps.d/60-sileo.sh is one of its steps; ENABLE_SILEO=0 leaves it out
+
+`prepare.sh` fetches two files from `apt.procurs.us`, each pinned by SHA-256 in `tools/mk-jb.sh` (the bootstrap for
+`iphoneos-arm64-rootless/1800`, and `org.coolstar.sileo` 2.5.1), unpacks them into `jb/` of the checkout (never in git) and
+builds two small programs of ours for iOS. A changed file upstream stops the build. It is the installer's flavour of
+`mk-jb.sh` (`PREINSTALL= ELLEKIT=`): the bootstrap and Sileo and nothing else.
+
+`steps.d/60-sileo.sh ROOT` then puts on the root:
+
+| What | Why |
+|---|---|
+| `/jb` | The prefix as the image carries it. Never run from. `jb_seed` copies it to `/private/var/jb` at the first boot; after that the copy is the phone's own and a later root does not touch it, unless the stamp in `/jb/.scion-stamp` differs: then the old copy is moved aside (`/private/var/jb.old-<time>`) and the new one seeded |
+| `/usr/local/bin/jb_seed` | `userland/src/jb_seed.c`, the same source as on 16.5. Once a boot: seeds if needed, then `/var/jb/prep.sh` (dpkg's `firmware` record, `pwd_mkdb`, Sileo and every app in `/var/jb/Applications` registered with `uicache`) |
+| `/usr/local/bin/var_sync` | `userland/src/var_sync.c`: `sync()` and `F_FULLFSYNC` every 5 seconds. The phone is reset, never shut down, so what was only in memory at that moment would be gone |
+| `/bin/chmod`, `cp`, `mkdir`, `mv`, `rm` | Links into the prefix. Sileo runs them by these names as root and iOS has none of them |
+| two launchd jobs | `com.scion.jbseed`, `com.scion.varsync`, as entries of `/System/Library/xpc/launchd.plist` (iOS's launchd reads its jobs from that file, not from the directories; `tools/ios27/sileo/jobs.py`) |
+
+The step also changes the prefix before it goes on the root, and refuses to go on if the result is not what it expects:
+
+- the only repository is Procursus. The project's own (`repo/` of scion-installer) is added when it is hosted somewhere
+  (`SCION_REPO_URL=https://...` at the build); the 16.5 line's two third-party stores are not listed here;
+- the bootstrap ships a password hash for `mobile`: it is replaced by `!`, which matches nothing (`root` has `!` already);
+- `usr/sbin/shshd` (set-user-ID, for a jailbreak's kernel access) and its job are deleted;
+- it stops if the prefix has OpenSSH or tweak injection in it, a file anyone may write, an account with a password, a
+  Mach-O that is not plain arm64, or a set-ID program other than the bootstrap's seven and Sileo's `giveMeRoot`.
+
+**Instructions.** Every Mach-O of the prefix (388 files) is plain `arm64` built for the baseline, the same files the 16.5
+line runs on the same cores; none is `arm64e`, so the PAC rewrite (`10-macho-a64e`) has nothing to do there. An LSE
+atomic, should a package bring one, is handled where the rest of the system's are: the kernel's emulation on the M3 cores.
+
+**Owners.** Built as root (the full build), everything is `root:wheel` on the image, `var/mobile` is `mobile`'s. A root
+edited without root (below) carries the builder's user ID on those files; `jb_seed` is the first thing that runs any of it,
+as root, and makes them root's before it does anything else. The copy in `/private/var/jb` is `root:wheel` either way.
+
+**Undo.** `60-sileo.sh ROOT undo` takes the five things off the root again and leaves `launchd.plist` equal to what it
+was (checked: the parsed file is identical). The phone's copy `/private/var/jb`, with what was installed into it, stays
+unless `PURGE_PREFIX=1`.
+
+## A phone that is installed already
+
+No new root is needed: the step is one more reversible edit of the root that is on the phone, with the tools the other
+steps use (the phone in TWRP, the root pulled as the pieces that differ from the image it was flashed from, edited on the
+Mac, the changed 64 MiB chunks pushed and read back). `tools/ios27/sileo/README.md` has the commands.
+
+## Apps
+
+A package with an app puts it in `/var/jb/Applications` and its `postinst` runs `uicache -p` (the packages of
+scion-installer's `repo/` do); `prep.sh` registers whatever is there at each boot as well. The kernel has no code-signing
+policy, so an app needs no signature and no account. What this is for: packages, the project's own apps, open-source
+apps built from source ([apps](../apps.md)). What it is not for, here or anywhere in Scion: decrypted or pirated apps,
+signature-bypass packages, anything that defeats an app's DRM.
+
+## Keeping it
+
+The root of an S9 is one HFS Plus volume on USERDATA with `/private/var` on it, so the prefix, dpkg's database, apt's
+lists, Sileo's sources and an app's data are on the flash like everything else, and a later boot finds them. Two things
+make that true in practice: the copy is made under another name and renamed when it is whole (a reset in the middle costs
+that copy and no more), and `var_sync` bounds what a reset can lose to the last five seconds.
+
+## Secure user data: what there is today
+
+Said plainly, because the word is bigger than the thing:
+
+| | iOS 27 on the S9 today |
+|---|---|
+| Encryption at rest | **None.** HFS Plus without content protection; whoever reads USERDATA (TWRP does) reads every file |
+| Protection classes | Labels only. A file marked class A is as readable as one marked D (the fork's `SweetKeyStore.cpp` and `sweet_hfs_pclass.c`) |
+| Passcode | **Cannot be set.** The key store answers as a device without one; nothing is gated by a passcode |
+| Keychain | Works; its keys are not protected at rest |
+| Sandbox | **None.** The kernel's stand-in allows every operation: an app is held back by Unix permissions only |
+| Code signing | Not enforced. Any Mach-O runs |
+| What does hold | Users and modes: apps run as `mobile` (501), the system and the prefix are `root`'s, `mobile` cannot write either |
+
+The 16.5 line is further: a passcode with a real key bag for the keychain ([keystore](../keystore.md),
+[passcode](../passcode.md)); files are not encrypted there either. Bringing that to this tree is separate work.
+
+What the package manager adds to that picture, and what was done so that it does not make it worse:
+
+- **A way to root, by design.** Sileo installs packages by running `giveMeRoot`, a set-user-ID program that checks that
+  its parent is Sileo. With no sandbox, that check is the whole fence between a program running as `mobile` and root.
+  This is what a package manager is on any rootless system; on a port with no sandbox it is worth saying.
+- **No password anywhere.** `root` and `mobile` are locked (`!`), so `su`, `sudo` and `login` let nobody in.
+- **Nothing listens.** No OpenSSH in the image (the step stops if the prefix has one); the two jobs open no socket. An
+  SSH server is an opt-in of the builder's, key only, and not part of this step.
+- **Owners and modes** are checked at the build (`check-root.sh`) and can be checked on the phone (the self-test):
+  the prefix is root's, nothing in it is writable by everybody, the set-ID list is the expected one.
+- **What is fetched** is pinned by SHA-256, from Procursus's own server.
+- A repository added in Sileo is trusted like any apt source: its packages run their scripts as root.
+
+## What the phone showed (13 Nov 2026, phone 1)
+
+- **apt and the system cfprefsd.** Procursus' apt runs its download methods as its sandbox user `_apt` (uid 1001). iOS's
+  own `/etc/passwd` has no such uid, and the system `cfprefsd` crashes (a `CFEqual` on NULL in `-[CFPrefsDaemon
+  handleSourceMessage:...]`) on the first preferences request of a client it cannot name. The method retries, launchd
+  restarts `cfprefsd` every ten seconds, and every root process that reads a preference waits for ever: `apt-get update`
+  stopped at its first file, `uicache` with it, and a minute later SpringBoard (a synchronous call to the pasteboard) and
+  with it the whole interface. The step now writes `APT::Sandbox::User "root";` into the prefix
+  (`etc/apt/apt.conf.d/00scion-sandbox`). With it, no cfprefsd crash in the three boots since.
+- **LaunchServices.** `uicache -p` answers "Unable to register" for every path on this port, `/Applications/*.app`
+  included, and `uicache -l` lists nothing; lsd's own rebuild at boot does register what is in `/Applications`. So the
+  step puts a real copy of `Sileo.app` there (marked `.scion-prefix-app`; `prep.sh` makes it root's and `giveMeRoot`
+  set-user-ID at every boot, for roots edited without owners) and drops the LaunchServices databases so that lsd rebuilds
+  them. An application installed later by a package lands in `/var/jb/Applications` and is not registered: making
+  `uicache` work (probably the entitlements lsd wants of it) is the open item.
+- **Sileo's first start** listed Havoc and Chariz besides Procursus (its own defaults); on the next start only Procursus
+  and the test repository. A flat repository needs a `Release` file for Sileo (apt does without one).
+- The plain bootstrap has no `awk`; the self-test uses `grep` and `cut` instead.
+
+## The self-test
+
+The port has no shell to ask. `SILEO_SELFTEST=1` with the step (a test root, never a release; `check-root.sh` says so)
+adds a third job that runs `tools/ios27/sileo/selftest.sh` once a boot and appends to
+`/private/var/scion-test/selftest.log`: owners and modes, the set-ID list, dpkg's database, Sileo registered, a counter
+and a kept file with one line per boot, the network as it stands. With `SELFTEST_REPO=DIR` (a flat apt repository and a
+`test.conf`) the first boot installs a package from it with `apt-get`, runs it, removes it, installs it again and installs
+an app; later boots want both still there. The log is read back from the root in TWRP.
+
+## Status
+
+See the table in `tools/ios27/sileo/README.md`: what has run on a phone and what has only been checked on an image.
+
+## Credits and licences
+
+The Procursus bootstrap and its packages: the Procursus Team and each package's authors, under each package's licence
+(the bootstrap carries them in `/var/jb/usr/share/doc`). Sileo: the Sileo Team (CoolStar, Amy While and contributors),
+under its own licence (`Licenses.plist` in the app). Neither is in this repository; both are fetched from their own server at build time. Kept data volume,
+re-seeding and `var_sync`: Anan Jaser's work on the 16.5 line, reused here unchanged. The files of this step are MIT-0.
diff --git a/docs/reference/drivers.md b/docs/reference/drivers.md
index 98a04a1c2..a658b9135 100644
--- a/docs/reference/drivers.md
+++ b/docs/reference/drivers.md
@@ -115,6 +115,7 @@ Every driver the kernel can be built with. `CONFIG_HAKIOS_<NAME>=y` in a defconf
 |---|---|---|---|---|---|---|---|---|---|---|
 | **`HAKIOS_QMI`**<br>QMI messages over the IPC router: how the Wi-Fi firmware's service and the modem's are spoken to | `hakios.qmi.c` |  |  |  |  |  |  | built |  |  | |
 | **`HAKIOS_MODEM`**<br>the modem (modem=1): started, its file systems served from the flash, the IPA's data path as en1, the SIM and the network registration. Research; needs fw-modem/ from the phone | `hakios.mpss.c`<br>`hakios.cell.c`<br>`hakios.nas.c`<br>`hakios.ipa.c` | `HAKIOS_QMI`, `HAKIOS_UFS` | `modem=`, `modem_again=`, `modem_apn=`, `modem_buffer=`, `modem_data_nobind=`, `modem_data_off=`, `modem_data_wait=`, `modem_dpm_off=` and 45 more |  |  |  |  | built |  |  | |
+| **`HAKIOS_SHANNON`**<br>the Galaxy S9's own modem, the Shannon CP inside the Exynos 9810 (cp=N): 1 a look at its PMU words, its mailbox and the RADIO partition's table of contents; 2 its image copied from RADIO, read only and as it is, into the CP's memory at 0xF0000000 and checked by the secure world's own call; 3 the CP started, its boot loader's handshake, the ring table, PHONE_START; 4 the link, only with the phone's own NV data (cp_nv=1, a file the image's builder supplies; EFS is never read or written): "low power mode" asked first, the CP's messages logged, the software version asked; 5 with a ready SIM "normal" asked, the registration watched for two minutes, then low power again (written, not yet run: the test SIM read as locked). Its file requests are not answered. Only where the CP's memory is not XNU's (the ios-27 tree; not the 16.5 line's UEFI layout). Off unless asked | `hakios.shannon.c` |  | `cp=`, `cp_apn=`, `cp_delay=`, `cp_ds=`, `cp_nv=`, `cp_ping=`, `cp_rev=`, `cp_sim=` and 2 more |  |  |  |  |  |  |  | |
 
 ## power
 
diff --git a/drivers/core/hakios.stubs.c b/drivers/core/hakios.stubs.c
index 16069871b..50f84497c 100644
--- a/drivers/core/hakios.stubs.c
+++ b/drivers/core/hakios.stubs.c
@@ -139,6 +139,10 @@ const char *hakios_exynos_camera_shot(__unused uint32_t n, __unused int pattern)
 #ifndef HAKIOS_EXYNOS_TEE
 void hakios_exynos_tee_init(void) {}
 #endif
+#ifndef HAKIOS_SHANNON
+void hakios_shannon_init(void);
+void hakios_shannon_init(void) {}
+#endif
 #ifndef HAKIOS_EXYNOS_IRIS
 void hakios_exynos_iris_init(void) {}
 void hakios_exynos_iris_quiesce(void) {}
diff --git a/drivers/input/hakios.input.c b/drivers/input/hakios.input.c
index 32cee423f..076353345 100644
--- a/drivers/input/hakios.input.c
+++ b/drivers/input/hakios.input.c
@@ -321,6 +321,11 @@ hakios_input_init(void)
 	hakios_s2mpb02_torch_init();
 	hakios_exynos_iris_init();
 	hakios_exynos_tee_init();
+	{
+		/* boot-arg cp=N on the Galaxy S9: its own modem (drivers/modem/hakios.shannon.c) */
+		extern void hakios_shannon_init(void);
+		hakios_shannon_init();
+	}
 	hakios_ufs_init();
 	hakios_net_init();
 	hakios_adreno_init();
diff --git a/drivers/map b/drivers/map
index 5c0d8689f..aab0b2377 100644
--- a/drivers/map
+++ b/drivers/map
@@ -88,6 +88,7 @@ modem    bsd/dev/hakios.cell.c
 modem    bsd/dev/hakios.qmi.c
 modem    bsd/dev/hakios.nas.c
 modem    bsd/dev/hakios.ipa.c
+modem    bsd/dev/hakios.shannon.c
 
 net      bsd/dev/hakios.net.c
 virtio   bsd/dev/hakios.virtio_net.c
diff --git a/drivers/modem/conf b/drivers/modem/conf
index 74422704b..99ce377bf 100644
--- a/drivers/modem/conf
+++ b/drivers/modem/conf
@@ -14,3 +14,16 @@ driver MODEM
 	requires QMI UFS
 	help    the modem (modem=1): started, its file systems served from the flash, the IPA's data path as en1,
 	help    the SIM and the network registration. Research; needs fw-modem/ from the phone
+
+driver SHANNON
+	file    bsd/dev/hakios.shannon.c
+	default n
+	help    the Galaxy S9's own modem, the Shannon CP inside the Exynos 9810 (cp=N): 1 a look at its PMU words, its
+	help    mailbox and the RADIO partition's table of contents; 2 its image copied from RADIO, read only and as it is,
+	help    into the CP's memory at 0xF0000000 and checked by the secure world's own call; 3 the CP started, its boot
+	help    loader's handshake, the ring table, PHONE_START; 4 the link, only with the phone's own NV data (cp_nv=1, a
+	help    file the image's builder supplies; EFS is never read or written): "low power mode" asked first, the CP's
+	help    messages logged, the software version asked; 5 with a ready SIM "normal" asked, the registration watched
+	help    for two minutes, then low power again (written, not yet run: the test SIM read as locked). Its file
+	help    requests are not answered. Only where the CP's memory is not XNU's (the ios-27 tree; not the 16.5 line's
+	help    UEFI layout). Off unless asked
diff --git a/drivers/modem/hakios.ext4ro.h b/drivers/modem/hakios.ext4ro.h
new file mode 100644
index 000000000..c4b4f507a
--- /dev/null
+++ b/drivers/modem/hakios.ext4ro.h
@@ -0,0 +1,333 @@
+// SPDX-License-Identifier: MIT-0
+/*
+ * A read-only reader of one file on an ext4 (or ext2/ext3) file system, for drivers that need a file of a partition
+ * the kernel never mounts. First user: the Galaxy S9's modem driver (drivers/modem/hakios.shannon.c, cp_nv=2), which
+ * takes the CP's non-volatile data, /efs/nv_data.bin, from the EFS partition at boot and keeps it in RAM.
+ *
+ * It only ever reads, through the caller's read function, and it has no write path at all: no journal replay, no
+ * superblock update, nothing that would mark the file system as mounted. A file system whose journal would need a
+ * replay is read as it is on the disk (what Linux calls "ro,noload").
+ *
+ * What it understands, from the on-disk format as documented (no code taken from any implementation): the superblock
+ * at byte 1024, 32- and 64-byte group descriptors, inodes of any size, extent trees of any depth (uninitialised extents
+ * read as zeros), the classic direct/indirect block map, and directories read linearly (an htree directory's index
+ * blocks look like empty entries to a linear reader). Not: inline data, encryption. A path is looked up from the root,
+ * one name per component.
+ *
+ * Header-only (static functions), so a driver includes it and a host-side test builds the same code.
+ */
+#ifndef HAKIOS_EXT4RO_H
+#define HAKIOS_EXT4RO_H
+
+/* the caller's reader: len bytes at byte offset off of the partition into dst; 0 or an errno */
+typedef int (*ext4ro_read_fn)(void *ctx, uint64_t off, void *dst, uint32_t len);
+
+struct ext4ro {
+	ext4ro_read_fn read;
+	void *ctx;
+	uint32_t block_size, inode_size, inodes_per_group, desc_size, first_data_block;
+	uint64_t blocks;
+	bool is64;
+	uint8_t *blk;           /* scratch, the caller's: block_size bytes (at most 64 KB) */
+	uint8_t *blk2;          /* a second one (index and indirect blocks) */
+};
+
+#define EXT4RO_MAGIC            0xEF53
+#define EXT4RO_INCOMPAT_64BIT   0x0080
+#define EXT4RO_INCOMPAT_ENCRYPT 0x10000
+#define EXT4RO_INODE_EXTENTS    0x00080000
+#define EXT4RO_INODE_INLINE     0x10000000
+#define EXT4RO_ROOT_INO         2
+#define EXT4RO_MAX_DEPTH        5
+
+static inline uint16_t
+ext4ro_le16(const uint8_t *p)
+{
+	return (uint16_t)(p[0] | p[1] << 8);
+}
+
+static inline uint32_t
+ext4ro_le32(const uint8_t *p)
+{
+	return (uint32_t)p[0] | (uint32_t)p[1] << 8 | (uint32_t)p[2] << 16 | (uint32_t)p[3] << 24;
+}
+
+/* the superblock: 0, or an errno (EINVAL: not ext2/3/4, ENOTSUP: a feature this reader does not have) */
+static int
+ext4ro_open(struct ext4ro *fs)
+{
+	uint8_t sb[1024];
+	uint32_t log, incompat;
+	int e;
+
+	if ((e = fs->read(fs->ctx, 1024, sb, sizeof(sb))) != 0) {
+		return e;
+	}
+	if (ext4ro_le16(sb + 0x38) != EXT4RO_MAGIC) {
+		return EINVAL;
+	}
+	log = ext4ro_le32(sb + 0x18);
+	if (log > 6) {
+		return EINVAL;
+	}
+	fs->block_size = 1024u << log;
+	fs->inodes_per_group = ext4ro_le32(sb + 0x28);
+	fs->first_data_block = ext4ro_le32(sb + 0x14);
+	incompat = ext4ro_le32(sb + 0x60);
+	fs->inode_size = ext4ro_le32(sb + 0x4C) >= 1 ? ext4ro_le16(sb + 0x58) : 128;   /* revision 0: 128 */
+	fs->is64 = (incompat & EXT4RO_INCOMPAT_64BIT) != 0;
+	fs->desc_size = fs->is64 ? ext4ro_le16(sb + 0xFE) : 32;
+	fs->blocks = ext4ro_le32(sb + 0x04) | (fs->is64 ? (uint64_t)ext4ro_le32(sb + 0x150) << 32 : 0);
+	if (fs->inodes_per_group == 0 || fs->inode_size < 128 || fs->inode_size > fs->block_size ||
+	    fs->desc_size < 32 || fs->desc_size > 1024 || (fs->desc_size & (fs->desc_size - 1)) != 0) {
+		return EINVAL;
+	}
+	if (incompat & EXT4RO_INCOMPAT_ENCRYPT) {
+		return ENOTSUP;
+	}
+	return 0;
+}
+
+static int
+ext4ro_read_block(struct ext4ro *fs, uint64_t block, uint8_t *dst)
+{
+	if (block >= fs->blocks) {
+		return EIO;
+	}
+	return fs->read(fs->ctx, block * fs->block_size, dst, fs->block_size);
+}
+
+/* an inode's first 256 bytes (fewer on disk: the rest zero) */
+static int
+ext4ro_inode(struct ext4ro *fs, uint32_t ino, uint8_t inode[256])
+{
+	uint32_t group, index, n = fs->inode_size < 256 ? fs->inode_size : 256;
+	uint64_t desc_off, table;
+	uint8_t desc[64];
+	int e;
+
+	if (ino == 0) {
+		return EINVAL;
+	}
+	group = (ino - 1) / fs->inodes_per_group;
+	index = (ino - 1) % fs->inodes_per_group;
+	desc_off = (uint64_t)(fs->first_data_block + 1) * fs->block_size + (uint64_t)group * fs->desc_size;
+	if ((e = fs->read(fs->ctx, desc_off, desc, fs->desc_size < 64 ? fs->desc_size : 64)) != 0) {
+		return e;
+	}
+	table = ext4ro_le32(desc + 0x08) | (fs->desc_size >= 64 ? (uint64_t)ext4ro_le32(desc + 0x28) << 32 : 0);
+	if (table == 0 || table >= fs->blocks) {
+		return EIO;
+	}
+	bzero(inode, 256);
+	return fs->read(fs->ctx, table * fs->block_size + (uint64_t)index * fs->inode_size, inode, n);
+}
+
+static uint64_t
+ext4ro_size(const uint8_t *inode)
+{
+	return ext4ro_le32(inode + 0x04) | (uint64_t)ext4ro_le32(inode + 0x6C) << 32;
+}
+
+/*
+ * The physical block of logical block lblk of an inode; 0 for a hole or an uninitialised extent (read as zeros).
+ * Extent trees: the 60 bytes of i_block are the root node; index entries are followed down to a leaf.
+ */
+static int
+ext4ro_map(struct ext4ro *fs, const uint8_t *inode, uint32_t lblk, uint64_t *pblk)
+{
+	uint32_t flags = ext4ro_le32(inode + 0x20);
+	const uint8_t *node = inode + 0x28;
+	int e;
+
+	*pblk = 0;
+	if (flags & EXT4RO_INODE_INLINE) {
+		return ENOTSUP;
+	}
+	if (flags & EXT4RO_INODE_EXTENTS) {
+		for (int level = 0; level <= EXT4RO_MAX_DEPTH; level++) {
+			uint16_t entries = ext4ro_le16(node + 2), depth = ext4ro_le16(node + 6);
+			uint32_t room = level == 0 ? 60u : fs->block_size;
+			const uint8_t *best = NULL;
+			uint64_t child;
+			uint8_t *buf;
+
+			if (ext4ro_le16(node) != 0xF30A || 12u + 12u * entries > room) {
+				return EIO;
+			}
+			for (uint16_t i = 0; i < entries; i++) {
+				const uint8_t *x = node + 12 + 12 * i;
+
+				if (ext4ro_le32(x) > lblk) {
+					break;
+				}
+				best = x;
+			}
+			if (best == NULL) {
+				return 0;               /* before the first extent: a hole */
+			}
+			if (depth == 0) {
+				uint32_t len = ext4ro_le16(best + 4), first = ext4ro_le32(best);
+				uint64_t start = ext4ro_le32(best + 8) | (uint64_t)ext4ro_le16(best + 6) << 32;
+				bool uninit = len > 32768;
+
+				if (uninit) {
+					len -= 32768;
+				}
+				if (lblk - first < len && !uninit) {
+					*pblk = start + (lblk - first);
+				}
+				return 0;
+			}
+			child = ext4ro_le32(best + 4) | (uint64_t)ext4ro_le16(best + 8) << 32;
+			buf = (level & 1) ? fs->blk2 : fs->blk;
+			if ((e = ext4ro_read_block(fs, child, buf)) != 0) {
+				return e;
+			}
+			node = buf;
+		}
+		return EIO;
+	}
+	/* the block map: 12 direct blocks, then single, double and triple indirect */
+	uint32_t per = fs->block_size / 4, idx[3] = { 0, 0, 0 };
+	uint64_t b, l = lblk;
+	int levels;
+
+	if (l < 12) {
+		*pblk = ext4ro_le32(inode + 0x28 + 4 * l);
+		return 0;
+	}
+	l -= 12;
+	if (l < per) {
+		levels = 1;
+		idx[0] = (uint32_t)l;
+		b = ext4ro_le32(inode + 0x28 + 4 * 12);
+	} else if ((l -= per) < (uint64_t)per * per) {
+		levels = 2;
+		idx[0] = (uint32_t)(l / per);
+		idx[1] = (uint32_t)(l % per);
+		b = ext4ro_le32(inode + 0x28 + 4 * 13);
+	} else {
+		l -= (uint64_t)per * per;
+		levels = 3;
+		idx[0] = (uint32_t)(l / per / per);
+		idx[1] = (uint32_t)((l / per) % per);
+		idx[2] = (uint32_t)(l % per);
+		b = ext4ro_le32(inode + 0x28 + 4 * 14);
+	}
+	for (int i = 0; i < levels && b != 0; i++) {
+		if ((e = ext4ro_read_block(fs, b, fs->blk2)) != 0) {
+			return e;
+		}
+		b = ext4ro_le32(fs->blk2 + 4 * idx[i]);
+	}
+	*pblk = b;
+	return 0;
+}
+
+/* the inode number of name in the directory dir_ino */
+static int
+ext4ro_lookup(struct ext4ro *fs, uint32_t dir_ino, const char *name, size_t name_len, uint32_t *ino)
+{
+	uint8_t inode[256];
+	uint64_t size;
+	int e;
+
+	*ino = 0;
+	if ((e = ext4ro_inode(fs, dir_ino, inode)) != 0) {
+		return e;
+	}
+	if ((ext4ro_le16(inode) & 0xF000) != 0x4000) {
+		return ENOTDIR;
+	}
+	size = ext4ro_size(inode);
+	for (uint32_t lblk = 0; (uint64_t)lblk * fs->block_size < size; lblk++) {
+		uint64_t pblk;
+
+		if ((e = ext4ro_map(fs, inode, lblk, &pblk)) != 0) {
+			return e;
+		}
+		if (pblk == 0) {
+			continue;
+		}
+		if ((e = ext4ro_read_block(fs, pblk, fs->blk)) != 0) {
+			return e;
+		}
+		for (uint32_t off = 0; off + 8 <= fs->block_size;) {
+			const uint8_t *d = fs->blk + off;
+			uint32_t entry = ext4ro_le32(d);
+			uint16_t rec = ext4ro_le16(d + 4);
+			uint8_t nl = d[6];
+
+			if (rec < 8 || off + rec > fs->block_size) {
+				break;
+			}
+			if (entry != 0 && nl == name_len && 8u + nl <= rec && memcmp(d + 8, name, name_len) == 0) {
+				*ino = entry;
+				return 0;
+			}
+			off += rec;
+		}
+	}
+	return ENOENT;
+}
+
+/*
+ * The regular file at path (e.g. "/nv_data.bin") into dst, at most cap bytes; *size gets its size. ENOSPC when it is
+ * bigger than cap (nothing read then). fs->blk and fs->blk2 must point at the caller's scratch blocks.
+ */
+static int
+ext4ro_read_file(struct ext4ro *fs, const char *path, uint8_t *dst, uint64_t cap, uint64_t *size)
+{
+	uint32_t ino = EXT4RO_ROOT_INO;
+	uint8_t inode[256];
+	const char *p = path;
+	int e;
+
+	*size = 0;
+	while (*p) {
+		const char *q;
+
+		while (*p == '/') {
+			p++;
+		}
+		if (!*p) {
+			break;
+		}
+		for (q = p; *q && *q != '/'; q++) {
+		}
+		if ((e = ext4ro_lookup(fs, ino, p, (size_t)(q - p), &ino)) != 0) {
+			return e;
+		}
+		p = q;
+	}
+	if ((e = ext4ro_inode(fs, ino, inode)) != 0) {
+		return e;
+	}
+	if ((ext4ro_le16(inode) & 0xF000) != 0x8000) {
+		return EISDIR;
+	}
+	*size = ext4ro_size(inode);
+	if (*size > cap) {
+		return ENOSPC;
+	}
+	for (uint64_t done = 0; done < *size;) {
+		uint64_t pblk;
+		uint32_t n = (uint32_t)((*size - done) < fs->block_size ? (*size - done) : fs->block_size);
+
+		if ((e = ext4ro_map(fs, inode, (uint32_t)(done / fs->block_size), &pblk)) != 0) {
+			return e;
+		}
+		if (pblk == 0) {
+			bzero(dst + done, n);
+		} else if ((e = ext4ro_read_block(fs, pblk, fs->blk)) != 0) {
+			return e;
+		} else {
+			memcpy(dst + done, fs->blk, n);
+		}
+		done += n;
+	}
+	return 0;
+}
+
+#endif /* HAKIOS_EXT4RO_H */
diff --git a/drivers/modem/hakios.shannon.c b/drivers/modem/hakios.shannon.c
new file mode 100644
index 000000000..5b133e0d2
--- /dev/null
+++ b/drivers/modem/hakios.shannon.c
@@ -0,0 +1,2784 @@
+// SPDX-License-Identifier: MIT-0
+/*
+ * The cellular modem of the Galaxy S9 (starlte, SM-G960F): the Samsung "Shannon" CP that is part of the Exynos 9810
+ * itself (Samsung's driver calls it ss360ap). Only with boot-arg cp=N on this phone; with cp absent or 0 nothing
+ * below runs: no register is read, no memory mapped, no call made to the secure world.
+ *
+ * WHAT THE CP IS, AS THE AP SEES IT (the phone's device tree and Samsung's kernel, read as data)
+ *   its memory     146 MB of the phone's DRAM at 0xF0000000 (the device tree's reserved "modem_if"), outside XNU's
+ *                  RAM. The CP sees it at 0x40000000. The image's own table (below) divides it:
+ *                    0x0000000  the CP's code and data, 121 MB (BOOT at 0, MAIN at 0x10000, NV at 0x4900000)
+ *                    0x7900000  VSS, the voice processor's, 7 MB
+ *                    0x8000000  IPC, 5 MB: the memory both sides talk through
+ *                    0x8500000  ZMC, 11 MB: downlink packets' buffers (not used here)
+ *                    0x9000000  VPA, 2 MB
+ *   its image      the phone's RADIO partition, read only, used exactly as it is. It starts with a table of
+ *                  contents of 32-byte entries (name[12], offset in the partition, address for the CP, size, CRC-32,
+ *                  number): TOC, BOOT, MAIN, VSS, NV, OFFSET. An entry goes to (its address - BOOT's address) in the
+ *                  CP's memory. NV has no bytes in RADIO: it is the place of the phone's own non-volatile data
+ *                  (Android's boot daemon copies /efs/nv_data.bin there). This driver never writes the EFS partition
+ *                  and never mounts it. With cp_nv=2 (the owner's decision of 13 Nov 2026) it READS /nv_data.bin out
+ *                  of EFS at boot through a read-only ext4 reader (hakios.ext4ro.h over hakios_ufs_read_partition,
+ *                  which has no write path), keeps it in RAM for the run and gives it to the CP; only its size and a
+ *                  CRC prefix are logged. With cp_nv=1 it takes a file "nv_data.bin" that the boot image's builder
+ *                  put beside the kernel (hakios_image_file("fw", ...)); without either the place is filled with zeros.
+ *   the secure     the image is checked and the CP's memory closed by Samsung's EL3 monitor, not by us:
+ *   world          SMC 0x82000700 with x1 = the mode (2: open the memory for loading; 0, or'ed with the memory's
+ *                  address when the image carries its memory table: check BOOT and MAIN and lock), x2 = BOOT's size,
+ *                  x3 = MAIN's size, each between SMC 0x82001011 x1 = 0 and x1 = 1 (the hash engine's clock on and
+ *                  off). Its answer is 0 or one of Samsung's error numbers (smc_error below). If it refuses, this
+ *                  driver stops: nothing is patched, skipped or retried another way.
+ *   the PMU        0x14060000. CP_CTRL_NS (0x30) and CP_CTRL_S (0x34) belong to the secure world and are read and
+ *                  written through the same SMC (x1 = 3 read, with x2 = 0 or 1 for the low and high half, x3 = 0 for
+ *                  _S and 1 for _NS; x1 = 4 write, x2 = the value). CP_STAT 0x38, CENTRAL_SEQ_CP_CONFIGURATION 0x280
+ *                  and _STATUS 0x284 (bits 23:16: 0x80 while the CP is held in reset), RESET_SEQUENCER_STATUS 0x504
+ *                  (bits 2:0: 0 before the CP has ever been powered, 5 when it has), the CP's power-down
+ *                  configuration 0x1320-0x1338, CLEANY_BUS_CP 0x3920/0x3924.
+ *   AP2CP_CFG      0x14820000 bit 0: EL3 prepares the CP's view of the memory at cold boot; writing 1 here lets the
+ *                  CP's processor run.
+ *   the mailbox    0x14170000. INTGR1 (0x1C) bit n raises interrupt n at the CP; INTSR0 (0x14) bits 31:16 are the
+ *                  CP's interrupts to the AP, cleared through INTCR0 (0x0C) and masked by INTMR0 (0x10); 64 shared
+ *                  words ISSRn at 0x80 + 4n. This phone's use: word 0 the AP's message, word 1 the CP's, word 2 the
+ *                  AP's state (bit 0 wake lock, 4:1 state, 5 "PDA active", 13:6 the board's revision, 15:14 dual
+ *                  SIM), word 3 the CP's state (4:1 state, 5 "LTE active"). Interrupt 0 each way says "word 0/1 has
+ *                  a message"; the AP's 1 is "wake up". Read by polling here (the interrupts stay masked).
+ *   a message      bit 7 valid; with bit 6 a command in bits 5:0 (1 INIT_START, 2 INIT_END, 8 PHONE_START,
+ *                  0xD PIF_INIT_DONE, 7 CRASH_RESET, 9 CRASH_EXIT); without it bit 0 "there is data in the rings".
+ *   the IPC        its first words are a magic number and an "access" word, then the old two queues' pointers; the
+ *   memory         boot loader of the CP talks through the old "raw" queue (to the CP at 12288, 2084864 bytes;
+ *                  from it at 2097152, 2097152 bytes; head and tail words at 24/28 and 32/36) with the magic "BOOT"
+ *                  (0x424F4F54). The running CP talks through rings of buffers (Samsung's "SBD"): at 2048 a table
+ *                  the AP writes (version, channels, per channel and direction the ring's length, buffer size and
+ *                  where its arrays of offsets and sizes are), the rings' read and write counters after it, the
+ *                  buffers from 64 KB up; magic 0xAA and access 1 once the link is up.
+ *   a frame        Samsung's SIPC5: a byte 0xF8 (bit 2: padded), the channel, the length (16 bits, header included),
+ *                  then the message. Channels: 215 the boot loader, 235 the phone's control messages ("FMT"),
+ *                  245 the CP's file requests to the AP ("RFS").
+ *
+ * THE STAGES (cp=N)
+ *   1  a look, nothing changed: the PMU's and the mailbox's registers, the two secure words (the SMC's read),
+ *      the first words of the CP's memory as the boot loader left it, RADIO's table of contents.
+ *   2  that, and the image loaded and checked: the CP's power domain started if it never was (CP_CTRL_NS bit 1,
+ *      CP_CTRL_S bit 3), the memory opened (mode 2), BOOT, MAIN and VSS copied from RADIO and compared with the
+ *      table's CRCs, the NV place filled (zeros, or the builder's file with cp_nv=1), then the secure world's
+ *      check (mode 0). Its answer is logged. The CP is not started.
+ *   3  that, and the CP started: the mailbox cleared, the AP's state word set, AP2CP_CFG written, the CP's state
+ *      waited for, the boot loader's two questions (0x900D, answer 0xA00D; 0x9F00, answer 0xAF00), then the
+ *      running CP's INIT_START, the ring table written, PIF_INIT_DONE, and its PHONE_START: "THE CP IS UP".
+ *      It is watched for cp_wait seconds (20) and then put back in reset.
+ *   4  that, and the link, ONLY with the phone's own NV data loaded (cp_nv=1): the one command this driver ever
+ *      sends that changes anything, "phone state: low power mode" (Samsung IPC's power group 0x01, number 0x07,
+ *      "execute", the two bytes 01 00: what Android sends for airplane mode), is put in the ring first, then
+ *      INIT_END is said (and said again on every PHONE_START until the CP stops repeating it: it looks at the one
+ *      message word about every 100 ms, and anything written there sooner replaces INIT_END). The running
+ *      CP otherwise goes to its NORMAL state by itself, receiver on, looking for a network (seen on 12 Nov 2026 with
+ *      zeros for NV; never again: with zeros or without cp_nv=1 this stage is refused and the run stays at stage
+ *      3). The CP is stopped at once if its next "phone state" is not low power, if none comes in 5 s, or if a
+ *      registration state other than "none" is ever reported. Everything the CP sends is logged (the channel, the
+ *      message's group, number and type, its length; the phone state, the SIM status bytes, the registration state;
+ *      a file request's kind, name, offset and length), one harmless question is asked (the modem's software
+ *      version) and its answer logged. The CP's file requests are NOT answered and nothing it wants stored is
+ *      kept. After cp_wait seconds (25) the CP is put back in reset.
+ *
+ *   5  that, and, ONLY when the phone's owner has asked for it, the radio: with the CP confirmed in low power mode
+ *      and the SIM's status "ready" (0x82 or 0x83; a locked SIM ends the run, no PIN is ever sent), "phone state:
+ *      normal" is asked for (the bytes 02 02: what Android sends when airplane mode is switched off). The phone
+ *      then registers on its network as it does under Android. Logged: the phone state, every registration state,
+ *      the serving network's operator code, the signal words. Two minutes after it has registered (or 90 s after
+ *      the request if it has not) low power mode is asked for again, confirmed, and the CP put back in reset.
+ *      No call, message, network or band selection is ever asked for; a data session only in stage 6.
+ *
+ *   6  that, and, ONLY with an access point name given by the builder (cp_apn=NAME: the operator's published default
+ *      one; none is built in), a data context: 5 s after the phone has registered the context is defined (Samsung
+ *      IPC's packet group 0x0D, number 1, "set": enable, context 1, type 2, the name) and, if the CP's general
+ *      response accepts that, activated (number 4, "set": enable, context 1, no user name or password). These are
+ *      the layouts of the public numbering for older Samsung modems, NOT confirmed for this one: the CP's answer
+ *      to each is the result of the stage, and a refusal ends it (no second form is tried). Logged: each result
+ *      word, the packet group's notifications (the call status' bytes; of the address configuration its length,
+ *      context and the first octet only), and how many packets the CP put on the data channels (their length and
+ *      IP version; nothing is sent on them and none is passed on). 20 s later the context is deactivated, then
+ *      low power mode, then reset, as in stage 5.
+ *
+ *   7  that, and three packets of our own through the context, made and checked in this file (no interface is
+ *      made, nothing of the system's is carried): with the context's IPv4 address and first DNS server taken from
+ *      the CP's address configuration (kept in memory for the run, never logged beyond one octet), one ICMP echo
+ *      request (to cp_ping=A.B.C.D, or to that DNS server) and one DNS question for the A record of example.com go
+ *      up, and whatever comes down is checked (lengths, header and data checksums, addresses, the echo's and the
+ *      question's identifiers) and counted: answered, not ours, IPv6, malformed. The rings, as Samsung's kernel
+ *      uses them on this phone (read as facts): a data packet has no frame header, its channel (10: context 1) is
+ *      in the upper half of its ring slot's size word; up through the "data" ring; down either through the "high
+ *      priority" ring or, for the "data" ring, into buffers of the 11 MB "ZMC" region behind the IPC memory: the
+ *      AP writes each slot's 64-bit data offset (from the IPC memory's start) and moves the ring's read counter
+ *      as its offer, the CP fills a buffer, sets the slot's size word and moves the write counter. Here slot k
+ *      always has the same 4 KB cell k, the offsets are never read back for use, the CP's counter is checked
+ *      against the ring's length and against what was offered, a length over 2048 is a malformed packet, and a
+ *      packet is copied out before it is looked at.
+ *
+ * NEVER DONE HERE: no partition is written; EFS is not read; no request that sets an identity, a band, a power or
+ * a calibration value, no test or factory mode, no PIN; the radio is on only in stage 5. An answer that could carry
+ * an identity is logged as its length only.
+ *
+ * kern.hakios.cp.state reads where it got to (the stage reached, 100 + a stage that failed, 200 stopped);
+ * kern.hakios.cp.go: 1 the state printed, 2 the CP stopped (reset asserted), 3 the version asked again.
+ *
+ * THE ARGUMENTS
+ *   cp=N         the first N of the Galaxy S9's modem's six stages (1 a look, 2 its image loaded and checked, 3 started, 4 the link, 5 the network, 6 a data context, 7 three packets through it); 0 or none: left alone
+ *   cp_sim=1     in low power mode, once the SIM is ready, one read of its administrative data file (EF_AD, 4 bytes: no identity) is asked, to see if the modem takes the public numbering's SIM read (seen twice on an SM-G960F: refused, result 0x8001)
+ *   cp_ping=A.B.C.D  the address stage 7 sends its one echo request to (none: the context's first DNS server)
+ *   cp_apn=NAME  the access point name stage 6 asks the data context for (the operator's published default; none: no stage 6)
+ *   cp_nv=1      the phone's own NV data, a file nv_data.bin the image's builder put beside the kernel, is given to the modem (none: zeros, and no stage 4)
+ *   cp_if=1      with cp=6 or 7 and cp_apn: the active data context becomes a network interface, pdp_ip0 (IPv4, point to point, the CP's address for it), and stays up: no deactivation, no return to low power, no two-minute limit; the modem runs until kern.hakios.cp.go=2. Off: the stages end as before
+ *   cp_if_kb=N   with cp_if=1: at most N KB through pdp_ip0 in a boot, both ways (2048 by default; the owner's mobile plan), then it drops
+ *   cp_route=1   with cp_if=1: an IPv4 default route through pdp_ip0 (only when there is none yet: Wi-Fi's wins)
+ *   cp_nv=2      the phone's own NV data read at boot from the EFS partition (/nv_data.bin, read-only, never mounted, never written), kept in RAM only; the CP's file requests for it (RFS NV read/write) are answered from that copy and its writes kept there for the run, never written back
+ *   cp_vss=0     the image's VSS part (the voice processor's) is not copied
+ *   cp_rev=N     the board's revision told to the modem (26, this phone's)
+ *   cp_ds=N      the dual SIM field told to the modem (0)
+ *   cp_wait=N    seconds the started modem is watched before it is put back in reset (20; 25 with the link)
+ *   cp_delay=N   seconds after the boot before the modem's driver does anything (30), so that its lines are in the log
+ *
+ * WHERE IT MAY RUN. The CP's memory is fixed by the boot chain at 0xF0000000. On a tree whose loader puts XNU itself
+ * there (the 16.5 line's UEFI does: devices/starlte/docs/modem-plan.md, 1.5) this driver must not load anything: it
+ * checks that no page of the 146 MB is XNU's and that the kernel is not in it, and does nothing if either fails.
+ */
+#include <kern/clock.h>
+#include <kern/kalloc.h>
+#include <kern/thread.h>
+#include <libkern/libkern.h>
+#include <mach/mach_time.h>
+#include <mach/mach_types.h>
+#include <mach/vm_param.h>
+#include <pexpert/pexpert.h>
+#include <sys/errno.h>
+#include <sys/param.h>
+#include <sys/hakios.input.h>
+#include <sys/hakios.log.h>
+#include <sys/hakios.physmap.h>
+#include <sys/sysctl.h>
+#include <sys/systm.h>
+#include <sys/hakios.xnu.h>
+#include <sys/hakios.ext4ro.h>
+#include <net/kpi_interface.h>
+#include <net/kpi_protocol.h>
+#include <net/if_types.h>
+#include <net/route.h>
+#include <net/if_dl.h>
+#include <netinet/in.h>
+#include <netinet/in_var.h>
+#include <sys/kpi_mbuf.h>
+#include <sys/kpi_socket.h>
+#include <sys/sockio.h>
+#include <sys/socket.h>
+
+/* ---- addresses ---- */
+
+#define CP_MEM_PA               0xF0000000ULL   /* the device tree's "modem_if" */
+#define CP_MEM_BYTES            0x09200000ULL
+#define CP_IPC_OFFSET           0x08000000u     /* the device tree's; the image's table is checked against it */
+#define CP_IPC_BYTES            0x00500000u
+#define CP_PMU_PA               0x14060000UL
+#define CP_PMU_BYTES            0x4000
+#define CP_MBOX_PA              0x14170000UL
+#define CP_CFG_PA               0x14820000UL    /* AP2CP_CFG */
+#define CP_GICD_PA              0x10100000UL    /* the interrupt controller: one "pending" word read, nothing else */
+
+#define PMU_CP_CTRL_NS          0x0030          /* through the SMC */
+#define PMU_CP_CTRL_S           0x0034          /* through the SMC */
+#define PMU_CP_STAT             0x0038
+#define PMU_CENTRAL_SEQ_CP_CFG  0x0280
+#define PMU_CENTRAL_SEQ_CP_STAT 0x0284
+#define PMU_RESET_SEQ_STAT      0x0504
+#define PMU_CP_PWR_FIRST        0x1320          /* RESET_AHEAD, CLEANY_BUS, LOGIC_RESET, TCXO_GATE, DISABLE_ISO, RESET_ISO, DUMP_PC */
+#define PMU_CLEANY_BUS_CP_CFG   0x3920
+#define PMU_CLEANY_BUS_CP_STAT  0x3924
+
+#define NS_PWRON                (1u << 1)
+#define NS_RESET_SET            (1u << 2)
+#define NS_DUMP_PC_NO_PG        (1u << 17)
+#define S_START                 (1u << 3)
+
+#define MBOX_MCUCTLR            0x00
+#define MBOX_INTGR0             0x08
+#define MBOX_INTCR0             0x0c
+#define MBOX_INTMR0             0x10
+#define MBOX_INTSR0             0x14
+#define MBOX_INTMSR0            0x18
+#define MBOX_INTGR1             0x1c
+#define MBOX_INTCR1             0x20
+#define MBOX_INTMR1             0x24
+#define MBOX_INTSR1             0x28
+#define MBOX_ISSR(n)            (0x80 + 4 * (n))
+#define MBOX_WORDS              64
+
+/* this phone's use of the mailbox (the device tree's mif_pdata) */
+#define WORD_AP_MSG             0
+#define WORD_CP_MSG             1
+#define WORD_AP_STATE           2
+#define WORD_CP_STATE           3
+#define INT_AP_MSG              0
+#define INT_AP_WAKEUP           1
+#define IRQ_CP_MSG              0
+#define AP_STATE_STATUS(v)      (((v) & 0xfu) << 1)
+#define AP_STATE_PDA_ACTIVE     (1u << 5)
+#define AP_STATE_REV(v)         (((v) & 0xffu) << 6)
+#define AP_STATE_DS(v)          (((v) & 0x3u) << 14)
+#define CP_STATE_STATUS(w)      (((w) >> 1) & 0xfu)
+#define CP_STATE_ACTIVE(w)      (((w) >> 5) & 1u)
+
+#define MSG_VALID               0x80
+#define MSG_CMD                 0x40
+#define MSG_DATA                0x01
+#define CMD_INIT_START          0x01
+#define CMD_INIT_END            0x02
+#define CMD_CRASH_RESET         0x07
+#define CMD_PHONE_START         0x08
+#define CMD_CRASH_EXIT          0x09
+#define CMD_PIF_INIT_DONE       0x0d
+
+#define SMC_CP                  0x82000700u
+#define SMC_CP_READ             3
+#define SMC_CP_WRITE            4
+#define SMC_CP_REG_S            0
+#define SMC_CP_REG_NS           1
+#define SMC_SSS_CLK             0x82001011u
+
+/* the IPC memory */
+#define IPC_MAGIC               0
+#define IPC_ACCESS              4
+#define IPC_RAW_TX_HEAD         24
+#define IPC_RAW_TX_TAIL         28
+#define IPC_RAW_RX_HEAD         32
+#define IPC_RAW_RX_TAIL         36
+#define IPC_RAW_TX_BUF          12288u
+#define IPC_RAW_TX_BYTES        2084864u
+#define IPC_RAW_RX_BUF          2097152u
+#define IPC_RAW_RX_BYTES        2097152u
+#define MAGIC_BOOT              0x424F4F54u
+#define MAGIC_IPC               0xAAu
+
+#define SBD_DESC                2048u           /* the table, in the first 64 KB */
+#define SBD_BUFFERS             65536u
+#define SBD_MAX_CHANNELS        32
+#define SBD_RB_CH               12u             /* u32 version, channels, counters' offset; then rb_ch[32] of 16 bytes */
+#define SBD_RB_DESC             (SBD_RB_CH + SBD_MAX_CHANNELS * 16u)   /* rb_desc[32][2] of 20 bytes */
+#define SBD_GLOBAL_BYTES        (SBD_RB_DESC + SBD_MAX_CHANNELS * 2u * 20u)
+
+#define CH_BOOT                 215
+#define CH_FMT                  235
+#define CH_RFS                  245
+#define DATA_CID                1               /* the one data context this driver ever defines */
+
+/* the channels of this phone's device tree that get a ring, in its order (the ones for other regions left out) */
+static const struct ring_cfg {
+	uint16_t ch;
+	uint16_t ul_len, ul_size, dl_len, dl_size;
+	const char *name;
+} ring_cfgs[] = {
+	{ 35, 16, 2048, 16, 2048, "cass" },
+	{ CH_FMT, 16, 4096, 32, 4096, "ipc0" },
+	{ 236, 16, 4096, 32, 4096, "ipc1" },
+	{ CH_RFS, 16, 2048, 512, 2048, "rfs0" },
+	{ 1, 32, 2048, 64, 2048, "csd" },
+	{ 25, 16, 2048, 16, 2048, "router" },
+	{ 28, 16, 2048, 128, 2048, "dm0" },
+	{ 10, 256, 2048, 256, 2048, "data, high priority" },
+	{ 11, 512, 2048, 2048, 8, "data" },     /* its downlink ring holds addresses of ZMC buffers: none given here */
+};
+#define NRINGS                  (sizeof(ring_cfgs) / sizeof(ring_cfgs[0]))
+
+struct ring {
+	uint16_t len, size;
+	uint32_t addr_v, size_v;        /* offsets of the arrays in the IPC memory */
+	uint32_t buffers;               /* offset of the first buffer */
+	uint32_t rp, wp;                /* offsets of the 16-bit counters */
+};
+
+struct toc_entry {
+	char name[12];
+	uint32_t offset, address, size, crc, number;
+};
+
+static struct {
+	uint32_t stage;                 /* cp=N */
+	volatile uint32_t state;
+	vm_offset_t pmu, mbox, cfg, gicd, mem;
+	uint8_t *ipc;
+	struct toc_entry toc[16];
+	uint32_t ntoc;
+	const struct toc_entry *boot, *main, *vss, *nv;
+	bool mem_table;                 /* the image carries its memory table: the check gets the memory's address */
+	bool started, up, link;
+	bool nv_loaded;                 /* the phone's own NV data is in the CP's memory (not zeros) */
+	bool stop;                      /* something seen that this driver stops the CP for */
+	bool link_acked;                /* the CP has taken INIT_END: it no longer repeats PHONE_START */
+	bool version_answered, bands_asked;
+	/* stage 5 */
+	int sim_status;                 /* the SIM's last status byte, -1 none yet */
+	int reg_state;                  /* the last registration state reported, -1 none yet */
+	bool normal_asked, back_asked;  /* "normal" was asked for; then "low power" again */
+	uint64_t normal_ms, registered_ms, back_ms, sim_ms;
+	uint32_t reg_changes, signals, writes_dropped;
+	uint32_t sim_probe;             /* cp_sim=1 */
+	bool sim_asked;
+	/* stage 6 */
+	char apn[64];                   /* cp_apn: letters, digits, '.' and '-' only */
+	uint32_t data_step;             /* 0 not begun, 1 defined (asked), 2 activation asked, 3 active (watched), 4 deactivation asked, 5 over */
+	uint64_t data_ms;
+	int data_result;                /* the general response's result word to the request waited for, -1 none yet */
+	uint8_t data_seq;               /* that request's sequence */
+	uint32_t data_notes, data_configs, data_packets, data_bytes;
+	/* stage 7: the context's addresses are here for the run only and are never logged */
+	uint8_t ip4[4], dns4[4], ping4[4];
+	bool have4, ping_given;
+	uint16_t zc_alloc, zc_pre;      /* the zero-copy ring: the next slot to offer, the next to take: ours, never read back */
+	uint16_t dns_port, dns_id;
+	uint64_t ping_sent_ms, ping_ms, dns_sent_ms, dns_ms;
+	uint32_t data_up, data_up_bytes, data_bad, data_v6, data_other, dns_rcode, dns_answers;
+	uint64_t init_end_ms, phone_start_ms;
+	uint64_t lpm_sent_ms;           /* when "low power mode" was asked */
+	int phone_state;                /* the CP's last "phone state" notification: 1 low power, 2 normal; -1 none yet */
+	struct ring ul[NRINGS], dl[NRINGS];
+	uint8_t mseq;
+	uint32_t frames[NRINGS], rfs_requests, fmt_messages, phone_starts;
+	uint32_t rev, ds, wait_s, delay_s, nv_file, vss_on;
+	uint32_t more[NRINGS];          /* bytes still to come of a frame longer than one buffer */
+	bool multi[NRINGS];             /* the frames now coming on a ring are the rest of a message already seen */
+	uint32_t rfs_more;              /* bytes of a file request still to come in later frames */
+	/* cp_nv=2: the NV data in RAM (kernel memory only; never written anywhere) and an NV write being received */
+	uint8_t *nv_ram;
+	uint32_t nv_ram_size;
+	bool w_active;
+	uint8_t w_id;
+	uint32_t w_off, w_len, w_got;
+	uint32_t rfs_answered, nv_writes_kept, nv_reads_answered;
+	uint32_t if_on, route_on;       /* cp_if=1, cp_route=1 */
+	uint32_t if_kb;                 /* cp_if_kb=N */
+	uint32_t dropped[NRINGS];       /* such frames dropped */
+} cp;
+
+static int cp_go;
+static int cp_state_out;
+
+SYSCTL_DECL(_kern_hakios);
+SYSCTL_NODE(_kern_hakios, OID_AUTO, cp, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "the Galaxy S9's cellular modem (hakios.shannon.c, cp=N)");
+SYSCTL_INT(_kern_hakios_cp, OID_AUTO, state, CTLFLAG_RD | CTLFLAG_KERN | CTLFLAG_LOCKED, &cp_state_out, 0, "the stage reached (1 looked, 2 loaded and checked, 3 the CP up, 4 the link up), 100 + the stage that failed, 200 stopped");
+SYSCTL_INT(_kern_hakios_cp, OID_AUTO, go, CTLFLAG_RW | CTLFLAG_KERN | CTLFLAG_LOCKED, &cp_go, 0, "set: 1 the state printed, 2 the CP stopped, 3 the version asked");
+
+/* ---- small things ---- */
+
+static inline uint32_t
+rd(vm_offset_t base, uint32_t off)
+{
+	return *(volatile uint32_t *)(base + off);
+}
+
+static inline void
+wr(vm_offset_t base, uint32_t off, uint32_t v)
+{
+	*(volatile uint32_t *)(base + off) = v;
+}
+
+static inline uint32_t
+ipc_rd32(uint32_t off)
+{
+	return *(volatile uint32_t *)(void *)(cp.ipc + off);
+}
+
+static inline void
+ipc_wr32(uint32_t off, uint32_t v)
+{
+	*(volatile uint32_t *)(void *)(cp.ipc + off) = v;
+}
+
+static inline uint16_t
+ipc_rd16(uint32_t off)
+{
+	return *(volatile uint16_t *)(void *)(cp.ipc + off);
+}
+
+static inline void
+ipc_wr16(uint32_t off, uint16_t v)
+{
+	*(volatile uint16_t *)(void *)(cp.ipc + off) = v;
+}
+
+static void
+set_state(uint32_t s)
+{
+	cp.state = s;
+	cp_state_out = (int)s;
+}
+
+static uint64_t
+now_ms(void)
+{
+	uint64_t ns;
+
+	absolutetime_to_nanoseconds(mach_absolute_time(), &ns);
+	return ns / NSEC_PER_MSEC;
+}
+
+static uint64_t
+smc(uint64_t fid, uint64_t a1, uint64_t a2, uint64_t a3)
+{
+	register uint64_t x0 __asm__("x0") = fid;
+	register uint64_t x1 __asm__("x1") = a1;
+	register uint64_t x2 __asm__("x2") = a2;
+	register uint64_t x3 __asm__("x3") = a3;
+
+	__asm__ volatile ("smc #0" : "+r" (x0), "+r" (x1), "+r" (x2), "+r" (x3) : :
+	    "x4", "x5", "x6", "x7", "x8", "x9", "x10", "x11", "x12", "x13", "x14", "x15", "x16", "x17", "memory");
+	return x0;
+}
+
+static const char *
+smc_error(uint32_t e)
+{
+	static const char *const names[] = {
+		"no error", "not aligned to 64 KB", "memory too big", "flag out of range", "wrong TZASC region number",
+		"wrong boot loader size", "memory out of range", "not aligned to 16 bytes", "memory in secure DRAM",
+		"ASP enable failed", "ASP disable failed", "CP not working", "CP already working", "CP already in dump mode",
+		"not a valid magic", "CP should be disabled", "CP memory already enabled", "window already set",
+		"failed to set the window", "invalid CP base", "corrupted CP memory information",
+	};
+
+	return e < sizeof(names) / sizeof(names[0]) ? names[e] : "not one of the listed errors";
+}
+
+/* one of the two secure words: false if the secure world would not say */
+static bool
+secure_read(uint32_t which, uint32_t *value)
+{
+	uint32_t lo = (uint32_t)smc(SMC_CP, SMC_CP_READ, 0, which);
+	uint32_t hi;
+
+	if (lo & 0xffff) {
+		say("cp: the secure world would not read CP_CTRL_%s (low half): %#x\n", which == SMC_CP_REG_S ? "S" : "NS", lo);
+		return false;
+	}
+	hi = (uint32_t)smc(SMC_CP, SMC_CP_READ, 1, which);
+	if (hi & 0xffff) {
+		say("cp: the secure world would not read CP_CTRL_%s (high half): %#x\n", which == SMC_CP_REG_S ? "S" : "NS", hi);
+		return false;
+	}
+	*value = (hi & 0xffff0000u) | (lo >> 16);
+	return true;
+}
+
+/* bits set or cleared in one of the two secure words, as Samsung's PMU sequences do it: read, change, write, read */
+static bool
+secure_update(uint32_t which, uint32_t clear, uint32_t set, const char *why)
+{
+	uint32_t before, after = 0;
+	uint32_t answer;
+
+	if (!secure_read(which, &before)) {
+		return false;
+	}
+	answer = (uint32_t)smc(SMC_CP, SMC_CP_WRITE, (before & ~clear) | set, which);
+	(void)secure_read(which, &after);
+	say("cp: CP_CTRL_%s %#x -> %#x (%s), the secure world answered %#x\n", which == SMC_CP_REG_S ? "S" : "NS", before,
+	    after, why, answer);
+	return answer == 0;
+}
+
+static bool
+pmu_wait(uint32_t off, uint32_t mask, uint32_t want, uint32_t ms, const char *name)
+{
+	uint64_t until = now_ms() + ms;
+	uint32_t v;
+
+	do {
+		v = rd(cp.pmu, off);
+		if ((v & mask) == want) {
+			return true;
+		}
+		delay(100);
+	} while (now_ms() < until);
+	say("cp: %s stayed %#x (wanted %#x under %#x) for %u ms\n", name, v, want, mask, ms);
+	return false;
+}
+
+/* the CP's own interrupt to the AP's interrupt controller, as Samsung's sequences wait for it: only looked at */
+static bool
+cp_irq_pending(void)
+{
+	return cp.gicd != 0 && (rd(cp.gicd, 0x238) & (1u << 28)) != 0;       /* GICD_ISPENDR14 (0x1238), bit 28 */
+}
+
+static void
+mbox_raise(uint32_t n)
+{
+	wr(cp.mbox, MBOX_INTGR1, 1u << n);
+}
+
+static void
+send_msg(uint16_t value)
+{
+	/* one word carries every message: the last one must have been taken (its interrupt no longer pending at the CP)
+	 * before the next is written over it. Seen: a "data" message written 1 ms after INIT_END replaced it, and the CP
+	 * never knew the link was up. 50 ms at most. */
+	for (uint32_t i = 0; i < 200 && (rd(cp.mbox, MBOX_INTSR1) & (1u << INT_AP_MSG)) != 0; i++) {
+		delay(250);
+	}
+	wr(cp.mbox, MBOX_ISSR(WORD_AP_MSG), value);
+	mbox_raise(INT_AP_MSG);
+}
+
+static uint32_t
+crc32_of(const uint8_t *p, uint32_t n)
+{
+	static const uint32_t nibble[16] = {
+		0x00000000, 0x1db71064, 0x3b6e20c8, 0x26d930ac, 0x76dc4190, 0x6b6b51f4, 0x4db26158, 0x5005713c,
+		0xedb88320, 0xf00f9344, 0xd6d6a3e8, 0xcb61b38c, 0x9b64c2b0, 0x86d3d2d4, 0xa00ae278, 0xbdbdf21c,
+	};
+	uint32_t c = 0xffffffffu;
+
+	while (n-- != 0) {
+		c ^= *p++;
+		c = nibble[c & 15] ^ (c >> 4);
+		c = nibble[c & 15] ^ (c >> 4);
+	}
+	return ~c;
+}
+
+/* the CP's memory must be nobody's: not XNU's pages, not where the kernel itself was loaded */
+extern boolean_t pmap_valid_page(ppnum_t pn);
+
+static bool
+memory_is_free(void)
+{
+	uint64_t here[2] = { kvtophys((vm_offset_t)&cp), kvtophys((vm_offset_t)&memory_is_free) };
+
+	for (uint32_t i = 0; i < 2; i++) {
+		if (here[i] >= CP_MEM_PA && here[i] < CP_MEM_PA + CP_MEM_BYTES) {
+			say("cp: this kernel itself is loaded in the CP's memory (%#llx): the modem cannot be used on this boot path\n",
+			    here[i]);
+			return false;
+		}
+	}
+	for (uint64_t pa = CP_MEM_PA; pa < CP_MEM_PA + CP_MEM_BYTES; pa += PAGE_SIZE) {
+		if (pmap_valid_page((ppnum_t)(pa >> PAGE_SHIFT))) {
+			say("cp: %#llx of the CP's memory is one of XNU's pages: the modem cannot be used with this memory layout\n", pa);
+			return false;
+		}
+	}
+	return true;
+}
+
+/* ---- stage 1: the look ---- */
+
+static void
+look_pmu(const char *when)
+{
+	uint32_t ns = 0, s = 0;
+	bool have_ns = secure_read(SMC_CP_REG_NS, &ns), have_s = secure_read(SMC_CP_REG_S, &s);
+
+	say("cp: PMU %s: CP_STAT %#x, CENTRAL_SEQ_CP config %#x status %#x, RESET_SEQUENCER_STATUS %#x, CLEANY_BUS_CP "
+	    "config %#x status %#x\n", when, rd(cp.pmu, PMU_CP_STAT), rd(cp.pmu, PMU_CENTRAL_SEQ_CP_CFG),
+	    rd(cp.pmu, PMU_CENTRAL_SEQ_CP_STAT), rd(cp.pmu, PMU_RESET_SEQ_STAT), rd(cp.pmu, PMU_CLEANY_BUS_CP_CFG),
+	    rd(cp.pmu, PMU_CLEANY_BUS_CP_STAT));
+	say("cp: PMU %s: the CP's power-down words 0x1320-0x1338: %#x %#x %#x %#x %#x %#x %#x\n", when,
+	    rd(cp.pmu, 0x1320), rd(cp.pmu, 0x1324), rd(cp.pmu, 0x1328), rd(cp.pmu, 0x132c), rd(cp.pmu, 0x1330),
+	    rd(cp.pmu, 0x1334), rd(cp.pmu, 0x1338));
+	if (have_ns && have_s) {
+		say("cp: PMU %s: the secure words: CP_CTRL_NS %#x, CP_CTRL_S %#x; the CP's interrupt %s\n", when, ns, s,
+		    cp_irq_pending() ? "pending" : "not pending");
+	}
+	/* AP2CP_CFG is NOT read here: it is in the CP's own power domain, and reading it before that domain was ever
+	 * started, while the CP is held in reset, or while the running CP has put itself to sleep is a bus error (seen
+	 * three times: an SError panic). It is touched once, at the start, as Samsung's driver does. */
+}
+
+static void
+look_mbox(const char *when)
+{
+	say("cp: mailbox %s: MCUCTLR %#x, to the AP: mask %#x status %#x, to the CP: mask %#x status %#x\n", when,
+	    rd(cp.mbox, MBOX_MCUCTLR), rd(cp.mbox, MBOX_INTMR0), rd(cp.mbox, MBOX_INTSR0), rd(cp.mbox, MBOX_INTMR1),
+	    rd(cp.mbox, MBOX_INTSR1));
+	say("cp: mailbox %s: words 0-9: %#x %#x %#x %#x %#x %#x %#x %#x %#x %#x (CP's state %u, active %u)\n", when,
+	    rd(cp.mbox, MBOX_ISSR(0)), rd(cp.mbox, MBOX_ISSR(1)), rd(cp.mbox, MBOX_ISSR(2)), rd(cp.mbox, MBOX_ISSR(3)),
+	    rd(cp.mbox, MBOX_ISSR(4)), rd(cp.mbox, MBOX_ISSR(5)), rd(cp.mbox, MBOX_ISSR(6)), rd(cp.mbox, MBOX_ISSR(7)),
+	    rd(cp.mbox, MBOX_ISSR(8)), rd(cp.mbox, MBOX_ISSR(9)), CP_STATE_STATUS(rd(cp.mbox, MBOX_ISSR(WORD_CP_STATE))),
+	    CP_STATE_ACTIVE(rd(cp.mbox, MBOX_ISSR(WORD_CP_STATE))));
+}
+
+/* how much of a stretch of the CP's memory is not zero: a count, never the bytes */
+static uint32_t
+not_zero(uint32_t off, uint32_t bytes)
+{
+	const volatile uint32_t *p = (const volatile uint32_t *)(void *)((uint8_t *)cp.mem + off);
+	uint32_t n = 0;
+
+	for (uint32_t i = 0; i < bytes / 4; i++) {
+		n += p[i] != 0;
+	}
+	return n * 4;
+}
+
+static void
+look_mem(void)
+{
+	const volatile uint32_t *m = (const volatile uint32_t *)cp.mem;
+
+	say("cp: the CP's memory as found: first words %#x %#x %#x %#x; at 0xA0 %#x, at 0x2A0 %#x (\"MEM\" would be an image "
+	    "left there by the boot loader)\n", m[0], m[1], m[2], m[3], m[0xa0 / 4], m[0x2a0 / 4]);
+	say("cp: the CP's memory as found: bytes not zero in the first 64 KB %u, in MAIN's first MB %u, in the NV place %u "
+	    "of 1048576, in the IPC memory's first 64 KB %u; IPC magic %#x access %#x\n", not_zero(0, 0x10000),
+	    not_zero(0x10000, 0x100000), not_zero(0x4900000, 0x100000), not_zero(CP_IPC_OFFSET, 0x10000),
+	    ipc_rd32(IPC_MAGIC), ipc_rd32(IPC_ACCESS));
+}
+
+static const struct toc_entry *
+toc_find(const char *name)
+{
+	for (uint32_t i = 0; i < cp.ntoc; i++) {
+		if (strncmp(cp.toc[i].name, name, sizeof(cp.toc[i].name)) == 0) {
+			return &cp.toc[i];
+		}
+	}
+	return NULL;
+}
+
+static bool
+read_toc(void)
+{
+	static uint8_t head[4096];
+	uint64_t size = 0;
+	int error = ENXIO;
+
+	/* the storage may come up after this thread: two minutes for it */
+	for (uint32_t waited = 0; waited < 240; waited++) {
+		error = hakios_ufs_read_partition("RADIO", 0, NULL, 0, &size);
+		if (error == 0) {
+			break;
+		}
+		IOSleep(500);
+	}
+	if (error != 0 || size < sizeof(head)) {
+		say("cp: no RADIO partition to read (error %d, %llu bytes)\n", error, size);
+		return false;
+	}
+	error = hakios_ufs_read_partition("RADIO", 0, head, sizeof(head), NULL);
+	if (error != 0) {
+		say("cp: RADIO's first block could not be read (error %d)\n", error);
+		return false;
+	}
+	cp.ntoc = 0;
+	for (uint32_t i = 0; i < 16; i++) {
+		struct toc_entry *e = &cp.toc[cp.ntoc];
+
+		memcpy(e, head + 32 * i, sizeof(*e));
+		if (e->name[0] == 0) {
+			break;
+		}
+		e->name[sizeof(e->name) - 1] = 0;
+		say("cp: RADIO (%llu bytes) entry %u: %s at %#x in the partition, for the CP at %#x, %u bytes, CRC %#x\n", size,
+		    i, e->name, e->offset, e->address, e->size, e->crc);
+		cp.ntoc++;
+	}
+	cp.boot = toc_find("BOOT");
+	cp.main = toc_find("MAIN");
+	cp.vss = toc_find("VSS");
+	cp.nv = toc_find("NV");
+	if (cp.ntoc == 0 || strcmp(cp.toc[0].name, "TOC") != 0 || cp.boot == NULL || cp.main == NULL ||
+	    cp.boot->address != 0x40000000u || cp.main->address <= cp.boot->address ||
+	    (uint64_t)(cp.main->address - cp.boot->address) + cp.main->size > CP_IPC_OFFSET ||
+	    (uint64_t)cp.boot->offset + cp.boot->size > size || (uint64_t)cp.main->offset + cp.main->size > size ||
+	    cp.boot->size > cp.main->address - cp.boot->address) {
+		say("cp: RADIO's table of contents is not the one this driver knows: nothing is loaded\n");
+		return false;
+	}
+	/* the image's own memory table, 0xA0 into BOOT: "MEMn", the CP's size, the rest's size, a count, then
+	 * (tag, offset, size) entries. Samsung's kernel gives the secure world the memory's address when it is there. */
+	{
+		uint32_t at = cp.boot->offset + 0xa0;
+		uint32_t tag = 0, count = 0;
+
+		if (cp.boot->offset < sizeof(head) - 0xa0 - 16 - 12 * 5) {
+			memcpy(&tag, head + at, 4);
+			memcpy(&count, head + at + 12, 4);
+		}
+		cp.mem_table = (tag & 0xffffff00u) == 0x4d454d00u && count >= 1 && count <= 5;
+		if (cp.mem_table) {
+			for (uint32_t i = 0; i < count; i++) {
+				uint32_t t, a, s;
+
+				memcpy(&t, head + at + 16 + 12 * i, 4);
+				memcpy(&a, head + at + 20 + 12 * i, 4);
+				memcpy(&s, head + at + 24 + 12 * i, 4);
+				say("cp: the image's memory table: %c%c%c at %#x, %#x bytes\n", (char)(t >> 16), (char)(t >> 8), (char)t,
+				    a, s);
+				if ((t & 0xffffff) == 0x495043 /* "IPC" */ && (a != CP_IPC_OFFSET || s != CP_IPC_BYTES)) {
+					say("cp: the image puts the IPC memory somewhere this driver does not expect: nothing is loaded\n");
+					return false;
+				}
+			}
+		} else {
+			say("cp: the image has no memory table: the device tree's layout is used\n");
+		}
+	}
+	return true;
+}
+
+/* ---- stage 2: loaded and checked ---- */
+
+static bool
+cp_power_first(void)
+{
+	uint32_t seq = rd(cp.pmu, PMU_RESET_SEQ_STAT) & 7;
+
+	if (seq != 0) {
+		say("cp: the CP's power domain was started before us (RESET_SEQUENCER_STATUS %u): left as it is\n", seq);
+		return true;
+	}
+	say("cp: the CP's power domain has never been started in this boot: starting it (Samsung's \"cp_init\")\n");
+	if (!secure_update(SMC_CP_REG_NS, 0, NS_PWRON, "power on") || !secure_update(SMC_CP_REG_S, 0, S_START, "start")) {
+		return false;
+	}
+	delay(1024);
+	if (!pmu_wait(PMU_RESET_SEQ_STAT, 7, 5, 500, "RESET_SEQUENCER_STATUS")) {
+		return false;
+	}
+	for (uint32_t i = 0; i < 500 && !cp_irq_pending(); i++) {
+		IOSleep(1);
+	}
+	say("cp: the CP's power domain is up (RESET_SEQUENCER_STATUS %u), its interrupt %s\n",
+	    rd(cp.pmu, PMU_RESET_SEQ_STAT) & 7, cp_irq_pending() ? "pending" : "not pending after 500 ms (gone on anyway)");
+	return true;
+}
+
+static bool
+copy_entry(const struct toc_entry *e)
+{
+	uint32_t at = e->address - cp.boot->address;
+	uint8_t *dst = (uint8_t *)cp.mem + at;
+	uint64_t t0 = now_ms();
+	uint32_t crc;
+
+	for (uint32_t done = 0; done < e->size;) {
+		uint32_t n = MIN(e->size - done, 1u << 20);
+		int error = hakios_ufs_read_partition("RADIO", (uint64_t)e->offset + done, dst + done, n, NULL);
+
+		if (error != 0) {
+			say("cp: %s: RADIO could not be read at %#x (error %d)\n", e->name, e->offset + done, error);
+			return false;
+		}
+		done += n;
+	}
+	crc = crc32_of(dst, e->size);
+	say("cp: %s: %u bytes of RADIO at %#x copied to the CP's memory at %#x in %llu ms; read back, their CRC is %#x, "
+	    "the table's %#x: %s\n", e->name, e->size, e->offset, at, now_ms() - t0, crc, e->crc,
+	    crc == e->crc ? "THE SAME" : "DIFFERENT");
+	return crc == e->crc;
+}
+
+/* cp_nv=2: EFS read through hakios_ufs_read_partition, which only reads (bsd/dev/herolte_ufs.c) */
+static int
+efs_read(__unused void *ctx, uint64_t off, void *dst, uint32_t len)
+{
+	return hakios_ufs_read_partition("EFS", off, dst, len, NULL);
+}
+
+/*
+ * cp_nv=2: /nv_data.bin of the EFS partition into cp.nv_ram (size bytes, the NV place's size), read-only. EFS is not
+ * mounted and nothing is ever written to it: the reader has no write path, and the copy stays in kernel memory for the
+ * run. Logged: sizes, and the first four hex digits of the copy's CRC-32. Nothing of its bytes.
+ */
+static bool
+nv_from_efs(uint32_t size)
+{
+	struct ext4ro fs = { .read = efs_read, .ctx = NULL };
+	uint64_t part = 0, got = 0, t0 = now_ms();
+	int e;
+
+	if ((e = hakios_ufs_read_partition("EFS", 0, NULL, 0, &part)) != 0) {
+		say("cp: cp_nv=2: the EFS partition cannot be read (errno %d): not going on\n", e);
+		return false;
+	}
+	if ((e = ext4ro_open(&fs)) != 0) {
+		say("cp: cp_nv=2: EFS (%llu bytes) is no ext4 this reader knows (errno %d): not going on\n", part, e);
+		return false;
+	}
+	fs.blk = kalloc_data(fs.block_size, Z_WAITOK);
+	fs.blk2 = kalloc_data(fs.block_size, Z_WAITOK);
+	cp.nv_ram = kalloc_data(size, Z_WAITOK | Z_ZERO);
+	if (fs.blk == NULL || fs.blk2 == NULL || cp.nv_ram == NULL) {
+		e = ENOMEM;
+	} else {
+		e = ext4ro_read_file(&fs, "/nv_data.bin", cp.nv_ram, size, &got);
+	}
+	if (fs.blk != NULL) {
+		kfree_data(fs.blk, fs.block_size);
+	}
+	if (fs.blk2 != NULL) {
+		kfree_data(fs.blk2, fs.block_size);
+	}
+	if (e != 0 || got != size) {
+		say("cp: cp_nv=2: EFS's /nv_data.bin not read (errno %d, %llu bytes, the NV place has %u): not going on\n", e,
+		    got, size);
+		if (cp.nv_ram != NULL) {
+			bzero(cp.nv_ram, size);
+			kfree_data(cp.nv_ram, size);
+			cp.nv_ram = NULL;
+		}
+		return false;
+	}
+	cp.nv_ram_size = size;
+	say("cp: NV: EFS's /nv_data.bin read READ-ONLY (EFS %llu bytes, ext4 blocks of %u; the file %u bytes, CRC-32 %04x..., "
+	    "%llu ms): kept in RAM only\n", part, fs.block_size, size, crc32_of(cp.nv_ram, size) >> 16, now_ms() - t0);
+	return true;
+}
+
+static bool
+fill_nv(void)
+{
+	uint32_t at, size;
+	uint8_t *dst;
+	const uint8_t *file = NULL;
+	uint64_t file_size = 0;
+
+	if (cp.nv == NULL) {
+		say("cp: the image names no NV place\n");
+		return true;
+	}
+	at = cp.nv->address - cp.boot->address;
+	size = cp.nv->size;
+	if (cp.nv->address < cp.main->address + cp.main->size || (uint64_t)at + size > CP_IPC_OFFSET || size > (4u << 20)) {
+		say("cp: the NV place (%#x, %u bytes) is not where this driver expects one: left alone\n", at, size);
+		return false;
+	}
+	dst = (uint8_t *)cp.mem + at;
+	if (cp.nv_file == 2) {
+		if (!nv_from_efs(size)) {
+			return false;
+		}
+		memcpy(dst, cp.nv_ram, size);
+		cp.nv_loaded = true;
+		say("cp: NV: the RAM copy of EFS's nv_data.bin (%u bytes) copied to the CP's memory at %#x\n", size, at);
+	} else if (cp.nv_file) {
+		file = hakios_image_file("fw", "nv_data.bin", &file_size, NULL);
+		if (file == NULL || file_size != size) {
+			say("cp: cp_nv=1, but the boot image carries no nv_data.bin of %u bytes (found %llu): not going on\n", size,
+			    file_size);
+			return false;
+		}
+		memcpy(dst, file, size);
+		cp.nv_loaded = true;
+		say("cp: NV: the builder's nv_data.bin (%u bytes, never from the EFS partition by this kernel) copied to the "
+		    "CP's memory at %#x\n", size, at);
+	} else {
+		bzero(dst, size);
+		say("cp: NV: the place at %#x (%u bytes) filled with zeros: the CP gets no non-volatile data in this run\n", at,
+		    size);
+	}
+	return true;
+}
+
+static bool
+load_and_check(void)
+{
+	uint32_t answer;
+	uint64_t mode;
+
+	if (!cp_power_first()) {
+		return false;
+	}
+	smc(SMC_SSS_CLK, 0, 0, 0);
+	answer = (uint32_t)smc(SMC_CP, 2, 0, 0);
+	smc(SMC_SSS_CLK, 1, 0, 0);
+	say("cp: the secure world asked to open the CP's memory for loading (mode 2): it answered %#x (%s)\n", answer,
+	    smc_error(answer));
+	/* (Samsung's daemon goes on whatever this answers: "CP not working" is what a CP that never ran gives) */
+
+	if (!copy_entry(cp.boot) || !copy_entry(cp.main)) {
+		say("cp: the image in the CP's memory is not the image in RADIO: the secure world is not asked, nothing started\n");
+		return false;
+	}
+	if (cp.vss != NULL && cp.vss_on) {
+		if (cp.vss->address - cp.boot->address + (uint64_t)cp.vss->size > CP_IPC_OFFSET ||
+		    cp.vss->address < cp.main->address + cp.main->size) {
+			say("cp: VSS is not where this driver expects it: not copied\n");
+		} else if (!copy_entry(cp.vss)) {
+			return false;
+		}
+	}
+	if (!fill_nv()) {
+		return false;
+	}
+
+	mode = cp.mem_table ? CP_MEM_PA : 0;
+	smc(SMC_SSS_CLK, 0, 0, 0);
+	answer = (uint32_t)smc(SMC_CP, mode, cp.boot->size, cp.main->size);
+	smc(SMC_SSS_CLK, 1, 0, 0);
+	say("cp: THE SECURE WORLD'S CHECK of the image (mode 0, memory %#llx, BOOT %u bytes, MAIN %u bytes): it answered "
+	    "%#x (%s)\n", mode, cp.boot->size, cp.main->size, answer, smc_error(answer));
+	if (answer != 0) {
+		say("cp: the secure world did not accept the image: stopping here, the CP is not started\n");
+		return false;
+	}
+	return true;
+}
+
+/* ---- the CP back in reset (Samsung's "reset_assert") ---- */
+
+static void
+cp_stop(const char *why)
+{
+	if (!cp.started) {
+		return;
+	}
+	say("cp: stopping the CP (%s)\n", why);
+	mbox_raise(INT_AP_WAKEUP);
+	IOSleep(5);
+	(void)secure_update(SMC_CP_REG_NS, 0, NS_DUMP_PC_NO_PG, "keep its program counter readable");
+	wr(cp.pmu, 0x1320, rd(cp.pmu, 0x1320) & ~3u);
+	wr(cp.pmu, 0x1324, rd(cp.pmu, 0x1324) & ~1u);
+	wr(cp.pmu, 0x1328, rd(cp.pmu, 0x1328) & ~3u);
+	wr(cp.pmu, 0x132c, rd(cp.pmu, 0x132c) & ~1u);
+	wr(cp.pmu, 0x1330, rd(cp.pmu, 0x1330) | 1u);
+	wr(cp.pmu, 0x1334, rd(cp.pmu, 0x1334) & ~1u);
+	wr(cp.pmu, 0x1338, rd(cp.pmu, 0x1338) & ~1u);
+	(void)secure_update(SMC_CP_REG_NS, 0, NS_RESET_SET, "reset");
+	wr(cp.pmu, PMU_CENTRAL_SEQ_CP_CFG, rd(cp.pmu, PMU_CENTRAL_SEQ_CP_CFG) & ~(1u << 16));
+	delay(1024);
+	if (pmu_wait(PMU_CENTRAL_SEQ_CP_STAT, 0xffu << 16, 0x80u << 16, 200, "CENTRAL_SEQ_CP_STATUS")) {
+		say("cp: THE CP IS IN RESET (CENTRAL_SEQ_CP_STATUS %#x)\n", rd(cp.pmu, PMU_CENTRAL_SEQ_CP_STAT));
+	}
+	/* the mailbox's interrupts to the AP masked and cleared, nothing pending for whoever boots next */
+	wr(cp.mbox, MBOX_INTMR0, 0xffff0000u);
+	wr(cp.mbox, MBOX_INTCR0, 0xffff0000u);
+	cp.started = cp.up = cp.link = cp.link_acked = false;
+	look_pmu("after the stop");
+	look_mbox("after the stop");
+}
+
+/* ---- stage 3: started ---- */
+
+/* a boot loader frame on the old raw queue */
+static bool
+boot_send(uint32_t word)
+{
+	uint8_t frame[8] = { 0xfc, CH_BOOT, 8, 0, (uint8_t)word, (uint8_t)(word >> 8), (uint8_t)(word >> 16), (uint8_t)(word >> 24) };
+	uint32_t head = ipc_rd32(IPC_RAW_TX_HEAD), tail = ipc_rd32(IPC_RAW_TX_TAIL);
+
+	if (head >= IPC_RAW_TX_BYTES || tail >= IPC_RAW_TX_BYTES) {
+		say("cp: the boot queue's pointers are out of range (%u, %u)\n", head, tail);
+		return false;
+	}
+	for (uint32_t i = 0; i < sizeof(frame); i++) {
+		cp.ipc[IPC_RAW_TX_BUF + (head + i) % IPC_RAW_TX_BYTES] = frame[i];
+	}
+	__builtin_arm_dsb(0xf);
+	ipc_wr32(IPC_RAW_TX_HEAD, (head + sizeof(frame)) % IPC_RAW_TX_BYTES);
+	return true;
+}
+
+static bool
+boot_receive(uint32_t *word, uint32_t ms)
+{
+	uint64_t until = now_ms() + ms;
+
+	do {
+		uint32_t head = ipc_rd32(IPC_RAW_RX_HEAD), tail = ipc_rd32(IPC_RAW_RX_TAIL);
+		uint32_t have;
+
+		if (head < IPC_RAW_RX_BYTES && tail < IPC_RAW_RX_BYTES &&
+		    (have = (head + IPC_RAW_RX_BYTES - tail) % IPC_RAW_RX_BYTES) >= 8) {
+			uint8_t frame[8];
+
+			for (uint32_t i = 0; i < 8; i++) {
+				frame[i] = cp.ipc[IPC_RAW_RX_BUF + (tail + i) % IPC_RAW_RX_BYTES];
+			}
+			/* everything that was there is taken: the boot loader says one thing at a time */
+			ipc_wr32(IPC_RAW_RX_TAIL, head);
+			memcpy(word, frame + 4, 4);
+			if ((frame[0] & 0xf8) != 0xf8 || frame[1] != CH_BOOT) {
+				say("cp: the boot queue held %u bytes that are no boot frame: %02x %02x %02x %02x %02x %02x %02x %02x\n",
+				    have, frame[0], frame[1], frame[2], frame[3], frame[4], frame[5], frame[6], frame[7]);
+				return false;
+			}
+			return true;
+		}
+		IOSleep(1);
+	} while (now_ms() < until);
+	return false;
+}
+
+static bool
+boot_ask(uint32_t question, uint32_t expected)
+{
+	uint32_t answer = 0;
+	uint64_t t0 = now_ms();
+
+	if (!boot_send(question)) {
+		return false;
+	}
+	if (!boot_receive(&answer, 5000)) {
+		say("cp: the boot loader was asked %#x and said nothing in 5 s (queue to it: head %u tail %u; from it: head %u "
+		    "tail %u; mailbox status %#x, word 1 %#x, CP's state word %#x)\n", question, ipc_rd32(IPC_RAW_TX_HEAD),
+		    ipc_rd32(IPC_RAW_TX_TAIL), ipc_rd32(IPC_RAW_RX_HEAD), ipc_rd32(IPC_RAW_RX_TAIL), rd(cp.mbox, MBOX_INTSR0),
+		    rd(cp.mbox, MBOX_ISSR(WORD_CP_MSG)), rd(cp.mbox, MBOX_ISSR(WORD_CP_STATE)));
+		return false;
+	}
+	say("cp: the boot loader was asked %#x and answered %#x after %llu ms (%s)\n", question, answer, now_ms() - t0,
+	    answer == expected ? "as Android's daemon expects" : "NOT the expected answer");
+	return answer == expected;
+}
+
+/* the table of rings the running CP reads when it is told PIF_INIT_DONE */
+static void zc_offer(void);
+
+static void
+write_rings(void)
+{
+	uint32_t desc = SBD_DESC + SBD_GLOBAL_BYTES;    /* the next free byte of the table's 62 KB */
+	uint32_t buffers = SBD_BUFFERS;
+	uint32_t counters;
+
+	bzero(cp.ipc + SBD_DESC, SBD_BUFFERS - SBD_DESC);
+	counters = desc;
+	desc += 2 * 2 * 2 * NRINGS;                      /* u16 ul_rp[], ul_wp[], dl_rp[], dl_wp[] */
+	ipc_wr32(SBD_DESC + 0, 1);                      /* version */
+	ipc_wr32(SBD_DESC + 4, NRINGS);
+	ipc_wr32(SBD_DESC + 8, counters);
+	for (uint32_t i = 0; i < NRINGS; i++) {
+		const struct ring_cfg *c = &ring_cfgs[i];
+
+		for (uint32_t dir = 0; dir < 2; dir++) {
+			struct ring *r = dir == 0 ? &cp.ul[i] : &cp.dl[i];
+			uint32_t d = SBD_DESC + SBD_RB_DESC + (i * 2 + dir) * 20;
+
+			r->len = dir == 0 ? c->ul_len : c->dl_len;
+			r->size = dir == 0 ? c->ul_size : c->dl_size;
+			r->buffers = buffers;
+			buffers += (uint32_t)r->len * r->size;
+			r->rp = counters + 2 * (NRINGS * (dir * 2 + 0) + i);
+			r->wp = counters + 2 * (NRINGS * (dir * 2 + 1) + i);
+			r->addr_v = desc;
+			desc += 4u * r->len;
+			r->size_v = desc;
+			desc += 4u * r->len;
+			for (uint32_t k = 0; k < r->len; k++) {
+				ipc_wr32(r->addr_v + 4 * k, r->buffers + k * r->size);
+			}
+			/* the ring's descriptor: channel, 0, direction, signalling by interrupt, the message to send for it,
+			 * length, number, buffer size, payload offset */
+			ipc_wr16(d + 0, c->ch);
+			ipc_wr16(d + 2, 0);
+			ipc_wr16(d + 4, (uint16_t)dir);
+			ipc_wr16(d + 6, 1);
+			ipc_wr32(d + 8, MSG_VALID | MSG_DATA);
+			ipc_wr16(d + 12, r->len);
+			ipc_wr16(d + 14, (uint16_t)i);
+			ipc_wr16(d + 16, r->size);
+			ipc_wr16(d + 18, 0);
+			/* the channel's entry: where its two descriptors and their offset arrays are */
+			ipc_wr32(SBD_DESC + SBD_RB_CH + i * 16 + dir * 8 + 0, d);
+			ipc_wr32(SBD_DESC + SBD_RB_CH + i * 16 + dir * 8 + 4, r->addr_v);
+		}
+	}
+	__builtin_arm_dsb(0xf);
+	cp.zc_alloc = cp.zc_pre = 0;
+	zc_offer();                     /* (stage 7 only) */
+	say("cp: the ring table written: %u channels, the table ends at %u of 65536, the buffers at %u of %u\n",
+	    (uint32_t)NRINGS, desc, buffers, CP_IPC_BYTES);
+}
+
+/* ---- stage 4: the link ---- */
+
+static bool fmt_send(uint8_t group, uint8_t index, uint8_t type, const uint8_t *data, uint16_t n);
+
+static bool
+ring_send(uint32_t i, const uint8_t *frame, uint32_t n, bool tell, uint32_t tag)
+{
+	struct ring *r = &cp.ul[i];
+	uint16_t wp = ipc_rd16(r->wp), rp = ipc_rd16(r->rp);
+
+	if (n > r->size || wp >= r->len || rp >= r->len || (uint16_t)((wp + 1) % r->len) == rp) {
+		say("cp: no room to send on channel %u (write %u, read %u of %u)\n", ring_cfgs[i].ch, wp, rp, r->len);
+		return false;
+	}
+	memcpy(cp.ipc + r->buffers + (uint32_t)wp * r->size, frame, n);
+	ipc_wr32(r->size_v + 4u * wp, n | tag);         /* (a data ring: the packet's channel in the upper half) */
+	__builtin_arm_dsb(0xf);
+	ipc_wr16(r->wp, (uint16_t)((wp + 1) % r->len));
+	__builtin_arm_dsb(0xf);
+	if (tell) {
+		send_msg(MSG_VALID | MSG_DATA);
+	}
+	return true;
+}
+
+/* one control message to the CP: the group, the number in it, the type (2: "get") */
+static bool
+fmt_send(uint8_t group, uint8_t index, uint8_t type, const uint8_t *data, uint16_t n)
+{
+	uint8_t frame[160];
+	uint16_t len = (uint16_t)(7 + n);
+
+	if (!cp.link || n > sizeof(frame) - 11) {       /* (cp.link is set before INIT_END is sent) */
+		return false;
+	}
+	frame[0] = 0xf8;
+	frame[1] = CH_FMT;
+	frame[2] = (uint8_t)(4 + len);
+	frame[3] = (uint8_t)((4u + len) >> 8);
+	frame[4] = (uint8_t)len;
+	frame[5] = (uint8_t)(len >> 8);
+	frame[6] = ++cp.mseq;
+	frame[7] = 0;
+	frame[8] = group;
+	frame[9] = index;
+	frame[10] = type;
+	if (n != 0) {
+		memcpy(frame + 11, data, n);
+	}
+	say("cp: sent to the CP on channel 235: group %#x number %#x type %#x, sequence %u, %u bytes of data\n", group, index,
+	    type, cp.mseq, n);
+	/* while the CP has not taken INIT_END the frame only waits in the ring: the "data" message would replace
+	 * INIT_END in the one message word (the watch loop tells the CP once it has) */
+	return ring_send(1, frame, 4u + len, cp.link_acked, 0);
+}
+
+/* the phone state asked for: 1 low power (bytes 01 00), 2 normal (02 02): Samsung IPC's power group 0x01, number
+ * 0x07, "execute": what Android's RIL sends when airplane mode is switched on and off */
+static void
+ask_phone_state(int state)
+{
+	static const uint8_t low[2] = { 0x01, 0x00 }, normal[2] = { 0x02, 0x02 };
+
+	(void)fmt_send(0x01, 0x07, 0x01, state == 2 ? normal : low, 2);
+}
+
+/* the band selection asked for (network group 0x08, number 7, "get", no data): what bands the modem is set to use.
+ * It sets nothing and carries no identity; its answer is logged as its length and first bytes. */
+static void
+ask_bands(void)
+{
+	(void)fmt_send(0x08, 0x07, 0x02, NULL, 0);
+}
+
+/* the modem's software version asked for: Samsung IPC's "MISC" group (0x0A), number 1, "get", one byte 0xFF.
+ * It sets nothing. (Number 3 of the same group is the serial number: never asked.) */
+static void
+ask_version(void)
+{
+	static const uint8_t all = 0xff;
+
+	(void)fmt_send(0x0a, 0x01, 0x02, &all, 1);
+}
+
+static void
+print_text(const char *what, const uint8_t *p, uint32_t n)
+{
+	char text[65];
+	uint32_t k = 0;
+
+	for (uint32_t i = 0; i < n && k < sizeof(text) - 1 && p[i] != 0; i++) {
+		text[k++] = (p[i] >= 0x20 && p[i] < 0x7f) ? (char)p[i] : '.';
+	}
+	text[k] = 0;
+	say("cp:   %s \"%s\"\n", what, text);
+}
+
+static void
+fmt_received(const uint8_t *m, uint32_t n)
+{
+	uint16_t len;
+	uint8_t group, index, type;
+
+	if (n < 7) {
+		say("cp: from the CP on channel 235: %u bytes, too short for a message\n", n);
+		return;
+	}
+	memcpy(&len, m, 2);
+	group = m[4];
+	index = m[5];
+	type = m[6];
+	cp.fmt_messages++;
+	say("cp: from the CP on channel 235: group %#x number %#x type %#x (%s), its sequence %u answering ours %u, %u "
+	    "bytes of data (its length word %u)\n", group, index, type, type == 1 ? "indication" : type == 2 ? "response" :
+	    type == 3 ? "notification" : "?", m[2], m[3], n - 7, len);
+	if (group == 0x0a && index == 0x01 && type == 2 && n >= 7 + 64) {
+		/* the version answer: text fields of 32 bytes: software, hardware, calibration date (no identity in them) */
+		say("cp: THE MODEM ANSWERED THE VERSION QUESTION (%u bytes):\n", n - 7);
+		print_text("software version", m + 7 + 1, 32);
+		if (n >= 7 + 1 + 64) {
+			print_text("hardware version", m + 7 + 33, 32);
+		}
+		if (n >= 7 + 1 + 96) {
+			print_text("calibration date", m + 7 + 65, 32);
+		}
+		cp.version_answered = true;
+	} else if (group == 0x08 && index == 0x07 && type == 2) {
+		say("cp: THE MODEM ANSWERED THE BAND SELECTION QUESTION (%u bytes): %02x %02x %02x %02x %02x %02x %02x %02x\n",
+		    n - 7, n > 7 ? m[7] : 0, n > 8 ? m[8] : 0, n > 9 ? m[9] : 0, n > 10 ? m[10] : 0, n > 11 ? m[11] : 0,
+		    n > 12 ? m[12] : 0, n > 13 ? m[13] : 0, n > 14 ? m[14] : 0);
+	} else if (group == 0x80 && n >= 7 + 5) {
+		/* the general response: which request it answers and a 16-bit result */
+		say("cp:   a general response to group %#x number %#x type %#x: result %#x\n", m[7], m[8], m[9],
+		    (uint32_t)(m[10] | m[11] << 8));
+		if (m[7] == 0x0d && cp.data_step != 0 && cp.data_result < 0 && m[3] == cp.data_seq) {
+			cp.data_result = m[10] | m[11] << 8;
+		}
+	} else if (group == 0x0d && index == 0x10 && n >= 7 + 2) {
+		/* the data call's status: context, state, then a cause: state words, no identity */
+		cp.data_notes++;
+		say("cp:   DATA CALL STATUS: context %u, state %u, then %02x %02x %02x (of %u)\n", m[7], m[8], n > 9 ? m[9] : 0,
+		    n > 10 ? m[10] : 0, n > 11 ? m[11] : 0, n - 7);
+	} else if (group == 0x0d && index == 0x09 && n >= 7 + 4) {
+		/* the context's address configuration: its length, context, flag byte and one octet; the addresses are not
+		 * logged */
+		cp.data_configs++;
+		uint32_t set = 0;
+
+		for (uint32_t k = 0; k < 5 && n >= 7 + 3 + 4 * (k + 1); k++) {
+			set |= (m[10 + 4 * k] | m[11 + 4 * k] | m[12 + 4 * k] | m[13 + 4 * k]) != 0 ? 1u << k : 0;
+		}
+		say("cp:   DATA ADDRESS CONFIGURATION: %u bytes, context %u, flags %#x, the first address' first octet %u (the "
+		    "rest is not logged); of the five 4-byte fields after the flags these are set: %#x\n", n - 7, m[7], m[8],
+		    m[10], set);
+		if (m[7] == DATA_CID && cp.data_step != 0 && n >= 7 + 3 + 8) {
+			/* the address and the first DNS server, for stage 7: used only if both look like host addresses */
+			memcpy(cp.ip4, m + 10, 4);
+			memcpy(cp.dns4, m + 14, 4);
+			cp.have4 = cp.ip4[0] != 0 && cp.ip4[0] != 127 && cp.ip4[0] < 224 && cp.dns4[0] != 0 &&
+			    cp.dns4[0] != 127 && cp.dns4[0] < 224;
+			if (!cp.ping_given) {
+				memcpy(cp.ping4, cp.dns4, 4);
+			}
+		}
+	} else if (group == 0x0d) {
+		cp.data_notes++;
+	} else if (group == 0x01 && index == 0x07 && n >= 7 + 1) {
+		/* the phone state: 1 low power (the radio off), 2 normal */
+		cp.phone_state = m[7];
+		say("cp:   PHONE STATE %u (%s)\n", m[7], m[7] == 1 ? "low power mode: the radio is off" : m[7] == 2 ?
+		    "NORMAL: the radio may be on" : "not a value this driver knows");
+		if (m[7] != 1 && (!cp.normal_asked || cp.back_asked)) {
+			say("cp:   the CP is not in low power mode: it is stopped now\n");
+			cp.stop = true;
+		}
+	} else if (group == 0x01 && n <= 7 + 8) {
+		/* power group: short state words, no identity */
+		say("cp:   power group data: %02x %02x %02x %02x (of %u)\n", n > 7 ? m[7] : 0, n > 8 ? m[8] : 0, n > 9 ? m[9] : 0,
+		    n > 10 ? m[10] : 0, n - 7);
+	} else if (group == 0x05 && (index == 0x01 || index == 0x07) && n <= 7 + 2) {
+		/* the SIM's status (number 1: 0x00 initialising, 0x80 no card, 0x82 ready, 0x83 phone book ready, 1-8 a lock)
+		 * and the card's type (number 7): no identity in either */
+		say("cp:   SIM %s: %02x %02x (of %u)\n", index == 1 ? "status" : "card type", n > 7 ? m[7] : 0, n > 8 ? m[8] : 0,
+		    n - 7);
+		if (index == 1 && n > 7) {
+			cp.sim_status = m[7];
+			cp.sim_ms = now_ms();
+		}
+	} else if (group == 0x05 && index == 0x05 && type == 2 && cp.sim_asked && n >= 7 + 3) {
+		/* the answer to our one SIM file read (EF_AD): the card's two status words, the length, and of the data only
+		 * how many digits the network code has (its fourth byte's low half) */
+		uint32_t got = m[9];
+
+		say("cp: THE SIM FILE READ WAS ANSWERED (EF_AD): status words %02x %02x, %u bytes of data; the network code's "
+		    "digits: %u\n", m[7], m[8], got, got >= 4 && n >= 7 + 3 + 4 ? m[13] & 0xfu : 0);
+	} else if (group == 0x08 && index == 0x05 && n >= 7 + 3) {
+		/* the registration state: technology, domain, state (1 none, 2 home, 3 searching, 4 emergency only, 5 unknown,
+		 * 6 roaming). The cell's numbers after them are not logged. */
+		say("cp:   REGISTRATION: technology %u, domain %u, state %u (%s)\n", m[7], m[8], m[9], m[9] == 1 ? "none" :
+		    m[9] == 2 ? "HOME" : m[9] == 3 ? "SEARCHING" : m[9] == 4 ? "EMERGENCY ONLY" : m[9] == 6 ? "ROAMING" : "?");
+		if (m[9] != (uint8_t)cp.reg_state) {
+			cp.reg_changes++;
+		}
+		cp.reg_state = m[9];
+		if ((m[9] == 2 || m[9] == 6) && cp.registered_ms == 0 && cp.normal_asked) {
+			cp.registered_ms = now_ms();
+			say("cp:   REGISTERED %llu ms after normal mode was asked for\n", cp.registered_ms - cp.normal_ms);
+		}
+		if (m[9] != 1 && !cp.normal_asked) {
+			say("cp:   a registration state other than \"none\" without normal mode asked for: the CP is stopped now\n");
+			cp.stop = true;
+		}
+	} else if (group == 0x08 && index == 0x03 && n >= 7 + 4) {
+		/* the serving network: its operator code is the run of 5 or 6 digits in it (the country's and the network's
+		 * numbers, the same for every subscriber of that network); nothing else of the message is logged */
+		char code[8];
+		uint32_t k = 0;
+
+		for (uint32_t i = 7; i < n && k == 0; i++) {
+			uint32_t d = 0;
+
+			while (i + d < n && d < 6 && m[i + d] >= '0' && m[i + d] <= '9') {
+				d++;
+			}
+			if (d >= 5) {
+				memcpy(code, m + i, d);
+				k = d;
+			}
+		}
+		code[k] = 0;
+		say("cp:   SERVING NETWORK: operator code %s (of %u bytes)\n", k != 0 ? code : "not found in it", n - 7);
+	} else if (group == 0x07 && (index == 0x01 || index == 0x06) && n >= 7 + 4) {
+		/* signal: the display group's icon (number 1) and strength (number 6) words: levels, no identity */
+		cp.signals++;
+		if (cp.signals <= 6 || cp.signals % 10 == 0) {
+			say("cp:   SIGNAL (%s, the %uth): %02x %02x %02x %02x %02x %02x\n", index == 1 ? "icons" : "strength",
+			    cp.signals, m[7], m[8], m[9], m[10], n > 11 ? m[11] : 0, n > 12 ? m[12] : 0);
+		}
+	}
+	/* everything else: the header above and the length only (a message may carry an identity) */
+}
+
+#define RING_RFS                3u              /* ring_cfgs' "rfs0" */
+
+/* cp_nv=2: an answer to the CP on the file channel: Samsung IPC's RFS header (length, command, id) and the body */
+static bool
+rfs_answer(uint8_t cmd, uint8_t id, const uint8_t *body, uint32_t n)
+{
+	uint8_t frame[2048];
+	uint32_t len = 6 + n;
+
+	if (4 + len > sizeof(frame) || 4 + len > cp.ul[RING_RFS].size) {
+		say("cp: an answer of %u bytes to file request command %#x does not fit one frame: not sent\n", len, cmd);
+		return false;
+	}
+	frame[0] = 0xf8;
+	frame[1] = CH_RFS;
+	frame[2] = (uint8_t)(4 + len);
+	frame[3] = (uint8_t)((4 + len) >> 8);
+	frame[4] = (uint8_t)len;
+	frame[5] = (uint8_t)(len >> 8);
+	frame[6] = (uint8_t)(len >> 16);
+	frame[7] = (uint8_t)(len >> 24);
+	frame[8] = cmd;
+	frame[9] = id;
+	if (n != 0) {
+		memcpy(frame + 10, body, n);
+	}
+	cp.rfs_answered++;
+	return ring_send(RING_RFS, frame, 4 + len, cp.link_acked, 0);
+}
+
+/* the answer to an NV read or write: confirm (1 done, 0 refused), offset, length; a read's data follows */
+static void
+rfs_nv_answer(uint8_t cmd, uint8_t id, bool ok, uint32_t offset, uint32_t length)
+{
+	static uint8_t body[2048];
+	uint32_t n = 9;
+
+	body[0] = ok ? 1 : 0;
+	memcpy(body + 1, &offset, 4);
+	memcpy(body + 5, &length, 4);
+	if (cmd == 1 && ok) {
+		memcpy(body + 9, cp.nv_ram + offset, length);
+		n += length;
+	}
+	(void)rfs_answer(cmd, id, body, n);
+	bzero(body, n);
+}
+
+/* more bytes of an NV write being received (cp_nv=2): into the RAM copy only */
+static void
+rfs_write_data(const uint8_t *d, uint32_t n)
+{
+	uint32_t take = MIN(n, cp.w_len - cp.w_got);
+
+	memcpy(cp.nv_ram + cp.w_off + cp.w_got, d, take);
+	cp.w_got += take;
+	if (cp.w_got == cp.w_len) {
+		cp.w_active = false;
+		cp.rfs_more = 0;
+		cp.nv_writes_kept++;
+		rfs_nv_answer(2, cp.w_id, true, cp.w_off, cp.w_len);
+		say("cp: NV write %u of the CP (offset %#x, %u bytes) kept in RAM only, answered\n", cp.nv_writes_kept, cp.w_off,
+		    cp.w_len);
+	}
+}
+
+/* a frame that continues a file request (multi-frame or a long frame) */
+static void
+rfs_continued(const uint8_t *m, uint32_t n)
+{
+	if (cp.w_active) {
+		rfs_write_data(m, n);
+	}
+}
+
+/* a file request of the CP: logged; with cp_nv=2 an NV read or write is answered from the RAM copy, nothing else is */
+static void
+rfs_received(const uint8_t *m, uint32_t n)
+{
+	uint32_t len = 0;
+	uint8_t cmd, id;
+
+	/* a file request is a stream: its first six bytes say how long it is, and a long one (an NV write with its
+	 * data) goes on through the next frames with nothing to mark them. Those frames are data: counted, dropped,
+	 * never looked into (seen twice: taken for requests, their first bytes were printed) */
+	if (cp.rfs_more != 0) {
+		rfs_continued(m, MIN(n, cp.rfs_more));
+		cp.rfs_more -= MIN(cp.rfs_more, n);
+		cp.dropped[3]++;
+		return;
+	}
+	cp.rfs_requests++;
+	if (n < 6) {
+		say("cp: from the CP on channel 245: %u bytes, too short for a file request\n", n);
+		return;
+	}
+	memcpy(&len, m, 4);
+	cmd = m[4];
+	id = m[5];
+	if (len > n) {
+		cp.rfs_more = len - n;
+	}
+	if ((cmd == 1 || cmd == 2) && n >= 14) {
+		uint32_t offset, length;
+
+		memcpy(&offset, m + 6, 4);
+		memcpy(&length, m + 10, 4);
+		if (cp.nv_ram != NULL) {
+			bool fits = offset <= cp.nv_ram_size && length <= cp.nv_ram_size - offset;
+
+			if (cmd == 1) {
+				bool ok = fits && length <= 2048u - 4u - 6u - 9u;     /* one frame */
+
+				rfs_nv_answer(1, id, ok, offset, ok ? length : 0);
+				cp.nv_reads_answered += ok;
+				say("cp: FILE REQUEST %u from the CP: an NV READ, offset %#x, %u bytes: %s\n", cp.rfs_requests, offset,
+				    length, ok ? "answered from the RAM copy" : "refused (out of the NV data or too long for one frame)");
+				return;
+			}
+			if (!fits) {
+				rfs_nv_answer(2, id, false, offset, length);
+				say("cp: FILE REQUEST %u from the CP: an NV WRITE out of the NV data (offset %#x, %u bytes): refused\n",
+				    cp.rfs_requests, offset, length);
+				return;
+			}
+			say("cp: FILE REQUEST %u from the CP: an NV WRITE, offset %#x, %u bytes: into the RAM copy only\n",
+			    cp.rfs_requests, offset, length);
+			cp.w_active = true;
+			cp.w_id = id;
+			cp.w_off = offset;
+			cp.w_len = length;
+			cp.w_got = 0;
+			rfs_write_data(m + 14, MIN(n - 14, length));
+			return;
+		}
+		say("cp: FILE REQUEST %u from the CP (not answered): %s of the NV data, offset %#x, %u bytes (request %u, id %u)\n",
+		    cp.rfs_requests, cmd == 1 ? "a READ" : "a WRITE (its data dropped, never kept)", offset, length, len, id);
+		cp.writes_dropped += cmd == 2;
+		return;
+	}
+	if (len > n) {
+		/* longer than this buffer and not an NV read or write: its header only, no look for a name in data */
+		say("cp: FILE REQUEST %u from the CP (not answered): command %#x, id %u, %u bytes in all (data dropped)\n",
+		    cp.rfs_requests, cmd, id, len);
+		return;
+	}
+	say("cp: FILE REQUEST %u from the CP (not answered): command %#x, id %u, %u bytes in all\n", cp.rfs_requests, cmd, id,
+	    len);
+	/* a path, if the request starts with one after a few words: printable text of 4 characters or more with a '/' or '.' */
+	for (uint32_t i = 6; i + 4 < n && i < 64; i++) {
+		uint32_t k = i;
+		bool path = false;
+
+		while (k < n && k - i < 63 && m[k] >= 0x20 && m[k] < 0x7f) {
+			path = path || m[k] == '/' || m[k] == '.';
+			k++;
+		}
+		if (k - i >= 4 && path && k < n && m[k] == 0) {
+			print_text("it names", m + i, k - i + 1);
+			break;
+		}
+	}
+}
+
+/* ---- the data rings (stage 7) ---- */
+
+#define RING_HIPRIO             7u              /* ring_cfgs' "data, high priority": ordinary buffers both ways */
+#define RING_DATA               8u              /* ring_cfgs' "data": up ordinary buffers, down the zero-copy slots */
+#define CH_PDP0                 10u             /* context 1's channel */
+#define ZMB_OFFSET              CP_IPC_BYTES    /* the "ZMC" region is right behind the IPC memory */
+#define ZMB_BYTES               0x00b00000u
+#define ZMB_CELL                4096u
+#define ZMB_HEADROOM            64u
+#define DATA_MAX                2048u
+#define PING_ID                 0x5339u
+
+/* where slot k's packet goes, counted from the IPC memory's start */
+static inline uint32_t
+zc_offset(uint32_t slot)
+{
+	return ZMB_OFFSET + slot * ZMB_CELL + ZMB_HEADROOM;
+}
+
+/* every free slot of the zero-copy ring offered to the CP */
+static void
+zc_offer(void)
+{
+	struct ring *r = &cp.dl[RING_DATA];
+	uint32_t n = 0;
+
+	if (cp.stage < 7 || r->len < 2 || r->size != 8 || (uint32_t)r->len * ZMB_CELL > ZMB_BYTES || cp.zc_alloc >= r->len ||
+	    cp.zc_pre >= r->len) {
+		return;
+	}
+	while ((uint16_t)((cp.zc_alloc + 1u) % r->len) != cp.zc_pre) {
+		uint64_t offset = zc_offset(cp.zc_alloc);
+
+		memcpy(cp.ipc + r->buffers + (uint32_t)cp.zc_alloc * 8u, &offset, 8);
+		cp.zc_alloc = (uint16_t)((cp.zc_alloc + 1u) % r->len);
+		n++;
+	}
+	if (n != 0) {
+		__builtin_arm_dsb(0xf);
+		ipc_wr16(r->rp, cp.zc_alloc);
+		__builtin_arm_dsb(0xf);
+	}
+}
+
+/* the Internet checksum over n bytes, begun with sum */
+static uint16_t
+ip_sum(const uint8_t *p, uint32_t n, uint32_t sum)
+{
+	for (uint32_t i = 0; i + 1 < n; i += 2) {
+		sum += (uint32_t)p[i] << 8 | p[i + 1];
+	}
+	if (n & 1) {
+		sum += (uint32_t)p[n - 1] << 8;
+	}
+	while (sum >> 16) {
+		sum = (sum & 0xffff) + (sum >> 16);
+	}
+	return (uint16_t)~sum;
+}
+
+/* a packet from the CP (a copy, n >= 1 bytes of it): checked, counted, never passed on; the answers to our two */
+/* ---- cp_if=1: the data context as the network interface pdp_ip0 ---- */
+
+#define PDP_QUEUE               64u
+#define PDP_MTU                 1400u
+
+static LCK_GRP_DECLARE(pdp_lck_grp, "hakios.pdp");
+static LCK_MTX_DECLARE(pdp_lock, &pdp_lck_grp);
+
+/* up: packets the stack gave pdp_ip0, waiting for the modem's thread to put them in the data ring */
+static struct {
+	ifnet_t ifp;
+	uint16_t head, tail;
+	uint16_t len[PDP_QUEUE];
+	uint8_t pkt[PDP_QUEUE][DATA_MAX];
+	uint64_t in, in_bytes, out, out_bytes, dropped_in, dropped_out;
+	bool addressed, routed, capped;
+} pdp;
+
+/* cp_if_kb: the boot's budget through pdp_ip0, both ways; past it everything is dropped */
+static bool
+pdp_over_budget(uint32_t n)
+{
+	if (pdp.in_bytes + pdp.out_bytes + n <= (uint64_t)cp.if_kb * 1024) {
+		return false;
+	}
+	if (!pdp.capped) {
+		pdp.capped = true;
+		say("cp: pdp_ip0: the boot's budget of %u KB is used up (cp_if_kb): everything is dropped from now on\n", cp.if_kb);
+	}
+	return true;
+}
+
+static errno_t
+pdp_output(ifnet_t ifp, mbuf_t m)
+{
+	size_t n = mbuf_pkthdr_len(m);
+	uint16_t next;
+
+	lck_mtx_lock(&pdp_lock);
+	next = (uint16_t)((pdp.tail + 1) % PDP_QUEUE);
+	if (n < 20 || n > DATA_MAX || next == pdp.head || mbuf_copydata(m, 0, n, pdp.pkt[pdp.tail]) != 0) {
+		pdp.dropped_out++;
+		lck_mtx_unlock(&pdp_lock);
+		ifnet_stat_increment_out(ifp, 0, 0, 1);
+		mbuf_freem(m);
+		return 0;
+	}
+	pdp.len[pdp.tail] = (uint16_t)n;
+	pdp.tail = next;
+	lck_mtx_unlock(&pdp_lock);
+	ifnet_stat_increment_out(ifp, 1, (u_int32_t)n, 0);
+	mbuf_freem(m);
+	return 0;
+}
+
+/* the modem's thread: the waiting packets into the data ring of context DATA_CID */
+static void
+pdp_drain(void)
+{
+	static uint8_t b[DATA_MAX];
+
+	for (;;) {
+		uint16_t n;
+
+		lck_mtx_lock(&pdp_lock);
+		if (pdp.head == pdp.tail) {
+			lck_mtx_unlock(&pdp_lock);
+			return;
+		}
+		n = pdp.len[pdp.head];
+		memcpy(b, pdp.pkt[pdp.head], n);
+		pdp.head = (uint16_t)((pdp.head + 1) % PDP_QUEUE);
+		lck_mtx_unlock(&pdp_lock);
+		if ((b[0] >> 4) != 4 || pdp_over_budget(n) || !ring_send(RING_DATA, b, n, true, (CH_PDP0 + DATA_CID - 1u) << 16)) {
+			pdp.dropped_out++;
+		} else {
+			pdp.out++;
+			pdp.out_bytes += n;
+			cp.data_up++;
+			cp.data_up_bytes += n;
+		}
+		bzero(b, n);
+	}
+}
+
+/* down: an IPv4 packet of the context to the stack */
+static void
+pdp_input(const uint8_t *p, uint32_t n)
+{
+	struct ifnet_stat_increment_param st;
+	unsigned int chunks = 1;
+	mbuf_t m = NULL;
+
+	if (pdp.ifp == NULL || n == 0 || n > DATA_MAX || pdp_over_budget(n) ||
+	    mbuf_allocpacket(MBUF_DONTWAIT, n, &chunks, &m) != 0) {
+		pdp.dropped_in++;
+		return;
+	}
+	if (mbuf_copyback(m, 0, n, p, MBUF_DONTWAIT) != 0) {
+		mbuf_freem(m);
+		pdp.dropped_in++;
+		return;
+	}
+	mbuf_pkthdr_setrcvif(m, pdp.ifp);
+	mbuf_pkthdr_setheader(m, mbuf_data(m));
+	bzero(&st, sizeof(st));
+	st.packets_in = 1;
+	st.bytes_in = n;
+	pdp.in++;
+	pdp.in_bytes += n;
+	ifnet_input(pdp.ifp, m, &st);
+}
+
+static errno_t
+pdp_demux(__unused ifnet_t ifp, __unused mbuf_t m, __unused char *frame_header, protocol_family_t *protocol)
+{
+	*protocol = PF_INET;
+	return 0;
+}
+
+static errno_t
+pdp_add_proto(__unused ifnet_t ifp, protocol_family_t protocol, __unused const struct ifnet_demux_desc *d,
+    __unused u_int32_t n)
+{
+	return protocol == PF_INET ? 0 : ENOPROTOOPT;
+}
+
+static errno_t
+pdp_del_proto(__unused ifnet_t ifp, __unused protocol_family_t protocol)
+{
+	return 0;
+}
+
+static errno_t
+pdp_ioctl(ifnet_t ifp, u_long command, __unused void *data)
+{
+	switch (command) {
+	case SIOCSIFADDR:
+	case SIOCAIFADDR:
+	case SIOCSIFDSTADDR:
+		ifnet_set_flags(ifp, IFF_UP | IFF_RUNNING, IFF_UP | IFF_RUNNING);
+		return 0;
+	case SIOCSIFFLAGS:
+		ifnet_set_flags(ifp, (ifnet_flags(ifp) & IFF_UP) ? IFF_RUNNING : 0, IFF_RUNNING);
+		return 0;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		return 0;
+	default:
+		return EOPNOTSUPP;
+	}
+}
+
+static errno_t
+pdp_proto_input(__unused ifnet_t ifp, protocol_family_t protocol, mbuf_t m, __unused char *header)
+{
+	if (proto_input(protocol, m) != 0) {
+		mbuf_freem(m);
+	}
+	return 0;
+}
+
+static errno_t
+pdp_proto_pre_output(__unused ifnet_t ifp, protocol_family_t protocol, __unused mbuf_t *m,
+    __unused const struct sockaddr *dest, __unused void *route, char *frame_type, __unused char *link_layer_dest)
+{
+	*(protocol_family_t *)(void *)frame_type = protocol;
+	return 0;
+}
+
+/* pdp_ip0 made and attached once, the context's address put on it, a default route if asked and there is none */
+static void
+pdp_attach(void)
+{
+	struct ifnet_init_eparams init = {
+		.ver = IFNET_INIT_CURRENT_VERSION,
+		.len = sizeof(init),
+		.flags = IFNET_INIT_LEGACY | IFNET_INIT_NX_NOAUTO,
+		.uniqueid = "hakios-pdp0",
+		.uniqueid_len = 11,
+		.name = "pdp_ip",
+		.unit = 0,
+		.family = IFNET_FAMILY_CELLULAR,
+		.type = IFT_CELLULAR,
+		.output = pdp_output,
+		.demux = pdp_demux,
+		.add_proto = pdp_add_proto,
+		.del_proto = pdp_del_proto,
+		.ioctl = pdp_ioctl,
+	};
+	struct ifnet_attach_proto_param proto;
+	struct in_aliasreq ifra;
+	socket_t so = NULL;
+	ifnet_t ifp = NULL;
+	errno_t e;
+
+	if (pdp.ifp == NULL) {
+		if ((e = ifnet_allocate_extended(&init, &ifp)) != 0) {
+			say("cp: pdp_ip0 cannot be made: error %d\n", e);
+			cp.if_on = 0;
+			return;
+		}
+		ifnet_set_mtu(ifp, PDP_MTU);
+		ifnet_set_flags(ifp, IFF_POINTOPOINT | IFF_MULTICAST | IFF_NOARP, 0xffff);
+		ifnet_set_hdrlen(ifp, 0);
+		ifnet_set_addrlen(ifp, 0);
+		ifnet_set_baudrate(ifp, 50 * 1000 * 1000);
+		if ((e = ifnet_attach(ifp, NULL)) != 0) {
+			say("cp: pdp_ip0 cannot be attached: error %d\n", e);
+			ifnet_release(ifp);
+			cp.if_on = 0;
+			return;
+		}
+		bzero(&proto, sizeof(proto));
+		proto.input = pdp_proto_input;
+		proto.pre_output = pdp_proto_pre_output;
+		if ((e = ifnet_attach_protocol(ifp, PF_INET, &proto)) != 0) {
+			say("cp: pdp_ip0: IPv4 cannot be attached: error %d\n", e);
+		}
+		pdp.ifp = ifp;
+		say("cp: pdp_ip0 attached (IPv4, point to point, MTU %u): the data context %u's packets go through it\n", PDP_MTU,
+		    DATA_CID);
+	}
+	if (!pdp.addressed && sock_socket(PF_INET, SOCK_DGRAM, 0, NULL, NULL, &so) == 0) {
+		struct sockaddr_in *a = (struct sockaddr_in *)&ifra.ifra_addr;
+		struct sockaddr_in *d = (struct sockaddr_in *)&ifra.ifra_broadaddr;
+		struct sockaddr_in *m = (struct sockaddr_in *)&ifra.ifra_mask;
+
+		bzero(&ifra, sizeof(ifra));
+		strlcpy(ifra.ifra_name, "pdp_ip0", sizeof(ifra.ifra_name));
+		a->sin_len = d->sin_len = m->sin_len = sizeof(struct sockaddr_in);
+		a->sin_family = d->sin_family = m->sin_family = AF_INET;
+		memcpy(&a->sin_addr, cp.ip4, 4);
+		memcpy(&d->sin_addr, cp.ip4, 4);        /* point to point: the peer as the CP gives it, its own address */
+		m->sin_addr.s_addr = 0xffffffffu;
+		e = sock_ioctl(so, SIOCAIFADDR, &ifra);
+		pdp.addressed = e == 0;
+		say("cp: pdp_ip0: the context's IPv4 address (first octet %u; the rest not logged) put on it: %s (%d)\n", cp.ip4[0],
+		    e == 0 ? "done" : "FAILED", e);
+		sock_close(so);
+		so = NULL;
+	}
+	if (pdp.addressed && cp.route_on && !pdp.routed && sock_socket(PF_ROUTE, SOCK_RAW, AF_INET, NULL, NULL, &so) == 0) {
+		struct {
+			struct rt_msghdr h;
+			struct sockaddr_in dst;
+			struct sockaddr_dl gw;
+			struct sockaddr_in mask;
+		} msg;
+		struct iovec iov = { &msg, sizeof(msg) };
+		struct msghdr mh;
+		size_t sent = 0;
+
+		bzero(&msg, sizeof(msg));
+		msg.h.rtm_msglen = sizeof(msg);
+		msg.h.rtm_version = RTM_VERSION;
+		msg.h.rtm_type = RTM_ADD;
+		msg.h.rtm_flags = RTF_UP | RTF_STATIC;
+		msg.h.rtm_addrs = RTA_DST | RTA_GATEWAY | RTA_NETMASK;
+		msg.h.rtm_seq = 1;
+		msg.dst.sin_len = msg.mask.sin_len = sizeof(struct sockaddr_in);
+		msg.dst.sin_family = msg.mask.sin_family = AF_INET;
+		msg.gw.sdl_len = sizeof(msg.gw);
+		msg.gw.sdl_family = AF_LINK;
+		msg.gw.sdl_index = (u_short)ifnet_index(pdp.ifp);
+		msg.gw.sdl_type = IFT_CELLULAR;
+		bzero(&mh, sizeof(mh));
+		mh.msg_iov = &iov;
+		mh.msg_iovlen = 1;
+		e = sock_send(so, &mh, 0, &sent);
+		pdp.routed = e == 0;
+		say("cp: pdp_ip0: an IPv4 default route through it: %s (%d)\n", e == 0 ? "added" :
+		    e == EEXIST ? "there is one already (Wi-Fi's?): none added" : "FAILED", e);
+		sock_close(so);
+	}
+}
+
+static void
+data_received(uint8_t ch, const uint8_t *p, uint32_t n)
+{
+	uint32_t ihl, total, version = p[0] >> 4;
+
+	cp.data_packets++;
+	cp.data_bytes += n;
+	if (cp.data_packets <= 4) {
+		say("cp: from the CP on data channel %u: a packet of %u bytes, IP version %u, protocol %u (addresses not logged)\n",
+		    ch, n, version, version == 4 && n >= 20 ? p[9] : version == 6 && n >= 40 ? p[6] : 0);
+	}
+	if (version == 6 && n >= 40) {
+		cp.data_v6++;
+		return;
+	}
+	ihl = (p[0] & 0xfu) * 4u;
+	if (version != 4 || n < 20 || ihl < 20 || ihl > n) {
+		cp.data_bad++;
+		return;
+	}
+	total = (uint32_t)p[2] << 8 | p[3];
+	if (total < ihl || total > n || ip_sum(p, ihl, 0) != 0) {
+		cp.data_bad++;
+		return;
+	}
+	if (pdp.ifp != NULL && cp.have4 && memcmp(p + 16, cp.ip4, 4) == 0) {
+		pdp_input(p, total);            /* cp_if=1: to the stack (and still looked at below, for stage 7's own) */
+	}
+	if (!cp.have4 || memcmp(p + 16, cp.ip4, 4) != 0 || (p[6] & 0x3f) != 0 || p[7] != 0) {
+		cp.data_other++;                /* not to our address, or a fragment */
+		return;
+	}
+	if (p[9] == 1 && total >= ihl + 8) {
+		const uint8_t *c = p + ihl;
+
+		if (ip_sum(c, total - ihl, 0) != 0) {
+			cp.data_bad++;
+		} else if (c[0] == 0 && c[1] == 0 && memcmp(p + 12, cp.ping4, 4) == 0 && c[4] == (PING_ID >> 8) &&
+		    c[5] == (PING_ID & 0xff) && c[6] == 0 && c[7] == 1 && cp.ping_sent_ms != 0 && cp.ping_ms == 0) {
+			cp.ping_ms = MAX(now_ms() - cp.ping_sent_ms, 1);
+			say("cp: STAGE 7: THE ECHO REQUEST WAS ANSWERED after %llu ms (a reply of %u bytes, its checksums right)\n",
+			    cp.ping_ms, total);
+		} else {
+			cp.data_other++;
+		}
+	} else if (p[9] == 17 && total >= ihl + 8 + 12) {
+		const uint8_t *u = p + ihl;
+		uint32_t ulen = (uint32_t)u[4] << 8 | u[5];
+		uint32_t pseudo = ((uint32_t)p[12] << 8 | p[13]) + ((uint32_t)p[14] << 8 | p[15]) + ((uint32_t)p[16] << 8 | p[17]) +
+		    ((uint32_t)p[18] << 8 | p[19]) + 17u + ulen;
+
+		if (ulen < 8 + 12 || ulen > total - ihl || ((u[6] | u[7]) != 0 && ip_sum(u, ulen, pseudo) != 0)) {
+			cp.data_bad++;
+		} else if (u[0] == 0 && u[1] == 53 && ((uint32_t)u[2] << 8 | u[3]) == cp.dns_port && memcmp(p + 12, cp.dns4, 4) == 0 &&
+		    ((uint32_t)u[8] << 8 | u[9]) == cp.dns_id && (u[10] & 0x80) != 0 && cp.dns_sent_ms != 0 && cp.dns_ms == 0) {
+			cp.dns_ms = MAX(now_ms() - cp.dns_sent_ms, 1);
+			cp.dns_rcode = u[11] & 0xfu;
+			cp.dns_answers = (uint32_t)u[14] << 8 | u[15];
+			say("cp: STAGE 7: THE DNS QUESTION WAS ANSWERED after %llu ms: response code %u, %u answer records (%u bytes, "
+			    "its checksums right)\n", cp.dns_ms, cp.dns_rcode, cp.dns_answers, total);
+		} else {
+			cp.data_other++;
+		}
+	} else {
+		cp.data_other++;
+	}
+}
+
+
+/* what the CP put into the zero-copy slots */
+static void
+zc_receive(void)
+{
+	struct ring *r = &cp.dl[RING_DATA];
+	uint16_t fill;
+	uint32_t budget = 64;
+
+	if (cp.stage < 7 || r->len < 2 || r->size != 8 || cp.zc_pre >= r->len) {
+		return;
+	}
+	fill = ipc_rd16(r->wp);
+	if (fill >= r->len) {
+		cp.data_bad++;                  /* a counter of the CP's outside the ring */
+		return;
+	}
+	while (cp.zc_pre != fill && budget-- != 0) {
+		static uint8_t packet[DATA_MAX];
+		uint32_t word, n;
+		uint64_t offset = 0;
+
+		if (cp.zc_pre == cp.zc_alloc) {
+			cp.data_bad++;          /* a slot filled that was never offered */
+			break;
+		}
+		word = ipc_rd32(r->size_v + 4u * cp.zc_pre);
+		n = word & 0xffff;
+		memcpy(&offset, cp.ipc + r->buffers + (uint32_t)cp.zc_pre * 8u, 8);
+		if (offset != zc_offset(cp.zc_pre) || n == 0 || n > DATA_MAX) {
+			cp.data_bad++;          /* the slot's offset is not the one given, or no packet's length */
+		} else {
+			memcpy(packet, cp.ipc + zc_offset(cp.zc_pre), n);
+			data_received((uint8_t)(word >> 16), packet, n);
+			bzero(packet, n);
+		}
+		cp.zc_pre = (uint16_t)((cp.zc_pre + 1u) % r->len);
+	}
+	zc_offer();
+}
+
+/* one IPv4 packet of ours up through the data ring: the header made here, from the context's address */
+static bool
+data_send(uint8_t protocol, const uint8_t *to, const uint8_t *payload, uint32_t n)
+{
+	uint8_t packet[128];
+	uint16_t sum;
+
+	if (!cp.have4 || cp.data_step != 3 || n > sizeof(packet) - 20) {
+		return false;
+	}
+	bzero(packet, 20);
+	packet[0] = 0x45;
+	packet[2] = (uint8_t)((20 + n) >> 8);
+	packet[3] = (uint8_t)(20 + n);
+	packet[4] = (uint8_t)(cp.dns_id >> 8);
+	packet[5] = (uint8_t)(cp.dns_id + protocol);
+	packet[6] = 0x40;               /* not to be fragmented */
+	packet[8] = 64;
+	packet[9] = protocol;
+	memcpy(packet + 12, cp.ip4, 4);
+	memcpy(packet + 16, to, 4);
+	sum = ip_sum(packet, 20, 0);
+	packet[10] = (uint8_t)(sum >> 8);
+	packet[11] = (uint8_t)sum;
+	memcpy(packet + 20, payload, n);
+	if (!ring_send(RING_DATA, packet, 20 + n, true, (CH_PDP0 + DATA_CID - 1u) << 16)) {
+		return false;
+	}
+	cp.data_up++;
+	cp.data_up_bytes += 20 + n;
+	return true;
+}
+
+static void
+send_ping(void)
+{
+	uint8_t c[8 + 32];
+	uint16_t sum;
+
+	bzero(c, sizeof(c));
+	c[0] = 8;                       /* echo request */
+	c[4] = (uint8_t)(PING_ID >> 8);
+	c[5] = (uint8_t)PING_ID;
+	c[7] = 1;
+	for (uint32_t i = 0; i < 32; i++) {
+		c[8 + i] = (uint8_t)i;
+	}
+	sum = ip_sum(c, sizeof(c), 0);
+	c[2] = (uint8_t)(sum >> 8);
+	c[3] = (uint8_t)sum;
+	cp.ping_sent_ms = now_ms();
+	say("cp: STAGE 7: one echo request of %u bytes sent up (%s): %s\n", 20 + (uint32_t)sizeof(c), cp.ping_given ?
+	    "to the builder's cp_ping address" : "to the context's first DNS server", data_send(1, cp.ping4, c, sizeof(c)) ?
+	    "in the ring" : "NOT SENT");
+}
+
+static void
+send_dns(void)
+{
+	static const uint8_t question[] = { 7, 'e', 'x', 'a', 'm', 'p', 'l', 'e', 3, 'c', 'o', 'm', 0, 0, 1, 0, 1 };
+	uint8_t u[8 + 12 + sizeof(question)];
+	uint32_t pseudo, ulen = sizeof(u);
+	uint16_t sum;
+
+	bzero(u, sizeof(u));
+	u[0] = (uint8_t)(cp.dns_port >> 8);
+	u[1] = (uint8_t)cp.dns_port;
+	u[3] = 53;
+	u[4] = (uint8_t)(ulen >> 8);
+	u[5] = (uint8_t)ulen;
+	u[8] = (uint8_t)(cp.dns_id >> 8);
+	u[9] = (uint8_t)cp.dns_id;
+	u[10] = 0x01;                   /* recursion wanted */
+	u[13] = 1;                      /* one question */
+	memcpy(u + 20, question, sizeof(question));
+	pseudo = ((uint32_t)cp.ip4[0] << 8 | cp.ip4[1]) + ((uint32_t)cp.ip4[2] << 8 | cp.ip4[3]) + ((uint32_t)cp.dns4[0] << 8 |
+	    cp.dns4[1]) + ((uint32_t)cp.dns4[2] << 8 | cp.dns4[3]) + 17u + ulen;
+	sum = ip_sum(u, ulen, pseudo);
+	if (sum == 0) {
+		sum = 0xffff;
+	}
+	u[6] = (uint8_t)(sum >> 8);
+	u[7] = (uint8_t)sum;
+	cp.dns_sent_ms = now_ms();
+	say("cp: STAGE 7: one DNS question of %u bytes (the A record of example.com) sent up to the context's first DNS "
+	    "server: %s\n", 20 + ulen, data_send(17, cp.dns4, u, ulen) ? "in the ring" : "NOT SENT");
+}
+
+static void
+rings_receive(void)
+{
+	for (uint32_t i = 0; i < NRINGS; i++) {
+		struct ring *r = &cp.dl[i];
+		uint16_t wp, rp;
+
+		if (i == RING_DATA) {
+			zc_receive();
+			continue;
+		}
+		if (r->size < 64) {
+			continue;       /* the data ring of addresses: nothing can arrive, no buffers were given */
+		}
+		wp = ipc_rd16(r->wp);
+		rp = ipc_rd16(r->rp);
+		while (rp != wp && wp < r->len && rp < r->len) {
+			static uint8_t frame[4096];
+			uint32_t word = ipc_rd32(r->size_v + 4u * rp);
+			uint32_t n = word & 0xffff;
+			uint32_t hdr;
+
+			if (n > r->size) {
+				n = r->size;
+			}
+			if (i == RING_HIPRIO) {
+				/* a data ring: the packet itself, no frame header; its channel is in the size word's upper half */
+				memcpy(frame, cp.ipc + r->buffers + (uint32_t)rp * r->size, n);
+				rp = (uint16_t)((rp + 1) % r->len);
+				ipc_wr16(r->rp, rp);
+				cp.frames[i]++;
+				if (n == 0) {
+					cp.data_bad++;
+				} else {
+					data_received((uint8_t)(word >> 16), frame, n);
+				}
+				bzero(frame, n);
+				continue;
+			}
+			if (cp.more[i] != 0) {
+				/* the rest of a frame longer than one buffer (a file request with data): counted, not copied,
+				 * not looked into; with cp_nv=2 an NV write's bytes go to the RAM copy */
+				if (i == RING_RFS && cp.w_active) {
+					uint32_t k = MIN(n, cp.more[i]);
+
+					memcpy(frame, cp.ipc + r->buffers + (uint32_t)rp * r->size, k);
+					rfs_continued(frame, k);
+					bzero(frame, k);
+				}
+				cp.more[i] -= MIN(cp.more[i], n);
+				rp = (uint16_t)((rp + 1) % r->len);
+				ipc_wr16(r->rp, rp);
+				continue;
+			}
+			memcpy(frame, cp.ipc + r->buffers + (uint32_t)rp * r->size, n);
+			rp = (uint16_t)((rp + 1) % r->len);
+			ipc_wr16(r->rp, rp);
+			cp.frames[i]++;
+			hdr = n >= 1 && (frame[0] & 2) ? ((frame[0] & 3) == 3 ? 5 : 6) : 4;
+			if (n >= 6 && (frame[0] & 0xf8) == 0xf8) {
+				uint32_t total = hdr == 6 ? (uint32_t)(frame[2] | frame[3] << 8 | frame[4] << 16) | (uint32_t)frame[5] << 24 :
+				    (uint32_t)(frame[2] | frame[3] << 8);
+
+				if (total > n) {
+					cp.more[i] = total - n;
+				}
+			}
+			if (n >= 5 && (frame[0] & 0xf8) == 0xf8 && hdr == 5) {
+				/* a message cut into several frames ("multi frame": a fifth header byte, bit 7 "more to come"):
+				 * the CP's file requests with data come so. Only the first frame is looked into; the others are
+				 * data, counted and dropped (seen: taken for requests, their first bytes were printed) */
+				bool rest = cp.multi[i];
+
+				cp.multi[i] = (frame[4] & 0x80) != 0;
+				if (rest && i == RING_RFS && cp.w_active) {
+					rfs_continued(frame + hdr, n - hdr);
+				}
+				if (rest) {
+					cp.frames[i]--;
+					cp.dropped[i]++;
+					bzero(frame, n);
+					continue;
+				}
+			}
+			if (n < hdr || (frame[0] & 0xf8) != 0xf8) {
+				say("cp: from the CP on ring %u (%s): %u bytes that are no frame\n", i, ring_cfgs[i].name, n);
+			} else if (frame[1] == CH_FMT || frame[1] == 236) {
+				fmt_received(frame + hdr, n - hdr);
+			} else if (frame[1] == CH_RFS) {
+				rfs_received(frame + hdr, n - hdr);
+			} else {
+				say("cp: from the CP on channel %u (%s): a frame of %u bytes (not looked into)\n", frame[1],
+				    ring_cfgs[i].name, n);
+			}
+			bzero(frame, n);
+		}
+	}
+}
+
+/* ---- the CP's messages ---- */
+
+/* false when the CP said it crashed */
+static bool
+handle_msg(uint16_t v)
+{
+	if (!(v & MSG_VALID)) {
+		say("cp: the CP raised its message interrupt with %#x in its word (not a valid message)\n", v);
+		return true;
+	}
+	if (v & MSG_CMD) {
+		switch (v & 0x3f) {
+		case CMD_INIT_START:
+			say("cp: the CP says INIT_START (it runs its main program)\n");
+			write_rings();
+			send_msg(MSG_VALID | MSG_CMD | CMD_PIF_INIT_DONE);
+			say("cp: told the CP PIF_INIT_DONE\n");
+			break;
+		case CMD_PHONE_START:
+			cp.phone_starts++;
+			if (!cp.up) {
+				/* the link's words as Samsung's kernel sets them when the CP reports itself started */
+				ipc_wr32(IPC_ACCESS, 0);
+				ipc_wr32(IPC_MAGIC, 0);
+				ipc_wr32(IPC_RAW_TX_HEAD, 0);
+				ipc_wr32(IPC_RAW_TX_TAIL, 0);
+				ipc_wr32(IPC_RAW_RX_HEAD, 0);
+				ipc_wr32(IPC_RAW_RX_TAIL, 0);
+				ipc_wr32(8, 0);
+				ipc_wr32(12, 0);
+				ipc_wr32(16, 0);
+				ipc_wr32(20, 0);
+				ipc_wr32(IPC_MAGIC, MAGIC_IPC);
+				ipc_wr32(IPC_ACCESS, 1);
+				cp.up = true;
+				set_state(3);
+				say("cp: the CP says PHONE_START: THE CP IS UP (its state word %#x: state %u, active %u)\n",
+				    rd(cp.mbox, MBOX_ISSR(WORD_CP_STATE)), CP_STATE_STATUS(rd(cp.mbox, MBOX_ISSR(WORD_CP_STATE))),
+				    CP_STATE_ACTIVE(rd(cp.mbox, MBOX_ISSR(WORD_CP_STATE))));
+			} else if (cp.phone_starts < 5 || cp.phone_starts % 20 == 0) {
+				say("cp: the CP says PHONE_START again (%u times now)\n", cp.phone_starts);
+			}
+			cp.phone_start_ms = now_ms();
+			if (cp.link && !cp.link_acked) {
+				/* it has not taken INIT_END yet (it looks at the message word about every 100 ms): told again, as
+				 * Samsung's kernel does on every repeated PHONE_START */
+				send_msg(MSG_VALID | MSG_CMD | CMD_INIT_END);
+			}
+			if (!cp.link && cp.stage >= 4 && !cp.nv_loaded) {
+				if (cp.phone_starts == 1) {
+					say("cp: stage 4 REFUSED: the CP has no NV data of its own (zeros): INIT_END is not sent, its protocol "
+					    "stack is not started, the run stays at stage 3 (a CP with blank NV goes to its normal state by "
+					    "itself with a default identity and no calibration: never near a network)\n");
+				}
+			} else if (!cp.link && cp.stage >= 4) {
+				static const uint8_t lpm[2] = { 0x01, 0x00 };
+
+				cp.link = true;
+				set_state(4);
+				/* first, so that it is the first thing the CP finds when its stack starts: the radio off. It waits in
+				 * the ring; then INIT_END */
+				(void)fmt_send(0x01, 0x07, 0x01, lpm, sizeof(lpm));
+				send_msg(MSG_VALID | MSG_CMD | CMD_INIT_END);
+				cp.init_end_ms = cp.lpm_sent_ms = now_ms();
+				say("cp: \"LOW POWER MODE\" (the radio off) put in the ring for the CP, the first thing it will find; "
+				    "then told the CP INIT_END\n");
+			}
+			break;
+		case CMD_CRASH_RESET:
+		case CMD_CRASH_EXIT:
+			say("cp: THE CP SAYS IT CRASHED (%s)\n", (v & 0x3f) == CMD_CRASH_RESET ? "CRASH_RESET" : "CRASH_EXIT");
+			/* its reason, if it left text at the place Samsung's kernel reads one (the IPC memory's 2 KB at 2048 -
+			 * the old layout - or 63488): printable text only */
+			print_text("text at the IPC memory's 0x800:", cp.ipc + 0x800 + 4, 64);
+			print_text("text at the IPC memory's 0xF800:", cp.ipc + 0xf800 + 4, 64);
+			return false;
+		default:
+			say("cp: the CP sent command %#x (not one this driver knows)\n", v & 0x3f);
+			break;
+		}
+	}
+	if (cp.up && (v & MSG_DATA || !(v & MSG_CMD))) {
+		rings_receive();
+	}
+	return true;
+}
+
+/* the mailbox looked at once: false when the CP crashed */
+static bool
+poll_once(void)
+{
+	static uint32_t last_state = 0xffffffffu;
+	uint32_t pending = rd(cp.mbox, MBOX_INTSR0) & 0xffff0000u;
+	uint32_t state = rd(cp.mbox, MBOX_ISSR(WORD_CP_STATE));
+	bool alive = true;
+
+	if (pending != 0) {
+		uint16_t msg = (uint16_t)rd(cp.mbox, MBOX_ISSR(WORD_CP_MSG));
+
+		wr(cp.mbox, MBOX_INTCR0, pending);
+		if (pending & (1u << (16 + IRQ_CP_MSG))) {
+			alive = handle_msg(msg);
+		}
+		if (pending & ~(1u << (16 + IRQ_CP_MSG))) {
+			say("cp: the CP raised interrupts %#x (2 state, 3 active, 5-7 clock requests, 8 wake lock, 9 radio mode); "
+			    "its state word %#x, words 5-7 %#x %#x %#x\n", pending >> 16, state, rd(cp.mbox, MBOX_ISSR(5)),
+			    rd(cp.mbox, MBOX_ISSR(6)), rd(cp.mbox, MBOX_ISSR(7)));
+		}
+	}
+	if (state != last_state) {
+		say("cp: the CP's state word is now %#x (state %u, active %u)\n", state, CP_STATE_STATUS(state),
+		    CP_STATE_ACTIVE(state));
+		last_state = state;
+	}
+	if (cp.up) {
+		rings_receive();
+	}
+	return alive;
+}
+
+static bool
+start(void)
+{
+	uint64_t until;
+	uint32_t state = 0;
+
+	/* the mailbox as Samsung's kernel has it before the CP runs: every word 0, then the AP's state */
+	wr(cp.mbox, MBOX_INTMR0, 0xffff0000u);          /* its interrupts to the AP: looked at here, never delivered */
+	wr(cp.mbox, MBOX_INTCR0, 0xffff0000u);
+	wr(cp.mbox, MBOX_INTCR1, 0xffffu);
+	for (uint32_t i = 0; i < MBOX_WORDS; i++) {
+		wr(cp.mbox, MBOX_ISSR(i), 0);
+	}
+	wr(cp.mbox, MBOX_ISSR(WORD_AP_STATE), AP_STATE_REV(cp.rev) | AP_STATE_DS(cp.ds) | AP_STATE_PDA_ACTIVE);
+	say("cp: the mailbox cleared; the AP's state word %#x (revision %u, dual SIM field %u, PDA active)\n",
+	    rd(cp.mbox, MBOX_ISSR(WORD_AP_STATE)), cp.rev, cp.ds);
+
+	say("cp: the IPC memory before the start: magic %#x access %#x\n", ipc_rd32(IPC_MAGIC), ipc_rd32(IPC_ACCESS));
+
+	say("cp: AP2CP_CFG was %#x: writing 1, the CP's processor may run\n", rd(cp.cfg, 0));
+	cp.started = true;
+	wr(cp.cfg, 0, 1);
+	say("cp: AP2CP_CFG is %#x\n", rd(cp.cfg, 0));
+
+	until = now_ms() + 3000;
+	do {
+		state = rd(cp.mbox, MBOX_ISSR(WORD_CP_STATE));
+		if (CP_STATE_STATUS(state) != 0) {
+			break;
+		}
+		IOSleep(5);
+	} while (now_ms() < until);
+	if (CP_STATE_STATUS(state) == 0) {
+		say("cp: the CP did not report a state in 3 s (its word %#x)\n", state);
+		look_pmu("with the CP silent");
+		look_mbox("with the CP silent");
+		return false;
+	}
+	say("cp: THE CP'S BOOT LOADER RUNS: its state word %#x (state %u) %llu ms after the start\n", state,
+	    CP_STATE_STATUS(state), now_ms() - (until - 3000));
+
+	/* Android's order: only now, with the boot loader running, the old queues' pointers are zeroed and the magic
+	 * "BOOT" written (the boot loader clears the memory's first words itself when it starts: a magic written before
+	 * the start was gone, and the first question was never taken) */
+	say("cp: the IPC memory with the boot loader running: magic %#x access %#x, queue words %#x %#x %#x %#x\n",
+	    ipc_rd32(IPC_MAGIC), ipc_rd32(IPC_ACCESS), ipc_rd32(IPC_RAW_TX_HEAD), ipc_rd32(IPC_RAW_TX_TAIL),
+	    ipc_rd32(IPC_RAW_RX_HEAD), ipc_rd32(IPC_RAW_RX_TAIL));
+	for (uint32_t off = 8; off <= IPC_RAW_RX_TAIL; off += 4) {
+		ipc_wr32(off, 0);
+	}
+	ipc_wr32(IPC_MAGIC, MAGIC_BOOT);
+	__builtin_arm_dsb(0xf);
+	if (ipc_rd32(IPC_MAGIC) != MAGIC_BOOT) {
+		say("cp: the IPC memory's magic reads back %#x, not \"BOOT\"\n", ipc_rd32(IPC_MAGIC));
+		return false;
+	}
+	/* and the AP's "boot confirm": its own state field 1 in its state word. The boot loader takes no question
+	 * before it (seen: without it the first question lay in the queue untouched for 5 s) */
+	wr(cp.mbox, MBOX_ISSR(WORD_AP_STATE), rd(cp.mbox, MBOX_ISSR(WORD_AP_STATE)) | AP_STATE_STATUS(1));
+	say("cp: the magic \"BOOT\" written, the AP's state word now %#x (its state field 1: boot confirmed)\n",
+	    rd(cp.mbox, MBOX_ISSR(WORD_AP_STATE)));
+	if (!boot_ask(0x0000900d, 0x0000a00d) || !boot_ask(0x00009f00, 0x0000af00)) {
+		return false;
+	}
+	say("cp: the boot loader's handshake is complete; waiting for the CP's main program\n");
+
+	until = now_ms() + 15000;
+	while (!cp.up && now_ms() < until) {
+		if (!poll_once()) {
+			return false;
+		}
+		IOSleep(1);
+	}
+	if (!cp.up) {
+		say("cp: the CP's main program did not report itself in 15 s\n");
+		look_pmu("with no PHONE_START");
+		look_mbox("with no PHONE_START");
+		return false;
+	}
+	return true;
+}
+
+/* ---- stage 6: the data context ---- */
+
+
+/* one step of the data stage, called while the phone is registered: NULL while it goes on, else why it is over */
+static const char *
+data_stage(void)
+{
+	uint64_t now = now_ms();
+	uint8_t d[127];
+
+	bzero(d, sizeof(d));
+	switch (cp.data_step) {
+	case 0:
+		if (now - cp.registered_ms < 5000) {
+			return NULL;
+		}
+		/* the context defined: enable, the context's number, type 2, the access point's name in 124 bytes */
+		d[0] = 1;
+		d[1] = DATA_CID;
+		d[2] = 2;
+		strlcpy((char *)d + 3, cp.apn, 124);
+		say("cp: STAGE 6: defining data context %u with the builder's access point name (%u characters)\n", DATA_CID,
+		    (uint32_t)strlen(cp.apn));
+		cp.data_result = -1;
+		if (!fmt_send(0x0d, 0x01, 0x03, d, 127)) {
+			return "the data context's definition could not be sent";
+		}
+		cp.data_seq = cp.mseq;
+		cp.data_step = 1;
+		cp.data_ms = now;
+		return NULL;
+	case 1:
+		if (cp.data_result < 0) {
+			return now - cp.data_ms > 10000 ? "no answer to the data context's definition in 10 s" : NULL;
+		}
+		if (cp.data_result != 0x8000) {
+			say("cp: STAGE 6: THE CP REFUSED THE DEFINITION (result %#x): nothing else is tried\n", cp.data_result);
+			return "the CP refused the data context's definition";
+		}
+		/* accepted: the context activated: enable, the context's number, no user name, no password */
+		d[0] = 1;
+		d[1] = DATA_CID;
+		say("cp: STAGE 6: the definition is accepted; asking for the context's activation\n");
+		cp.data_result = -1;
+		if (!fmt_send(0x0d, 0x04, 0x03, d, 101)) {
+			return "the activation could not be sent";
+		}
+		cp.data_seq = cp.mseq;
+		cp.data_step = 2;
+		cp.data_ms = now;
+		return NULL;
+	case 2:
+		if (cp.data_result < 0) {
+			return now - cp.data_ms > 30000 ? "no answer to the activation in 30 s" : NULL;
+		}
+		if (cp.data_result != 0x8000) {
+			say("cp: STAGE 6: THE CP REFUSED THE ACTIVATION (result %#x): nothing else is tried\n", cp.data_result);
+			return "the CP refused the activation";
+		}
+		say("cp: STAGE 6: THE ACTIVATION IS ACCEPTED %llu ms after it was asked; watching it\n", now - cp.data_ms);
+		cp.data_step = 3;
+		cp.data_ms = now;
+		return NULL;
+	case 3:
+		if (cp.if_on && cp.have4) {
+			/* cp_if=1: the context stays; its packets go through pdp_ip0 until asked to stop */
+			static uint64_t next_try, next_say;
+
+			if ((pdp.ifp == NULL || !pdp.addressed || (cp.route_on && !pdp.routed && now - cp.data_ms < 60000)) &&
+			    now - cp.data_ms >= 1000 && now >= next_try) {
+				next_try = now + 5000;
+				pdp_attach();
+			}
+			pdp_drain();
+			if (next_say == 0) {
+				next_say = now + 60000;
+			} else if (now >= next_say) {
+				next_say = now + 60000;
+				say("cp: pdp_ip0: up %llu packets (%llu bytes), down %llu (%llu bytes), dropped %llu up %llu down\n", pdp.out,
+				    pdp.out_bytes, pdp.in, pdp.in_bytes, pdp.dropped_out, pdp.dropped_in);
+			}
+			return NULL;
+		}
+		if (cp.stage >= 7 && cp.have4) {
+			/* stage 7: our two packets, 2 and 3 s after the activation; done 5 s after it at the earliest */
+			if (cp.ping_sent_ms == 0 && now - cp.data_ms >= 2000) {
+				send_ping();
+			}
+			if (cp.dns_sent_ms == 0 && now - cp.data_ms >= 3000) {
+				send_dns();
+			}
+			if (now - cp.data_ms < 5000 || ((cp.ping_ms == 0 || cp.dns_ms == 0) && now - cp.data_ms < 12000)) {
+				return NULL;
+			}
+		} else if (now - cp.data_ms < (cp.stage >= 7 ? 6000 : 20000)) {
+			return NULL;
+		}
+		if (cp.stage >= 7 && !cp.have4) {
+			say("cp: STAGE 7: no IPv4 address and DNS server were read from the CP's address configuration: no packet "
+			    "is sent\n");
+		}
+		d[1] = DATA_CID;
+		say("cp: STAGE 6: %llu s with the context (%u status notes, %u address configurations, %u packets of %u bytes "
+		    "from the CP): asking for its deactivation\n", (now - cp.data_ms) / 1000, cp.data_notes, cp.data_configs,
+		    cp.data_packets, cp.data_bytes);
+		cp.data_result = -1;
+		if (!fmt_send(0x0d, 0x04, 0x03, d, 101)) {
+			return "the deactivation could not be sent";
+		}
+		cp.data_seq = cp.mseq;
+		cp.data_step = 4;
+		cp.data_ms = now;
+		return NULL;
+	case 4:
+		if (cp.data_result < 0 && now - cp.data_ms < 5000) {
+			return NULL;
+		}
+		if (cp.data_result < 0) {
+			say("cp: STAGE 6: no answer to the deactivation in 5 s (low power mode ends the context anyway)\n");
+		} else {
+			say("cp: STAGE 6: the deactivation's result %#x\n", cp.data_result);
+		}
+		cp.data_step = 5;
+		return "the data stage is over";
+	default:
+		return "the data stage is over";
+	}
+}
+
+static void
+print_state(void)
+{
+	say("cp: state %u; frames from the CP by ring:", cp.state);
+	for (uint32_t i = 0; i < NRINGS; i++) {
+		say(" %s %u", ring_cfgs[i].name, cp.frames[i]);
+	}
+	say("; control messages %u, file requests %u (%u answered: %u NV writes kept in RAM, %u NV reads; %u frames of other "
+	    "data dropped unread), PHONE_START %u times, last phone state %d\n", cp.fmt_messages, cp.rfs_requests,
+	    cp.rfs_answered, cp.nv_writes_kept, cp.nv_reads_answered, cp.dropped[3], cp.phone_starts, cp.phone_state);
+	if (cp.mbox != 0) {
+		look_mbox("now");
+		look_pmu("now");
+	}
+}
+
+static void
+cp_thread(__unused void *arg, __unused wait_result_t result)
+{
+	uint64_t until, asked = 0, kick = 0;
+	const char *why = NULL, *why5 = NULL;
+	bool alive = true;
+
+	thread_set_thread_name(current_thread(), "hakios.shannon");
+	/* not at once: the boot's own flood of lines would push these out of the log before the USB console has it */
+	IOSleep(cp.delay_s * 1000);
+	say("cp: stage %u asked for (1 a look, 2 load and check, 3 start, 4 the link, 5 the network)%s\n", cp.stage,
+	    cp.nv_file == 2 ? ", with EFS's nv_data.bin (RAM copy)" : cp.nv_file ? ", with the builder's nv_data.bin" :
+	    ", no non-volatile data (zeros)");
+
+	if (!memory_is_free()) {
+		set_state(101);
+		return;
+	}
+	cp.pmu = ml_io_map(CP_PMU_PA, CP_PMU_BYTES);
+	cp.mbox = ml_io_map(CP_MBOX_PA, 0x1000);
+	cp.cfg = ml_io_map(CP_CFG_PA, 0x1000);
+	cp.gicd = ml_io_map(CP_GICD_PA + 0x1000, 0x1000);       /* the page of the "set pending" words */
+	cp.mem = hakios_physmap_wc(CP_MEM_PA, CP_MEM_BYTES);
+	if (cp.pmu == 0 || cp.mbox == 0 || cp.cfg == 0 || cp.mem == 0) {
+		say("cp: a mapping failed (PMU %d, mailbox %d, AP2CP_CFG %d, the CP's memory %d)\n", cp.pmu != 0, cp.mbox != 0,
+		    cp.cfg != 0, cp.mem != 0);
+		set_state(101);
+		return;
+	}
+	cp.ipc = (uint8_t *)cp.mem + CP_IPC_OFFSET;
+
+	look_pmu("as found");
+	look_mbox("as found");
+	look_mem();
+	if (!read_toc()) {
+		set_state(101);
+		return;
+	}
+	set_state(1);
+	if (cp.stage < 2) {
+		say("cp: stage 1 done: looked, nothing changed\n");
+		return;
+	}
+
+	if (!load_and_check()) {
+		set_state(102);
+		look_pmu("after the failed load");
+		return;
+	}
+	set_state(2);
+	look_pmu("after the check");
+	if (cp.stage < 3) {
+		say("cp: stage 2 done: the image is loaded and accepted, the CP is not started\n");
+		return;
+	}
+
+	if (!start()) {
+		set_state(103);
+		cp_stop("the start did not complete");
+		return;
+	}
+
+	/* watching: everything the CP says, until the time is up or we are told to stop */
+	until = now_ms() + (uint64_t)cp.wait_s * 1000;
+	while (alive) {
+		int go = cp_go;
+
+		alive = poll_once();
+		if (cp.stop && (!cp.normal_asked || cp.back_asked)) {
+			why = "it was not in low power mode, or reported a registration state";
+			break;
+		}
+		if (cp.link && !cp.link_acked && now_ms() - cp.init_end_ms > 150 && now_ms() - cp.phone_start_ms > 350) {
+			cp.link_acked = true;
+			cp.lpm_sent_ms = now_ms();
+			say("cp: the CP has stopped repeating PHONE_START %llu ms after INIT_END: it took it, the link is up\n",
+			    now_ms() - cp.init_end_ms);
+		}
+		if (cp.link && !cp.link_acked && now_ms() - cp.init_end_ms > 4000) {
+			say("cp: the CP still repeats PHONE_START 4 s after INIT_END: it is stopped now\n");
+			why = "it did not take INIT_END";
+			break;
+		}
+		if (cp.link_acked && now_ms() >= kick && ipc_rd16(cp.ul[1].rp) != ipc_rd16(cp.ul[1].wp)) {
+			/* what we sent is still in the ring: the CP is told again that there is data (it may not have been
+			 * listening yet when it was first told) */
+			send_msg(MSG_VALID | MSG_DATA);
+			kick = now_ms() + 200;
+		}
+		if (cp.link_acked && cp.phone_state != 1 && !cp.normal_asked && now_ms() - cp.lpm_sent_ms > 5000) {
+			say("cp: no \"low power mode\" from the CP 5 s after it was asked (its last phone state: %d): it is stopped now\n",
+			    cp.phone_state);
+			why = "it did not confirm low power mode";
+			break;
+		}
+		if (cp.stage >= 5 && cp.link_acked && cp.phone_state == 1 && !cp.normal_asked && cp.version_answered) {
+			/* stage 5, step 1: the SIM's status, read in low power mode */
+			uint64_t waited = now_ms() - cp.lpm_sent_ms;
+
+			if ((cp.sim_status == 0x82 || cp.sim_status == 0x83) && now_ms() - cp.sim_ms > 2000) {
+				say("cp: STAGE 5: the SIM is ready (status %#x) and the CP is in low power mode: asking for NORMAL mode "
+				    "(the radio on; the phone will register on its network)\n", cp.sim_status);
+				cp.normal_asked = true;
+				cp.normal_ms = now_ms();
+				until = cp.normal_ms + 100000;          /* 100 s to register, at most */
+				ask_phone_state(2);
+			} else if (cp.sim_status >= 1 && cp.sim_status <= 8 && now_ms() - cp.sim_ms > 3000) {
+				say("cp: STAGE 5: the SIM is locked (status %#x: it wants a PIN or PUK). NO attempt is made. Staying in low "
+				    "power mode and stopping\n", cp.sim_status);
+				why5 = "the SIM is locked";
+				break;
+			} else if (waited > 20000) {
+				say("cp: STAGE 5: no SIM ready 20 s after the link came up (its last status %#x; 0x80 no card, 0x81 card "
+				    "error, 0 initialising): normal mode is NOT asked for\n", cp.sim_status);
+				why5 = "no SIM ready";
+				break;
+			}
+		}
+		if (cp.normal_asked && !cp.back_asked) {
+			/* stage 5, steps 2 and 3: registered for two minutes, or not in time, then low power again */
+			const char *back = NULL;
+
+			if (cp.registered_ms != 0 && now_ms() - cp.registered_ms > 120000 && !cp.if_on) {
+				back = "registered for two minutes";
+			} else if (cp.registered_ms == 0 && now_ms() - cp.normal_ms > 90000) {
+				back = "NOT registered 90 s after normal mode was asked for";
+				why5 = "not registered in time";
+			} else if (cp.registered_ms != 0 && cp.reg_state != 2 && cp.reg_state != 6 &&
+			    now_ms() - cp.registered_ms > 5000) {
+				back = "the registration was lost";
+				why5 = "registration lost";
+			} else if (cp.stop || go == 2) {
+				back = "asked to stop";
+			}
+			if (back == NULL && cp.stage >= 6 && cp.apn[0] != 0 && cp.registered_ms != 0) {
+				back = data_stage();
+			}
+			if (back != NULL) {
+				say("cp: STAGE 5: %s (last registration state %d, %u changes, %u signal reports): asking for LOW POWER MODE\n",
+				    back, cp.reg_state, cp.reg_changes, cp.signals);
+				cp.back_asked = true;
+				cp.back_ms = now_ms();
+				cp.phone_state = -1;
+				cp.stop = false;
+				until = cp.back_ms + 12000;
+				ask_phone_state(1);
+			} else {
+				until = now_ms() + 30000;       /* the stage's own clocks decide */
+			}
+		}
+		if (cp.back_asked && cp.phone_state == 1 && now_ms() - cp.back_ms > 1500) {
+			say("cp: STAGE 5: the CP is in low power mode again %llu ms after it was asked\n", now_ms() - cp.back_ms);
+			break;
+		}
+		if (go != 0) {
+			cp_go = 0;
+			if (go == 1) {
+				print_state();
+			} else if (go == 2 && !cp.normal_asked) {
+				break;                          /* (in normal mode: low power is asked for first, above) */
+			} else if (go == 3 && cp.link) {
+				ask_version();
+			}
+		}
+		if (cp.link_acked && cp.phone_state == 1 && asked == 0) {
+			asked = now_ms() + 2000;        /* only once it has said it is in low power mode */
+		}
+		if (asked > 1 && now_ms() >= asked) {
+			asked = 1;
+			ask_version();
+		}
+		if (cp.sim_probe != 0 && !cp.sim_asked && cp.version_answered && cp.phone_state == 1 && !cp.normal_asked &&
+		    cp.sim_status == 0x83 && now_ms() - cp.sim_ms > 2000) {
+			/* (only once the SIM says "all its files are ready", 0x83: asked 2 s after "ready", 0x82, the read was
+			 * refused with result 0x8001)
+			 * Samsung IPC's SIM group (0x05), number 5 "get": the command (0xB0: read), the file (0x6FAD, low byte
+			 * first), three parameters (offset 0, 0, 4 bytes): the public numbering's layout for older modems */
+			static const uint8_t read_ad[6] = { 0xb0, 0xad, 0x6f, 0x00, 0x00, 0x04 };
+
+			cp.sim_asked = true;
+			say("cp: one SIM file read asked (EF_AD, 4 bytes, no identity in it)\n");
+			(void)fmt_send(0x05, 0x05, 0x02, read_ad, sizeof(read_ad));
+		}
+		if (cp.version_answered && !cp.bands_asked && cp.phone_state == 1) {
+			cp.bands_asked = true;
+			ask_bands();
+		}
+		if (now_ms() >= until) {
+			break;
+		}
+		IOSleep(1);
+	}
+	if (cp.normal_asked) {
+		say("cp: STAGE 5 SUMMARY: normal mode asked; registered: %s; last registration state %d; %u changes of it; %u "
+		    "signal reports; low power again: %s; NV writes the CP asked for and that were dropped: %u\n",
+		    cp.registered_ms != 0 ? "YES" : "no", cp.reg_state, cp.reg_changes, cp.signals,
+		    cp.back_asked && cp.phone_state == 1 ? "confirmed" : "NOT confirmed", cp.writes_dropped);
+	}
+	if (cp.data_step != 0) {
+		say("cp: STAGE 6 SUMMARY: the data stage got to step %u (1 defined, 2 activation asked, 3 active, 4 deactivation "
+		    "asked, 5 over); %u status notes, %u address configurations, %u packets of %u bytes from the CP on the data "
+		    "channels\n", cp.data_step, cp.data_notes, cp.data_configs, cp.data_packets,
+		    cp.data_bytes);
+	}
+	if (cp.stage >= 7 && cp.data_step != 0) {
+		say("cp: STAGE 7 SUMMARY: up %u packets of %u bytes; down %u packets of %u bytes: echo %s (%llu ms), DNS %s (%llu ms, "
+		    "response code %u, %u answers), not ours %u, IPv6 %u, MALFORMED %u; the zero-copy ring's next slot to offer %u, to "
+		    "take %u\n", cp.data_up, cp.data_up_bytes, cp.data_packets, cp.data_bytes, cp.ping_ms != 0 ? "ANSWERED" :
+		    "not answered", cp.ping_ms, cp.dns_ms != 0 ? "ANSWERED" : "not answered", cp.dns_ms, cp.dns_rcode,
+		    cp.dns_answers, cp.data_other, cp.data_v6, cp.data_bad, cp.zc_alloc, cp.zc_pre);
+	}
+	bzero(cp.ip4, sizeof(cp.ip4));
+	bzero(cp.dns4, sizeof(cp.dns4));
+	cp.have4 = false;
+	print_state();
+	cp_stop(!alive ? "it crashed" : why != NULL ? why : why5 != NULL ? why5 : "the watch is over, or asked to");
+	set_state(alive && why == NULL ? 200 : 104);
+}
+
+/* loader_return(): the CP in reset before the phone is handed back, if this run started it */
+void hakios_shannon_quiesce(void);
+void
+hakios_shannon_quiesce(void)
+{
+	if (cp.started) {
+		cp_go = 2;
+		for (uint32_t i = 0; i < 300 && cp.started; i++) {
+			IOSleep(10);
+		}
+	}
+}
+
+void hakios_shannon_init(void);
+void
+hakios_shannon_init(void)
+{
+	thread_t thread;
+	uint32_t n = 0;
+
+	if (!PE_parse_boot_argn("cp", &n, sizeof(n)) || n == 0) {
+		return;
+	}
+	cp.stage = n > 7 ? 7 : n;
+	cp.rev = 26;
+	cp.wait_s = cp.stage >= 4 ? 25 : 20;
+	cp.delay_s = 30;
+	cp.phone_state = cp.sim_status = cp.reg_state = -1;
+	cp.vss_on = 1;
+	PE_parse_boot_argn("cp_nv", &cp.nv_file, sizeof(cp.nv_file));
+	PE_parse_boot_argn("cp_if", &cp.if_on, sizeof(cp.if_on));
+	PE_parse_boot_argn("cp_route", &cp.route_on, sizeof(cp.route_on));
+	cp.if_kb = 2048;
+	PE_parse_boot_argn("cp_if_kb", &cp.if_kb, sizeof(cp.if_kb));
+	PE_parse_boot_argn("cp_vss", &cp.vss_on, sizeof(cp.vss_on));
+	PE_parse_boot_argn("cp_rev", &cp.rev, sizeof(cp.rev));
+	PE_parse_boot_argn("cp_ds", &cp.ds, sizeof(cp.ds));
+	PE_parse_boot_argn("cp_wait", &cp.wait_s, sizeof(cp.wait_s));
+	PE_parse_boot_argn("cp_delay", &cp.delay_s, sizeof(cp.delay_s));
+	PE_parse_boot_argn("cp_sim", &cp.sim_probe, sizeof(cp.sim_probe));
+	if (PE_parse_boot_argn("cp_apn", cp.apn, sizeof(cp.apn))) {
+		cp.apn[sizeof(cp.apn) - 1] = 0;
+		for (uint32_t i = 0; cp.apn[i] != 0; i++) {
+			char c = cp.apn[i];
+
+			if (!((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '.' || c == '-')) {
+				cp.apn[0] = 0;          /* not a name: no stage 6 */
+				break;
+			}
+		}
+	}
+	cp.data_result = -1;
+	{
+		char text[20] = "";
+		uint32_t part = 0, value = 0, digits = 0;
+		bool good = PE_parse_boot_argn("cp_ping", text, sizeof(text));
+
+		/* A.B.C.D, four numbers of at most 255 */
+		text[sizeof(text) - 1] = 0;
+		for (uint32_t i = 0; good; i++) {
+			char c = text[i];
+
+			if (c >= '0' && c <= '9') {
+				value = value * 10 + (uint32_t)(c - '0');
+				good = ++digits <= 3 && value <= 255;
+			} else if (((c == '.' && part < 3) || (c == 0 && part == 3)) && digits != 0) {
+				cp.ping4[part++] = (uint8_t)value;
+				value = digits = 0;
+				if (c == 0) {
+					break;
+				}
+			} else {
+				good = false;
+			}
+		}
+		cp.ping_given = good && part == 4 && cp.ping4[0] != 0 && cp.ping4[0] != 127 && cp.ping4[0] < 224;
+	}
+	cp.dns_id = (uint16_t)(mach_absolute_time() >> 4);
+	cp.dns_port = (uint16_t)(0xc000u | (mach_absolute_time() & 0x3fffu));
+	if (cp.delay_s > 600) {
+		cp.delay_s = 600;
+	}
+	if (cp.wait_s > 600) {
+		cp.wait_s = 600;
+	}
+	if (kernel_thread_start(cp_thread, NULL, &thread) == KERN_SUCCESS) {
+		thread_deallocate(thread);
+	} else {
+		say("cp: no thread\n");
+	}
+}
diff --git a/profiles/ios-27.copy b/profiles/ios-27.copy
index 67fea6e05..3e1916d5e 100644
--- a/profiles/ios-27.copy
+++ b/profiles/ios-27.copy
@@ -27,3 +27,5 @@ drivers/wifi/hakios.sta.c bsd/dev/hakios.sta.c
 drivers/wifi/hakios.apple80211.c bsd/dev/hakios.apple80211.c
 drivers/wifi/hakios.wlan.cpp iokit/Kernel/hakios.wlan.cpp
 drivers/net/hakios.net.c bsd/dev/hakios.net.c
+drivers/modem/hakios.shannon.c bsd/dev/hakios.shannon.c
+drivers/modem/hakios.ext4ro.h bsd/sys/hakios.ext4ro.h
diff --git a/tools/apn-table.py b/tools/apn-table.py
new file mode 100755
index 000000000..a313db374
--- /dev/null
+++ b/tools/apn-table.py
@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT-0
+"""The access point names of the world's mobile networks, from Android's public list, as a table to choose from.
+
+  apn-table.py fetch  OUT.xml                 the list, from its public repository at the pinned commit, hash checked
+  apn-table.py table  IN.xml OUT.tbl          the "default" (internet) entries as a compact table
+  apn-table.py select IN.tbl --mcc 272 --mnc 03 [--spn NAME] [--gid1 HEX] [--imsi DIGITS] [--iccid DIGITS]
+                                              the entry Android's rules choose for such a SIM, or why none
+
+A phone's data connection needs the name of the operator's access point (the APN). Nothing in the modem knows it:
+Android ships a list of every network's, device/sample/etc/apns-full-conf.xml (Apache-2.0, The Android Open Source
+Project), and chooses from it by what the SIM says. This tool takes that list exactly as published (a pinned commit,
+its SHA-256 checked; entries are never edited here) and makes the table a driver or a small helper searches. The
+list is not in this repository and neither is the table: both are made when an image is built. An image that
+carries the table carries data derived from the list: NOTICE and THIRD_PARTY_LICENSES.md have its row.
+
+THE CHOICE (Android's, android.telephony.data.ApnSetting and the telephony provider's rules, as facts):
+  1. the entries whose mcc and mnc are the SIM's own (the first digits of its subscriber number; how many digits
+     the mnc has is in the SIM's EF_AD), of type "default" (an entry with no type, or "*", serves every type);
+  2. an entry may be for one brand on a network (an MVNO): mvno_type says what tells the brand, mvno_match_data
+     its value: "spn" the SIM's service provider name (compared without case), "gid" the first bytes of its
+     group identifier (hex, without case), "imsi" a pattern of leading digits of the subscriber number ('x' any
+     digit), "iccid" leading digits of the card's number;
+  3. if any brand entry matches the SIM, only brand entries are candidates; otherwise only the entries with no
+     brand. The more specific match wins;
+  4. HERE, one step stricter than Android (which then lets the user pick): if the candidates do not all name the
+     same access point, protocol and credentials, none is chosen. No guess: no data connection, and a line saying so.
+
+What is compared with the SIM (its name, group identifier, the leading digits of its numbers) is read from the SIM,
+used for the comparison and forgotten: a chooser logs the chosen entry's carrier name and access point, never the
+SIM's values. ("select" takes them on its command line for tests with made-up values only.)
+
+THE TABLE (little-endian; every length is checked by a reader before use)
+  header   "SAPN", u8 version (1), 3 x 0, u32 rows, u32 bytes of all rows, the list's SHA-256 (32 bytes)
+  a row    u16 its length, u16 mcc, u16 mnc, u8 digits of the mnc (2 or 3), u8 brand kind (0 none, 1 spn, 2 imsi,
+           3 gid, 4 iccid), u8 protocol and u8 roaming protocol (0 IP, 1 IPV6, 2 IPV4V6), u8 authentication
+           (0 none, 1 PAP, 2 CHAP, 3 either; 255 not given), u8 0, then five strings, each a length byte and
+           that many bytes: carrier name, access point name, brand value, user name, password
+  rows are in the order of (mcc, mnc), then the list's.
+"""
+import base64
+import hashlib
+import struct
+import sys
+import urllib.request
+import xml.etree.ElementTree as ET
+
+PIN_REPO = 'https://android.googlesource.com/device/sample'
+PIN_COMMIT = '73f904fbeb872f5675cb5f18cd9dfb15856425a6'
+PIN_PATH = 'etc/apns-full-conf.xml'
+PIN_SHA256 = '9e44015793ec01d0773123103dca19b181fbc5fdd43cfc1b1d5cfacbda622726'
+
+KINDS = {'': 0, 'spn': 1, 'imsi': 2, 'gid': 3, 'iccid': 4}
+PROTOCOLS = {'IP': 0, 'IPV6': 1, 'IPV4V6': 2}
+HEADER = struct.Struct('<4sB3xII32s')
+ROW = struct.Struct('<HHHBBBBBB')
+
+
+def fetch(out):
+    url = '%s/+/%s/%s?format=TEXT' % (PIN_REPO, PIN_COMMIT, PIN_PATH)
+    data = base64.b64decode(urllib.request.urlopen(url, timeout=120).read())
+    check(data, url)
+    open(out, 'wb').write(data)
+    print('%s: %d bytes, sha256 as pinned (%s at %s)' % (out, len(data), PIN_PATH, PIN_COMMIT[:12]))
+
+
+def check(data, where):
+    got = hashlib.sha256(data).hexdigest()
+    if got != PIN_SHA256:
+        sys.exit('%s: sha256 %s is not the pinned list (%s)' % (where, got, PIN_SHA256))
+
+
+def text(value, what):
+    raw = (value or '').encode('utf-8')
+    if len(raw) > 255:
+        sys.exit('%s longer than 255 bytes' % what)
+    return bytes([len(raw)]) + raw
+
+
+def table(source, out):
+    data = open(source, 'rb').read()
+    check(data, source)
+    rows = []
+    for order, apn in enumerate(ET.fromstring(data).iter('apn')):
+        get = lambda name: (apn.get(name) or '').strip()
+        kinds = [k.strip() for k in get('type').split(',') if k.strip()]
+        if kinds and 'default' not in kinds and '*' not in kinds:
+            continue
+        if get('carrier_enabled').lower() in ('false', '0') or not get('apn'):
+            continue
+        mcc, mnc = get('mcc'), get('mnc')
+        if not (mcc.isdigit() and len(mcc) == 3 and mnc.isdigit() and len(mnc) in (2, 3)):
+            continue
+        kind = get('mvno_type').lower()
+        if kind not in KINDS:
+            sys.exit('entry %d: mvno_type %r is not one this table knows' % (order, kind))
+        protocol = PROTOCOLS.get(get('protocol') or 'IP')
+        roaming = PROTOCOLS.get(get('roaming_protocol') or get('protocol') or 'IP')
+        if protocol is None or roaming is None:
+            sys.exit('entry %d: a protocol this table does not know' % order)
+        auth = int(get('authtype')) if get('authtype') not in ('', '-1') else 255
+        strings = b''.join((text(get('carrier'), 'a carrier name'), text(get('apn'), 'an access point name'),
+                            text(get('mvno_match_data'), 'a brand value'), text(get('user'), 'a user name'),
+                            text(get('password'), 'a password')))
+        row = ROW.pack(ROW.size + len(strings), int(mcc), int(mnc), len(mnc), KINDS[kind], protocol, roaming,
+                       auth, 0) + strings
+        rows.append(((int(mcc), int(mnc), len(mnc), order), row))
+    rows.sort(key=lambda r: r[0])
+    body = b''.join(row for _, row in rows)
+    open(out, 'wb').write(HEADER.pack(b'SAPN', 1, len(rows), len(body), hashlib.sha256(data).digest()) + body)
+    print('%s: %d default entries, %d bytes' % (out, len(rows), HEADER.size + len(body)))
+
+
+def read(path):
+    blob = open(path, 'rb').read()
+    if len(blob) < HEADER.size:
+        sys.exit('%s: too short for a table' % path)
+    magic, version, count, size, _ = HEADER.unpack_from(blob)
+    if magic != b'SAPN' or version != 1 or HEADER.size + size != len(blob):
+        sys.exit('%s: not a version 1 table of its stated size' % path)
+    at, rows = HEADER.size, []
+    for _ in range(count):
+        if at + ROW.size > len(blob):
+            sys.exit('%s: a row beyond the table' % path)
+        length, mcc, mnc, digits, kind, protocol, roaming, auth, _ = ROW.unpack_from(blob, at)
+        if length < ROW.size + 5 or at + length > len(blob):
+            sys.exit('%s: a row of a wrong length' % path)
+        p, strings = at + ROW.size, []
+        for _ in range(5):
+            if p >= at + length or p + 1 + blob[p] > at + length:
+                sys.exit('%s: a string beyond its row' % path)
+            strings.append(blob[p + 1:p + 1 + blob[p]].decode('utf-8'))
+            p += 1 + blob[p]
+        rows.append(dict(mcc=mcc, mnc=mnc, digits=digits, kind=kind, protocol=protocol, roaming=roaming, auth=auth,
+                         carrier=strings[0], apn=strings[1], brand=strings[2], user=strings[3], password=strings[4]))
+        at += length
+    return rows
+
+
+def brand_matches(row, spn, gid1, imsi, iccid):
+    value = row['brand']
+    if row['kind'] == 1:
+        return spn is not None and spn.lower() == value.lower()
+    if row['kind'] == 2:
+        return imsi is not None and len(value) <= len(imsi) and all(c in 'xX' or c == d for c, d in zip(value, imsi))
+    if row['kind'] == 3:
+        return gid1 is not None and gid1.lower().startswith(value.lower()) and value != ''
+    if row['kind'] == 4:
+        return iccid is not None and any(p and iccid.startswith(p) for p in value.split(','))
+    return False
+
+
+def choose(rows, mcc, mnc, digits, spn=None, gid1=None, imsi=None, iccid=None):
+    """The chosen row, or None and the reason."""
+    mine = [r for r in rows if r['mcc'] == mcc and r['mnc'] == mnc and r['digits'] == digits]
+    if not mine:
+        return None, 'the list has no default entry for this network'
+    brand = [r for r in mine if r['kind'] != 0 and brand_matches(r, spn, gid1, imsi, iccid)]
+    candidates = brand or [r for r in mine if r['kind'] == 0]
+    if not candidates:
+        return None, "the list's entries for this network are all for brands, and none is this SIM's"
+    same = {(r['apn'].lower(), r['protocol'], r['user'], r['password'], r['auth']) for r in candidates}
+    if len(same) != 1:
+        return None, '%d entries with different access points fit this SIM equally: none is chosen' % len(candidates)
+    return candidates[0], 'a brand entry' if brand else "the network's own entry"
+
+
+def select(argv):
+    rows = read(argv[0])
+    options = dict(zip(argv[1::2], argv[2::2]))
+    mnc = options.get('--mnc', '')
+    if not (options.get('--mcc', '').isdigit() and mnc.isdigit() and len(mnc) in (2, 3)):
+        sys.exit('select: --mcc NNN and --mnc NN or NNN')
+    row, why = choose(rows, int(options['--mcc']), int(mnc), len(mnc), options.get('--spn'), options.get('--gid1'),
+                      options.get('--imsi'), options.get('--iccid'))
+    if row is None:
+        sys.exit('no access point chosen: ' + why)
+    print('chosen (%s): carrier "%s", access point "%s", protocol %s, user name %s' % (
+        why, row['carrier'], row['apn'], ['IP', 'IPV6', 'IPV4V6'][row['protocol']], 'given' if row['user'] else 'none'))
+
+
+def main():
+    if len(sys.argv) == 3 and sys.argv[1] == 'fetch':
+        fetch(sys.argv[2])
+    elif len(sys.argv) == 4 and sys.argv[1] == 'table':
+        table(sys.argv[2], sys.argv[3])
+    elif len(sys.argv) >= 7 and sys.argv[1] == 'select':
+        select(sys.argv[2:])
+    else:
+        sys.exit(__doc__)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/tools/ios27/fullroot/check-root.sh b/tools/ios27/fullroot/check-root.sh
index eca74abac..b8a376668 100755
--- a/tools/ios27/fullroot/check-root.sh
+++ b/tools/ios27/fullroot/check-root.sh
@@ -67,5 +67,19 @@ n=0; while IFS= read -r l; do h=${l%% *}; f=${l#*  }; f=${f#./}; [[ $(shasum -a
 [[ $n == 0 ]] && ok "overlay files all present with matching sha256" || bad "$n overlay files differ"
 r=$("$PY" -I "${IOS27_PIPELINE:-$H/pipeline}/root/macho-rewrite.py" "${IOS27_PIPELINE:-$H/pipeline}/cache/a64e-rewrite.py" "$R" --dry-run 2>&1 | tail -1); echo "info  Mach-O a64e dry run: $r"
 case $r in *"'ret': 0, 'br': 0, 'blr': 0, 'pac': 0,"*"errors 0") ok "Mach-O a64e rewrite is complete (0 sites left, 0 errors)";; *) bad "Mach-O a64e rewrite incomplete";; esac
+# the package manager (steps.d/60-sileo.sh): all of it or none of it, and nothing it must not bring
+if [[ -d $R/jb ]]; then
+    for f in jb/Applications/Sileo.app/Sileo jb/usr/bin/dpkg jb/usr/bin/apt-get jb/prep.sh jb/.scion-stamp usr/local/bin/jb_seed usr/local/bin/var_sync; do
+        [[ -e $R/$f ]] && ok "present $f" || bad "missing $f"; done
+    for c in chmod cp mkdir mv rm; do [[ $(readlink "$R/bin/$c" 2>/dev/null) == /var/jb/usr/bin/$c ]] && ok "/bin/$c -> the prefix" || bad "/bin/$c is not the prefix's link"; done
+    [[ $(/usr/bin/python3 "$H/../sileo/jobs.py" "$R" list | grep -c ' present$') -ge 2 ]] && ok "launchd jobs com.scion.jbseed, com.scion.varsync" || bad "the prefix's launchd jobs are not in launchd.plist"
+    /usr/bin/python3 "$H/../sileo/jobs.py" "$R" list | grep -q 'sileotest.plist present' && info "com.scion.sileotest is on this root: a TEST root (SILEO_SELFTEST=1), not a release"
+    [[ ! -e $R/jb/usr/sbin/sshd && ! -e $R/jb/usr/lib/TweakLoader.dylib ]] && ok "no OpenSSH, no tweak injection in the prefix" || bad "OpenSSH or tweak injection is in the prefix"
+    [[ -z $(awk -F: '!/^#/ && NF >= 10 && $2 != "*" && $2 != "!"' "$R/jb/etc/master.passwd") ]] && ok "no account with a password in the prefix" || bad "an account with a password is in the prefix"
+    [[ -z $(find "$R/jb" ! -type l -perm -0002 | head -1) ]] && ok "nothing writable by everybody in the prefix" || bad "files writable by everybody in the prefix"
+    [[ $(stat -f %u "$R/jb/Applications/Sileo.app/giveMeRoot") == 0 ]] && ok "the prefix is root's" || info "the prefix is not root's on this mount (no owners, or made without root): jb_seed makes it so on the phone"
+else
+    info "no package manager on this root (ENABLE_SILEO=0)"
+fi
 df -h "$R" | tail -1 | sed 's/^/info  /'; echo "info  inodes/files: $(find "$R" -xdev 2>/dev/null | wc -l | tr -d ' ') entries"
 [[ $fail == 0 ]] && echo "CHECK-ROOT: ALL HARD CHECKS PASSED" || echo "CHECK-ROOT: FAILURES"; exit $fail
diff --git a/tools/ios27/fullroot/steps.d/60-sileo.sh b/tools/ios27/fullroot/steps.d/60-sileo.sh
new file mode 100755
index 000000000..113d7fe21
--- /dev/null
+++ b/tools/ios27/fullroot/steps.d/60-sileo.sh
@@ -0,0 +1,198 @@
+#!/bin/bash
+# SPDX-License-Identifier: MIT-0
+# 60-sileo.sh ROOT [undo] : the package manager on an iOS 27 root, as the 16.5 line has it by default: the Procursus
+# bootstrap with Sileo in it (tools/mk-jb.sh: both fetched from apt.procurs.us, both pinned by SHA-256), rootless, all of
+# it under /var/jb. Default ON (ENABLE_SILEO=0 leaves the root without it). Idempotent. What it puts on the root:
+#   /jb                          the prefix as the image carries it (read, never run from): jb_seed copies it to
+#                                /private/var/jb at the first boot and leaves that copy alone afterwards -- what dpkg and
+#                                apt install there is the phone's own. A different stamp (/jb/.scion-stamp: REV below and
+#                                mk-jb.sh's) moves the phone's copy aside and seeds this one.
+#   /usr/local/bin/jb_seed       userland/src/jb_seed.c, the 16.5 line's, built for iOS (tools/ios27/sileo/build-tools.sh)
+#   /usr/local/bin/var_sync      userland/src/var_sync.c: the volume to the flash every 5 s (the phone is reset, never
+#                                shut down; without it what was installed in the last seconds is gone)
+#   /bin/{chmod,cp,mkdir,mv,rm}  links into the prefix: Sileo runs them by these names and iOS's /bin has df and ps only
+#   two launchd jobs             com.scion.jbseed (once a boot), com.scion.varsync (stays), in /System/Library/xpc/launchd.plist
+#   /Applications/Sileo.app      a real copy of the prefix's (marked .scion-prefix-app): on this port uicache -p answers
+#                                "Unable to register" for every path (also /Applications/*.app; seen on phone 1, 13 Nov 2026),
+#                                while lsd's own rebuild at boot registers what is in /Applications. The LaunchServices
+#                                databases are dropped so that lsd rebuilds them at the next boot (as 70-lsd-extkit does).
+#                                prep.sh (root, every boot) makes such copies root's and giveMeRoot 4755 again. A Sileo
+#                                upgraded by apt lands in /var/jb/Applications: the copy is refreshed at the next build.
+# What it does NOT put there, checked here so that a prefix made with other settings stops the build: no OpenSSH, no
+# tweak injection (ElleKit), no repository but Procursus (and the project's own, if SCION_REPO_URL names where it is
+# hosted), no account with a password, no file that everybody may write, no set-user-ID program beyond the bootstrap's
+# own and Sileo's helper.
+# Owners: run as root on a mount with owners (the full build), everything is root:wheel here. Run without root (an
+# edit of a pulled root, owners off), the files carry the builder's user ID and jb_seed makes them root's on the phone
+# before anything else (claim() there); the copy in /private/var/jb is root:wheel either way.
+# SILEO_SELFTEST=1 (a test root, never a release): tools/ios27/sileo/selftest.sh as a third job, which says into
+# /private/var/scion-test/selftest.log at every boot what the prefix is (owners, dpkg, Sileo registered, a kept file);
+# with SELFTEST_REPO=DIR, a flat apt repository with a test.conf, it also installs, runs and removes a package from it.
+#   undo: the four things above taken off the root again. /private/var/jb, the phone's own copy with what was installed
+#   into it, stays unless PURGE_PREFIX=1.
+set -euo pipefail
+R=${1:?usage: 60-sileo.sh ROOT [undo]}; DO=${2:-apply}
+H=$(cd "$(dirname "$0")" && pwd); REPO=$(cd "$H/../../../.." && pwd)
+JB=${JB_ROOT:-$REPO/jb}
+REV=2                                   # of what this step makes of the prefix: raise it and phones seed again
+                                        # 2: apt's methods stay root; prep.sh owns the /Applications copies
+BIN_NAMES="chmod cp mkdir mv rm"
+SETID="Applications/Sileo.app/giveMeRoot usr/bin/chpass usr/bin/login usr/bin/newgrp usr/bin/passwd usr/bin/quota usr/bin/su usr/bin/sudo"
+die() { echo "60-sileo: $*" >&2; exit 1; }
+[[ -f $R/System/Library/xpc/launchd.plist && -d $R/private/var ]] || die "$R is not an iOS root"
+
+if [[ $DO == undo ]]; then
+	/usr/bin/python3 "$H/../../sileo/jobs.py" "$R" remove
+	for c in $BIN_NAMES; do
+		[[ -L $R/bin/$c && $(readlink "$R/bin/$c") == /var/jb/usr/bin/$c ]] && rm -f "$R/bin/$c"
+	done
+	rm -f "$R/usr/local/bin/jb_seed" "$R/usr/local/bin/var_sync" "$R/usr/local/libexec/scion-sileo-selftest.sh"
+	rmdir "$R/usr/local/libexec" 2>/dev/null || true
+	rm -rf "$R/jb" "$R/jb.new"
+	[[ -e $R/Applications/Sileo.app/.scion-prefix-app ]] && rm -rf "$R/Applications/Sileo.app"
+	[[ ${PURGE_PREFIX:-0} == 1 ]] && rm -rf "$R/private/var/jb" "$R/private/var/.jb-seeding" "$R/private/var/log/scion-jbseed.log" "$R/private/var/log/scion-varsync.log" "$R/private/var/scion-test"
+	echo "60-sileo: taken off the root$([[ ${PURGE_PREFIX:-0} == 1 ]] && echo ', the phone'"'"'s copy too' || echo '; /private/var/jb, if the phone has made one, stays')"
+	exit 0
+fi
+[[ $DO == apply ]] || die "what is '$DO'? (nothing, or undo)"
+[[ ${ENABLE_SILEO:-1} == 1 ]] || { echo "60-sileo: off (ENABLE_SILEO=0)"; exit 0; }
+
+# the inputs, made before the build by tools/ios27/sileo/prepare.sh (no root, network for the two downloads)
+P=$JB/root/var/jb
+[[ -x $P/Applications/Sileo.app/Sileo && -s $JB/.stamp ]] || die "no prefix at $P: run tools/ios27/sileo/prepare.sh"
+[[ $(cat "$JB/.stamp") == *-- ]] || die "the prefix at $P was made with PREINSTALL or ElleKit: run tools/ios27/sileo/prepare.sh (it makes the plain one)"
+(cd "$JB/ios27" 2>/dev/null && shasum -a 256 -c SHA256SUMS >/dev/null 2>&1) || die "no jb_seed and var_sync at $JB/ios27: run tools/ios27/sileo/prepare.sh"
+for c in $BIN_NAMES; do
+	[[ -x $P/usr/bin/$c ]] || die "the prefix has no usr/bin/$c"
+	if [[ -e $R/bin/$c || -L $R/bin/$c ]]; then
+		[[ -L $R/bin/$c && $(readlink "$R/bin/$c") == /var/jb/usr/bin/$c ]] || die "/bin/$c is on the root already and is not this step's link"
+	fi
+done
+
+# the image's copy, made aside and put in place whole
+rm -rf "$R/jb.new"
+cp -a "$P" "$R/jb.new"
+N=$R/jb.new
+# the repositories Sileo starts with: Procursus, where all of it came from; the project's own once it is hosted
+find "$N/etc/apt/sources.list.d" -type f ! -name procursus.sources -delete
+if [[ -n ${SCION_REPO_URL:-} ]]; then
+	[[ $SCION_REPO_URL == https://* ]] || die "SCION_REPO_URL must be https://"
+	printf 'Types: deb\nURIs: %s\nSuites: ./\nComponents:\n' "$SCION_REPO_URL" > "$N/etc/apt/sources.list.d/scion.sources"
+fi
+# no account with a password: the bootstrap ships one for mobile (its own first-run script asks for a new one, and that
+# script is not used here). "!" matches nothing; pwd_mkdb makes the databases from this file on the phone (prep.sh).
+awk -F: -v OFS=: '/^#/ || NF < 10 { print; next } $2 != "*" && $2 != "!" { $2 = "!"; n++ } { print } END { printf "60-sileo: %d password(s) taken out of master.passwd\n", n > "/dev/stderr" }' \
+	"$N/etc/master.passwd" > "$N/etc/master.passwd.new"
+cat "$N/etc/master.passwd.new" > "$N/etc/master.passwd" && rm -f "$N/etc/master.passwd.new"
+rm -f "$N/etc/pwd.db" "$N/etc/spwd.db"
+# what mk-jb.sh takes out of dpkg's database and leaves on the disk (a set-user-ID daemon of a jailbreak's kernel
+# access, and its job): nothing here has a use for it
+rm -f "$N/usr/sbin/shshd" "$N/Library/LaunchDaemons/us.diatr.shshd.plist"
+# apt's methods run as root, not as its sandbox user _apt (uid 1001): iOS's own /etc/passwd does not know that uid, and
+# the system cfprefsd crashes (CFEqual on NULL) on every request of a client it cannot name; the method retries, launchd
+# restarts cfprefsd every 10 s, and every root process that reads a preference waits for ever (seen on phone 1, 13 Nov
+# 2026: apt-get update hung at its first file, uicache and then SpringBoard's pasteboard calls with it, the UI froze)
+printf '// scion: no sandbox user (iOS has no uid for _apt; see 60-sileo.sh)\nAPT::Sandbox::User "root";\n' > "$N/etc/apt/apt.conf.d/00scion-sandbox"
+# prep.sh (once a boot, as root): the copies of the prefix's applications in /Applications are root's
+/usr/bin/python3 - "$N/prep.sh" <<'PY2'
+import sys
+p = sys.argv[1]; s = open(p).read()
+block = ('# scion: copies of the prefix\'s applications in /Applications (LaunchServices registers them there) are root\'s,\n'
+         'for a in /Applications/*.app; do [ -e "$a/.scion-prefix-app" ] || continue; /var/jb/usr/sbin/chown -R 0:0 "$a"; '
+         '/var/jb/usr/bin/chmod -R go-w "$a"; [ -f "$a/giveMeRoot" ] && /var/jb/usr/bin/chmod 4755 "$a/giveMeRoot"; done\n')
+key = 'for app in /var/jb/Applications/*.app; do'
+if block not in s:
+    assert key in s, 'prep.sh changed: no loop over /var/jb/Applications'
+    s = s.replace(key, block + key, 1)
+open(p, 'w').write(s)
+PY2
+# the prefix's applications copied into /Applications at every boot and from uicache (their icons on this port)
+/usr/bin/python3 "$H/../../sileo/prep-apps.py" "$N"
+printf 'ios27-r%s-%s' "$REV" "$(cat "$JB/.stamp")" > "$N/.scion-stamp"
+
+# the checks: what must not be there
+for f in usr/sbin/sshd usr/bin/ssh usr/libexec/sshd-keygen-wrapper usr/lib/TweakLoader.dylib usr/lib/libellekit.dylib usr/sbin/dropbear; do
+	[[ ! -e $N/$f ]] || die "$f is in the prefix: this root is to carry neither OpenSSH nor tweak injection"
+done
+[[ -z $(awk -F: '!/^#/ && NF >= 10 && $2 != "*" && $2 != "!"' "$N/etc/master.passwd") ]] || die "an account with a password is left in master.passwd"
+W=$(cd "$N" && find . ! -type l -perm -0002 | head -5)
+[[ -z $W ]] || die "writable by everybody in the prefix: $W"
+HAVE=$(cd "$N" && find . -type f -perm +6000 | sed 's|^\./||' | LC_ALL=C sort | tr '\n' ' ')
+WANT=$(printf '%s\n' $SETID | LC_ALL=C sort | tr '\n' ' ')
+[[ $HAVE == "$WANT" ]] || die "the set-ID programs are not the expected ones: have: $HAVE want: $WANT"
+# every Mach-O plain arm64: an arm64e slice would need the PAC rewrite the rest of the root went through (10-macho-a64e
+# runs before this step and leaves /jb alone), and a fat file is not what the bootstrap ships
+/usr/bin/python3 - "$N" <<'PY' || die "the prefix has Mach-O files that are not plain arm64 (listed above)"
+import os, struct, sys
+bad = n = 0
+for d, _, files in os.walk(sys.argv[1]):
+    for f in files:
+        p = os.path.join(d, f)
+        if os.path.islink(p) or not os.path.isfile(p):
+            continue
+        with open(p, 'rb') as h:
+            head = h.read(12)
+        if len(head) < 12:
+            continue
+        magic, cpu, sub = struct.unpack('<III', head)
+        if magic in (0xbebafeca, 0xbfbafeca):                   # fat, as read little-endian
+            print('60-sileo: fat Mach-O:', p, file=sys.stderr); bad += 1
+        elif magic == 0xfeedfacf:
+            n += 1
+            if cpu != 0x0100000c or (sub & 0xffffff) != 0:
+                print('60-sileo: not plain arm64 (cpu %#x subtype %#x): %s' % (cpu, sub, p), file=sys.stderr); bad += 1
+print('60-sileo: %d Mach-O files in the prefix, all plain arm64' % n if not bad else '60-sileo: %d Mach-O files are not plain arm64' % bad)
+sys.exit(1 if bad else 0)
+PY
+[[ $(find "$N/etc/apt/sources.list.d" -type f | wc -l | tr -d ' ') == $([[ -n ${SCION_REPO_URL:-} ]] && echo 2 || echo 1) ]] || die "the list of repositories is not what was written"
+
+if [[ $EUID == 0 ]]; then
+	chown -R 0:0 "$N"
+	chown 501:501 "$N/var/mobile"
+	for f in $SETID; do                     # chown took the bits off
+		case $f in usr/bin/quota) chmod 2755 "$N/$f" ;; *) chmod 4755 "$N/$f" ;; esac
+	done
+fi
+rm -rf "$R/jb"
+mv "$N" "$R/jb"
+
+# Sileo where LaunchServices registers it (see the head of this file)
+if [[ -e $R/Applications/Sileo.app && ! -e $R/Applications/Sileo.app/.scion-prefix-app ]]; then
+	die "a Sileo.app that is not this step's is in /Applications"
+fi
+rm -rf "$R/Applications/Sileo.app"
+cp -a "$R/jb/Applications/Sileo.app" "$R/Applications/Sileo.app"
+: > "$R/Applications/Sileo.app/.scion-prefix-app"
+[[ $EUID != 0 ]] || { chown -R 0:0 "$R/Applications/Sileo.app"; chmod 4755 "$R/Applications/Sileo.app/giveMeRoot"; }
+for c in "$R"/private/var/mobile/Containers/Data/InternalDaemon/*/Library/Caches/*com.apple.LaunchServices-*.csstore; do
+	[[ -f $c ]] && rm -f "$c" && echo "60-sileo: LaunchServices database dropped (lsd rebuilds it at the next boot): ${c##*/}"
+done
+
+install -d -m 0755 "$R/usr/local/bin"
+for t in jb_seed var_sync; do
+	cat "$JB/ios27/$t" > "$R/usr/local/bin/$t.new.$$" && chmod 0755 "$R/usr/local/bin/$t.new.$$" && mv -f "$R/usr/local/bin/$t.new.$$" "$R/usr/local/bin/$t"
+done
+for c in $BIN_NAMES; do
+	ln -sfn "/var/jb/usr/bin/$c" "$R/bin/$c"
+done
+if [[ $EUID == 0 ]]; then
+	chown 0:0 "$R/usr/local/bin/jb_seed" "$R/usr/local/bin/var_sync"
+	for c in $BIN_NAMES; do chown -h 0:0 "$R/bin/$c"; done
+fi
+if [[ ${SILEO_SELFTEST:-0} == 1 ]]; then
+	install -d -m 0755 "$R/usr/local/libexec"
+	cat "$H/../../sileo/selftest.sh" > "$R/usr/local/libexec/scion-sileo-selftest.sh" && chmod 0755 "$R/usr/local/libexec/scion-sileo-selftest.sh"
+	[[ $EUID != 0 ]] || chown 0:0 "$R/usr/local/libexec" "$R/usr/local/libexec/scion-sileo-selftest.sh"
+	if [[ -n ${SELFTEST_REPO:-} ]]; then
+		[[ -f $SELFTEST_REPO/Packages && -f $SELFTEST_REPO/test.conf ]] || die "SELFTEST_REPO=$SELFTEST_REPO has no Packages and test.conf"
+		rm -rf "$R/private/var/scion-test/repo"
+		install -d -m 0755 "$R/private/var/scion-test"
+		cp -R "$SELFTEST_REPO" "$R/private/var/scion-test/repo"
+	fi
+	/usr/bin/python3 "$H/../../sileo/jobs.py" "$R" add --selftest
+	echo "60-sileo: SILEO_SELFTEST=1: this is a test root (a third job, com.scion.sileotest)"
+else
+	rm -f "$R/usr/local/libexec/scion-sileo-selftest.sh"
+	/usr/bin/python3 "$H/../../sileo/jobs.py" "$R" add
+fi
+echo "60-sileo: /jb ($(du -sh "$R/jb" | cut -f1), stamp $(cut -c1-24 "$R/jb/.scion-stamp")), jb_seed, var_sync, /bin links, 2 launchd jobs$([[ $EUID == 0 ]] || echo '; no root here: jb_seed makes the owners right on the phone')"
diff --git a/tools/ios27/metal/mk-bundle27.sh b/tools/ios27/metal/mk-bundle27.sh
index a05474587..fc6405f77 100755
--- a/tools/ios27/metal/mk-bundle27.sh
+++ b/tools/ios27/metal/mk-bundle27.sh
@@ -10,11 +10,18 @@ BRIDGE=$SB/build/m2v-bridge/ios/libnative_metal_bridge.a
 PANVK=$W/build/mesa/build-vk26/src/panfrost/vulkan/libvulkan_panfrost.dylib
 B=$W/stage/StarbiteMetal.bundle
 rm -rf "$B" && mkdir -p "$B" $W/sym $W/stage
-# the frontend and HotMetal2 are built from a copy with patches/frontend-dexr.diff, hotmetal2-diag.diff and frontend-flush.diff applied
-# (NOPATCH=1: as they are in tools/ios27/metal2)
+# the frontend and HotMetal2 are built from a copy with patches/frontend-dexr.diff, hotmetal2-diag.diff, frontend-flush.diff and
+# frontend-turned.diff applied, in that order (NOPATCH=1: as they are in tools/ios27/metal2)
 rm -rf $W/src27 && mkdir -p $W/src27/tools/ios27 && cp -R tools/ios27/metal2 $W/src27/tools/ios27/
-[ -n "${NOPATCH:-}" ] || for p in frontend-dexr hotmetal2-diag frontend-flush; do patch -s -p1 -d $W/src27 < tools/ios27/metal/patches/$p.diff || exit 1; done
+[ -n "${NOPATCH:-}" ] || for p in frontend-dexr hotmetal2-diag frontend-flush frontend-turned; do patch -s -p1 -d $W/src27 < tools/ios27/metal/patches/$p.diff || exit 1; done
 M2=$W/src27/tools/ios27/metal2
+# frontend-turned.diff includes TurnShaders.inc: tools/ios27/metal2/TurnShaders.metal (the pass that writes a turned texture into its
+# surface) compiled by the same Xcode's Metal compiler and held as bytes
+if [ -z "${NOPATCH:-}" ]; then
+	xcrun -sdk iphoneos metal -mios-version-min=16.0 -c $M2/TurnShaders.metal -o $W/src27/turn.air || exit 1
+	xcrun -sdk iphoneos metallib $W/src27/turn.air -o $W/src27/turn.metallib || exit 1
+	{ echo "static const unsigned char sweet_turn_metallib[] = {"; xxd -i < $W/src27/turn.metallib; echo "};"; } > $M2/TurnShaders.inc
+fi
 $CC -x objective-c++ -std=c++17 -fobjc-arc -O2 -g -Wall -Wno-deprecated-declarations -Wno-unused-function -bundle \
 	-o "$B/StarbiteMetal" $M2/HotMetal2.mm $M2/NativeBridgeMetalFrontend.mm -x none "$BRIDGE" \
 	-Wl,-dead_strip -lc++ -framework Foundation -framework Metal -framework IOSurface -framework IOKit \
diff --git a/tools/ios27/metal/patches/frontend-turned.diff b/tools/ios27/metal/patches/frontend-turned.diff
new file mode 100644
index 000000000..a35f1ae42
--- /dev/null
+++ b/tools/ios27/metal/patches/frontend-turned.diff
@@ -0,0 +1,211 @@
+--- a/tools/ios27/metal2/NativeBridgeMetalFrontend.mm	2026-11-12 16:10:16
++++ b/tools/ios27/metal2/NativeBridgeMetalFrontend.mm	2026-11-12 16:10:16
+@@ -10,6 +10,7 @@
+ #import <Metal/Metal.h>
+ #import <IOSurface/IOSurfaceRef.h>
+ #import <objc/runtime.h>
++#import <objc/message.h>
+ #include <algorithm>
+ #include <atomic>
+ #include <initializer_list>
+@@ -177,6 +178,11 @@
+ @property(nonatomic) NSUInteger parentRelativeLevel,parentRelativeSlice;
+ @property(nonatomic,strong) id<MTLHeap> parentHeap;
+ @property(nonatomic) int responsibleProcess;
++// A turned texture (the descriptor's rotation, Metal's private property of textures over a surface): the picture is drawn into
++// this texture, unturned, in device memory; turnedTarget is the texture over the surface itself, written from it at commit.
++@property(nonatomic,strong) NBTexture *turnedTarget;
++@property(nonatomic) NSUInteger turn;
++@property(nonatomic) IOSurfaceRef turnedSurface;
+ @end
+ @implementation NBBuffer
+ - (void)dealloc {
+@@ -351,6 +357,7 @@
+    nmb_texture_release(_handle);
+  }
+  if(_surface)CFRelease(_surface);
++ if(_turnedSurface)CFRelease(_turnedSurface);
+ }
+ - (MTLTextureType)textureType {return (MTLTextureType)_descriptor.type;}
+ - (MTLPixelFormat)pixelFormat {return (MTLPixelFormat)_descriptor.format;}
+@@ -376,7 +383,7 @@
+ - (NSUInteger)compressionFootprint {return 0;}
+ - (MTLTextureSwizzleChannels)swizzle {return MTLTextureSwizzleChannelsMake(MTLTextureSwizzleRed,MTLTextureSwizzleGreen,MTLTextureSwizzleBlue,MTLTextureSwizzleAlpha);}
+ - (uint32_t)swizzleKey {return 0;}
+-- (IOSurfaceRef)iosurface {return _surface;}
++- (IOSurfaceRef)iosurface {return _surface?_surface:_turnedSurface;}
+ - (NSUInteger)iosurfacePlane {return _surfacePlane;}
+ - (id<MTLBuffer>)buffer {return _surface?nil:(id<MTLBuffer>)_buffer;}
+ - (NSUInteger)bufferOffset {return _offset;}
+@@ -388,7 +395,7 @@
+ - (MTLResourceID)gpuResourceID {return sweetResourceID(_handle);}
+ - (NSUInteger)resourceIndex {return 0;}
+ - (NSUInteger)uniqueIdentifier {return (NSUInteger)(uintptr_t)_handle;}
+-- (NSUInteger)rotation {return 0;}
++- (NSUInteger)rotation {return _turn;}
+ - (NSUInteger)allocatedSize {
+  if(_surface)return IOSurfaceGetAllocSize(_surface);
+  if(_buffer && !_rowBytes)return [_buffer allocatedSize];
+@@ -948,6 +955,7 @@
+ @property(nonatomic) uint32_t commitIndex;
+ @property(nonatomic,strong) NSMutableArray *scheduledHandlers,*completedHandlers;
+ @property(nonatomic,strong) NSMutableSet *surfaces,*writtenSurfaces;
++@property(nonatomic,strong) NSMutableSet *turned;   // turned textures this buffer drew into or copied with (see sweetEncodeTurns)
+ // Runtime handles retain GPU storage, but only the Objective-C owner retains
+ // a no-copy deallocator, its memory owner and texture/heap ancestry.
+ @property(nonatomic,strong) NSMutableSet *resourceOwners;
+@@ -956,7 +964,9 @@
+ @property(nonatomic) BOOL schedulingDelivered;
+ @property(nonatomic,strong) NSMutableDictionary *userDict;
+ - (void)refuse:(NSString *)what;
++- (void)noteTurned:(NBTexture *)texture;
+ @end
++static void sweetEncodeTurns(NBCommandBuffer *commandBuffer);
+ @interface NBEncoder : NBObject
+ @property(nonatomic) NmbEncoder *handle;
+ @property(nonatomic,strong) NBCommandBuffer *commandBuffer;
+@@ -1287,6 +1297,7 @@
+   if(![o isKindOfClass:[NBTexture class]]){[self.commandBuffer refuse:@"missing or foreign blit texture"];return false;}
+   [self.commandBuffer.resourceOwners addObject:o];
+   if([(NBTexture *)o surface])[self.commandBuffer.surfaces addObject:o];
++  [self.commandBuffer noteTurned:(NBTexture *)o];
+  }
+  return true;
+ }
+@@ -1403,6 +1414,69 @@
+ 
+ static void completed(void *context);
+ static void scheduled(void *context);
++// Turned textures. CoreAnimation draws a display that shows the interface on its side into the display's own surfaces through
++// a texture whose descriptor carries a rotation (a private property of Metal's descriptor; 3 on a phone held in landscape) and
++// the turned size (1792 x 828 over a surface of 828 x 1792 with 3328 bytes a row): the GPU is to store the picture turned, so
++// that the surface still holds what the panel scans out. No Vulkan image can lie over the surface that way, so the texture the
++// caller gets is one of the asked shape in device memory (everything drawn into it and sampled from it is as the caller means
++// it), and every command buffer that drew into it ends with one more pass: a triangle over the surface's own texture that
++// reads the picture through the turn (TurnShaders.metal). The surface is written before the buffer completes, which is when
++// the window server hands it to the display. Cost: one pass over the screen per frame while the interface is turned.
++#include "TurnShaders.inc"          // sweet_turn_metallib[]: TurnShaders.metal, built by the bundle's script
++static std::mutex gTurnLock;
++static id<MTLLibrary> gTurnLibrary;
++static id<MTLSamplerState> gTurnSampler;
++static NSMutableDictionary<NSNumber *,id<MTLRenderPipelineState>> *gTurnPipelines;
++static std::atomic<uint64_t> gTurnPasses;
++// The pipeline that writes a surface of this pixel format through this turn (1, 2 or 3 quarter turns), or nil with the reason logged.
++static id<MTLRenderPipelineState> sweetTurnPipeline(MTLPixelFormat format,NSUInteger turn) {
++ if(turn<1 || turn>3 || !gDeviceObject)return nil;
++ std::lock_guard<std::mutex> lock(gTurnLock);
++ id<MTLDevice> device=(id<MTLDevice>)gDeviceObject;NSError *error=nil;
++ if(!gTurnPipelines)gTurnPipelines=[NSMutableDictionary dictionary];
++ NSNumber *key=@(((uint64_t)format<<2)|turn);
++ if(id<MTLRenderPipelineState> made=gTurnPipelines[key])return made;
++ if(!gTurnLibrary) {
++  dispatch_data_t data=dispatch_data_create(sweet_turn_metallib,sizeof sweet_turn_metallib,nullptr,DISPATCH_DATA_DESTRUCTOR_DEFAULT);
++  gTurnLibrary=[device newLibraryWithData:data error:&error];
++  if(!gTurnLibrary){NBLOG(@"native-metal: turned textures: the library was refused: %@",error.localizedDescription);return nil;}
++ }
++ if(!gTurnSampler) {
++  MTLSamplerDescriptor *sd=[MTLSamplerDescriptor new];
++  sd.minFilter=MTLSamplerMinMagFilterNearest;sd.magFilter=MTLSamplerMinMagFilterNearest;sd.mipFilter=MTLSamplerMipFilterNotMipmapped;
++  sd.sAddressMode=MTLSamplerAddressModeClampToEdge;sd.tAddressMode=MTLSamplerAddressModeClampToEdge;
++  gTurnSampler=[device newSamplerStateWithDescriptor:sd];
++  if(!gTurnSampler)return nil;
++ }
++ MTLRenderPipelineDescriptor *pd=[MTLRenderPipelineDescriptor new];
++ pd.vertexFunction=[gTurnLibrary newFunctionWithName:@"sweet_turn_vert"];
++ pd.fragmentFunction=[gTurnLibrary newFunctionWithName:[NSString stringWithFormat:@"sweet_turn_frag_%lu",(unsigned long)turn]];
++ pd.colorAttachments[0].pixelFormat=format;
++ id<MTLRenderPipelineState> state=(pd.vertexFunction && pd.fragmentFunction)?[device newRenderPipelineStateWithDescriptor:pd error:&error]:nil;
++ if(!state){NBLOG(@"native-metal: turned textures: no pipeline for format %lu turn %lu: %@",(unsigned long)format,(unsigned long)turn,error.localizedDescription);return nil;}
++ gTurnPipelines[key]=state;
++ return state;
++}
++// Before the commit: each turned texture this buffer may have written goes into its surface.
++static void sweetEncodeTurns(NBCommandBuffer *commandBuffer) {
++ NSSet *turned=[commandBuffer.turned copy];[commandBuffer.turned removeAllObjects];
++ for(NBTexture *picture in turned) {
++  NBTexture *target=picture.turnedTarget;
++  id<MTLRenderPipelineState> state=sweetTurnPipeline(target.pixelFormat,picture.turn);
++  if(!state){[commandBuffer refuse:@"turned texture: no pipeline"];return;}
++  MTLRenderPassDescriptor *pass=[MTLRenderPassDescriptor renderPassDescriptor];
++  pass.colorAttachments[0].texture=(id<MTLTexture>)target;
++  pass.colorAttachments[0].loadAction=MTLLoadActionDontCare;pass.colorAttachments[0].storeAction=MTLStoreActionStore;
++  id<MTLRenderCommandEncoder> encoder=[(id<MTLCommandBuffer>)commandBuffer renderCommandEncoderWithDescriptor:pass];
++  [encoder setRenderPipelineState:state];
++  [encoder setFragmentTexture:(id<MTLTexture>)picture atIndex:0];
++  [encoder setFragmentSamplerState:gTurnSampler atIndex:0];
++  [encoder drawPrimitives:MTLPrimitiveTypeTriangle vertexStart:0 vertexCount:3];
++  [encoder endEncoding];
++  gTurnPasses++;
++ }
++ [commandBuffer.turned removeAllObjects];      // (the pass above reads the picture: it is not a new write of it)
++}
+ @implementation NBCommandBuffer
+ - (instancetype)init {
+  if((self=[super init])){_scheduledHandlers=[NSMutableArray array];_completedHandlers=[NSMutableArray array];_surfaces=[NSMutableSet set];_writtenSurfaces=[NSMutableSet set];_resourceOwners=[NSMutableSet set];_handlers=dispatch_group_create();_schedulingHandlers=dispatch_group_create();}
+@@ -1419,6 +1493,15 @@
+ - (void)refuse:(NSString *)what {
+  if(!self.encodeFailure){self.encodeFailure=what;NBLOG(@"native-metal: command buffer refused: %@",what);}
+ }
++// A turned texture, or a view of one, that a pass of this buffer draws into (or a blit copies with): its surface is written at commit.
++- (void)noteTurned:(NBTexture *)texture {
++ for(NBTexture *root=texture;root;root=(NBTexture *)root.parent) {
++  if(!root.turnedTarget)continue;
++  if(!_turned)_turned=[NSMutableSet set];
++  [_turned addObject:root];
++  return;
++ }
++}
+ - (MTLCommandBufferStatus)status {
+  if(self.failedLocally)return MTLCommandBufferStatusError;
+  return (MTLCommandBufferStatus)nmb_command_buffer_status(_handle);
+@@ -1498,6 +1581,7 @@
+   if(!a.texture)return true;
+   if(![(id)a.texture isKindOfClass:[NBTexture class]])return false;
+   NBTexture *texture=(NBTexture *)a.texture;if(texture.surface){[_surfaces addObject:texture];[_writtenSurfaces addObject:texture];}
++  [self noteTurned:texture];
+   [_resourceOwners addObject:texture];
+   out.texture=texture.handle;out.level=a.level;out.slice=a.slice;out.depth_plane=a.depthPlane;out.load=a.loadAction;out.store=a.storeAction;
+   return true;
+@@ -1575,6 +1659,7 @@
+ }
+ - (void)commit {
+  if(self.committed){NBLOG(@"native-metal: commit twice");return;}
++ if(_turned.count && !self.encodeFailure)sweetEncodeTurns(self);
+  self.committed=YES;
+  self.committedUs=nowUs();
+  {
+@@ -2290,6 +2375,34 @@
+ // 4 KiB context by Turnip), so every process that imports the surface renders and samples the same memory.
+ - (id<MTLTexture>)newTextureWithDescriptor:(MTLTextureDescriptor *)d iosurface:(IOSurfaceRef)surface plane:(NSUInteger)plane {
+  if(!surface || !d)return nil;
++ // A turned texture (above, "Turned textures"): the surface's own texture, unturned, and the picture in device memory.
++ const NSUInteger turn=[d respondsToSelector:@selector(rotation)]?((NSUInteger(*)(id,SEL))objc_msgSend)(d,@selector(rotation)):0;
++ if(turn) {
++  const size_t sw=IOSurfaceGetPlaneCount(surface)?IOSurfaceGetWidthOfPlane(surface,plane):IOSurfaceGetWidth(surface);
++  const size_t sh=IOSurfaceGetPlaneCount(surface)?IOSurfaceGetHeightOfPlane(surface,plane):IOSurfaceGetHeight(surface);
++  const bool quarter=(turn&1)!=0;
++  if(turn>3 || d.textureType!=MTLTextureType2D || d.mipmapLevelCount>1 || d.sampleCount>1 ||
++     d.width!=(quarter?sh:sw) || d.height!=(quarter?sw:sh)) {
++   NBLOG(@"native-metal: turned texture refused: %lux%lu turn %lu over a surface of %zux%zu",(unsigned long)d.width,(unsigned long)d.height,(unsigned long)turn,sw,sh);
++   return nil;
++  }
++  MTLTextureDescriptor *own=[d copy];
++  ((void(*)(id,SEL,NSUInteger))objc_msgSend)(own,@selector(setRotation:),0);
++  own.width=sw;own.height=sh;own.usage=d.usage|MTLTextureUsageRenderTarget;
++  NBTexture *target=(NBTexture *)[(id<MTLDevice>)self newTextureWithDescriptor:own iosurface:surface plane:plane];
++  if(!target)return nil;
++  if(!sweetTurnPipeline(target.pixelFormat,turn))return nil;
++  MTLTextureDescriptor *shape=[d copy];
++  ((void(*)(id,SEL,NSUInteger))objc_msgSend)(shape,@selector(setRotation:),0);
++  shape.storageMode=MTLStorageModePrivate;shape.usage=d.usage|MTLTextureUsageRenderTarget|MTLTextureUsageShaderRead;
++  NBTexture *picture=(NBTexture *)[(id<MTLDevice>)self newTextureWithDescriptor:shape];
++  if(!picture)return nil;
++  picture.turnedTarget=target;picture.turn=turn;picture.turnedSurface=(IOSurfaceRef)CFRetain(surface);picture.noRecycle=YES;
++  static std::atomic<int> said{0};
++  if(said.fetch_add(1)<4){char line[200];snprintf(line,sizeof line,"native-metal: turned texture %lux%lu fmt %lu turn %lu over surface %u (%zux%zu)",
++   (unsigned long)d.width,(unsigned long)d.height,(unsigned long)d.pixelFormat,(unsigned long)turn,IOSurfaceGetID(surface),sw,sh);sm2_logs(line);}
++  return (id<MTLTexture>)picture;
++ }
+  const size_t planeCount=IOSurfaceGetPlaneCount(surface);
+  if(planeCount>2 || (planeCount?plane>=planeCount:plane!=0))return nil;
+  void *rawBase=IOSurfaceGetBaseAddress(surface);const size_t page=(size_t)getpagesize(),allocation=IOSurfaceGetAllocSize(surface);
diff --git a/tools/ios27/metal2/TurnShaders.metal b/tools/ios27/metal2/TurnShaders.metal
new file mode 100644
index 000000000..6c675279d
--- /dev/null
+++ b/tools/ios27/metal2/TurnShaders.metal
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: MIT-0
+// The copy behind a turned render target (NativeBridgeMetalFrontend.mm, "turned textures"): the window server draws the
+// interface in its own orientation into a texture of that shape; this pass writes it, turned by quarter turns, into the
+// display's surface, whose rows run along the panel. One triangle over the whole surface; the fragment reads the texel
+// that belongs at its place. Built by the bundle's script (xcrun metal, metallib) into TurnShaders.inc.
+#include <metal_stdlib>
+using namespace metal;
+
+struct TurnOut {
+    float4 position [[position]];
+    float2 at;                      // the surface's own coordinate, 0..1, origin top left
+};
+
+vertex TurnOut sweet_turn_vert(uint vid [[vertex_id]])
+{
+    float2 p = float2(float((vid << 1) & 2), float(vid & 2));      // (0,0) (2,0) (0,2)
+    TurnOut o;
+    o.position = float4(p.x * 2.0 - 1.0, 1.0 - p.y * 2.0, 0.0, 1.0);
+    o.at = p;
+    return o;
+}
+
+// MTLTextureRotation 1, 2, 3 = one, two, three quarter turns: where in the unturned picture the surface's point reads.
+fragment float4 sweet_turn_frag_1(TurnOut in [[stage_in]], texture2d<float> picture [[texture(0)]], sampler nearest [[sampler(0)]])
+{
+    return picture.sample(nearest, float2(1.0 - in.at.y, in.at.x));
+}
+
+fragment float4 sweet_turn_frag_2(TurnOut in [[stage_in]], texture2d<float> picture [[texture(0)]], sampler nearest [[sampler(0)]])
+{
+    return picture.sample(nearest, float2(1.0 - in.at.x, 1.0 - in.at.y));
+}
+
+fragment float4 sweet_turn_frag_3(TurnOut in [[stage_in]], texture2d<float> picture [[texture(0)]], sampler nearest [[sampler(0)]])
+{
+    return picture.sample(nearest, float2(in.at.y, 1.0 - in.at.x));
+}
diff --git a/tools/ios27/s9/build-root.sh b/tools/ios27/s9/build-root.sh
index ad97a28ac..88490b1b7 100755
--- a/tools/ios27/s9/build-root.sh
+++ b/tools/ios27/s9/build-root.sh
@@ -6,6 +6,7 @@
 #   sudo tools/ios27/s9/build-root.sh inputs     -> tools/ios27/fullroot/out/root-full.img (raw HFSX, 32 GiB sparse, about 20 GiB used)
 # Environment, all optional: PY=<python with numpy>; SIZE_GB (32); OUT=<image>; MIN_FREE_GB (62: the copy, the cache and working
 # room); DAEMON_SET=bp|min; METAL_CA_CLIENTS (default here: "backboardd SBRendererService", what the icon fixes were tested with);
+# ENABLE_SILEO=0 for a root without the package manager (docs/ios27/SILEO.md);
 # ENABLE_METAL_CA=0 for the OpenGL ES compositor (then boot with tools/ios27/cmdline/starlte-rc-gl.txt). About 40 minutes.
 set -euo pipefail
 HERE=$(cd "$(dirname "$0")" && pwd); FR=$(cd "$HERE/../fullroot" && pwd)
diff --git a/tools/ios27/s9/prepare-root-inputs.sh b/tools/ios27/s9/prepare-root-inputs.sh
index 3870b8bce..8e4c62a39 100755
--- a/tools/ios27/s9/prepare-root-inputs.sh
+++ b/tools/ios27/s9/prepare-root-inputs.sh
@@ -12,6 +12,8 @@
 #   patches.txt                tools/ios27/s9/patches-24A446.txt, after every expected word was found in your cache
 #   undef.txt + the oracle     pipeline/cache/aot/make-oracle.sh over your cache (tables in pipeline/cache/aot/oracle/, not in git)
 #   overlay/ + MANIFEST.sha256 a copy of OVERLAY_DIR with the manifest steps.d/30-overlay.sh checks
+#   jb/ (of the checkout)      the package manager's prefix for steps.d/60-sileo.sh (tools/ios27/sileo/prepare.sh; needs the
+#                              network for two pinned downloads, zstd, and Xcode's iPhoneOS SDK)
 set -euo pipefail
 SRC=${1:?usage: prepare-root-inputs.sh STOCK_CACHE_DIR [OVERLAY_DIR]}; OV=${2:-}
 HERE=$(cd "$(dirname "$0")" && pwd); T27=$(cd "$HERE/.." && pwd); FR=$T27/fullroot
@@ -77,4 +79,11 @@ else
 	echo "NOTE: no StarbiteMetal.bundle in the overlay: build-root.sh will use the OpenGL ES compositor (ENABLE_METAL_CA=0)"
 fi
 echo "overlay: $(grep -c . "$P/overlay/MANIFEST.sha256" || true) files"
+# 6. the package manager's prefix (steps.d/60-sileo.sh): the Procursus bootstrap and Sileo, pinned, and the two programs
+# that seed and keep it, into jb/ of this checkout. ENABLE_SILEO=0 here and at the build leaves the root without it.
+if [ "${ENABLE_SILEO:-1}" = 1 ]; then
+	"$HERE/../sileo/prepare.sh"
+else
+	echo "NOTE: ENABLE_SILEO=0: no package manager on this root (build with ENABLE_SILEO=0 as well)"
+fi
 echo "ready: IOS27_PRIVATE=$P"
diff --git a/tools/ios27/sileo/README.md b/tools/ios27/sileo/README.md
new file mode 100644
index 000000000..3a97db579
--- /dev/null
+++ b/tools/ios27/sileo/README.md
@@ -0,0 +1,52 @@
+# tools/ios27/sileo: the package manager on an iOS 27 root
+
+What it is and why: [docs/ios27/SILEO.md](../../../docs/ios27/SILEO.md). The files:
+
+| File | What |
+|---|---|
+| `prepare.sh` | Fetch and check the Procursus bootstrap and Sileo (`tools/mk-jb.sh`, pinned), build `jb_seed` and `var_sync` for iOS. No root. Output in `jb/` of the checkout |
+| `build-tools.sh` | The second half of that: `userland/src/jb_seed.c` and `var_sync.c` with Xcode's iPhoneOS SDK, arm64, ad-hoc signed |
+| `../fullroot/steps.d/60-sileo.sh ROOT [undo]` | The root step. Part of every full-root build; also run by hand on an attached root |
+| `jobs.py ROOT add [--selftest]\|remove\|list` | The launchd jobs, as entries of `/System/Library/xpc/launchd.plist` |
+| `selftest.sh` | Runs on the phone on a test root (`SILEO_SELFTEST=1`), writes `/private/var/scion-test/selftest.log` |
+
+## A new root
+
+    tools/ios27/s9/prepare-root-inputs.sh ...     # calls prepare.sh
+    sudo tools/ios27/s9/build-root.sh inputs      # 60-sileo.sh runs with the other steps; check-root.sh checks it
+
+## A phone that already has an iOS 27 root
+
+One reversible root step. The phone is in TWRP; `SERIAL` is its adb serial, `BASE` the image its root was flashed from
+(the pull only fetches what differs from it, and `BASE` is not written to). `root-sync` stands for a chunked pull and
+push of USERDATA through TWRP's adb, pinned to that serial (the Starbite tools' `starlte-root-sync.py` is the one used
+so far); without one, edit a copy of `BASE` and write it whole with `tools/ios27/fullroot/fastflash-root.py`, which
+replaces everything on the phone's root.
+
+    tools/ios27/sileo/prepare.sh
+    root-sync pull BASE work/root.img                         # the phone's root as it is now (+ work/root.img.hashes)
+    hdiutil attach -owners off -nobrowse -imagekey diskimage-class=CRawDiskImage -mountpoint work/mnt work/root.img
+    tools/ios27/fullroot/steps.d/60-sileo.sh work/mnt         # undo: the same with "undo" as the second argument
+    hdiutil detach work/mnt
+    root-sync push work/root.img                              # the changed 64 MiB chunks, each read back
+
+Without root on the Mac the new files carry the builder's user ID; `jb_seed` makes them root's at the first boot (it says
+how many in `/private/var/log/scion-jbseed.log`). The first boot after the step copies the prefix (about 120 MB, half a
+minute after SpringBoard is up), then Sileo's icon appears on the last page of the home screen.
+
+To take it off again: the same three commands with `60-sileo.sh work/mnt undo` (add `PURGE_PREFIX=1` to delete the
+phone's own copy and everything installed into it as well).
+
+## Reading the self-test
+
+    root-sync pull BASE work/after.img
+    hdiutil attach -readonly -owners off -nobrowse -imagekey diskimage-class=CRawDiskImage -mountpoint work/mnt work/after.img
+    cat work/mnt/private/var/scion-test/selftest.log work/mnt/private/var/log/scion-jbseed.log
+
+## Status
+
+| | |
+|---|---|
+| The step, its undo, a second run, `check-root.sh` | Run on a clone of a full RC2 root image on the Mac: applies, repeats without change, undo leaves `launchd.plist` identical, `fsck_hfs` clean |
+| On a phone (phone 1, iOS 27 full root, 13 Nov 2026) | Seeded at the first boot (6357 files, 9 s), owners right, no password, no OpenSSH. With REV 1: `apt-get update` hung and the UI froze (cfprefsd, below); uicache could register nothing. With the REV 2 changes (applied to the phone's root by hand, the same edits this step now makes): `apt-get` installs, runs, removes and installs again from a repository on the phone, the package and an app package are still installed after a reboot; Sileo's icon on the home screen, Sileo opens, lists the installed packages and refreshes its sources (no network on this port yet: Procursus "offline") |
+| Not yet on a phone | An install from Sileo's own interface (giveMeRoot); a source over the network (no Wi-Fi); an application brought by a package (it is installed but not registered: uicache) |
diff --git a/tools/ios27/sileo/build-tools.sh b/tools/ios27/sileo/build-tools.sh
new file mode 100755
index 000000000..010f50b68
--- /dev/null
+++ b/tools/ios27/sileo/build-tools.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+# SPDX-License-Identifier: MIT-0
+# build-tools.sh : the two programs an iOS 27 root needs for the package manager's prefix, built from the 16.5 line's
+# own sources for iOS (arm64, the baseline instruction set: nothing the S9's cores lack), ad-hoc signed:
+#   jb_seed   userland/src/jb_seed.c   copies the image's /jb to /private/var/jb once, prepares it at each boot
+#   var_sync  userland/src/var_sync.c  the kept volume to the flash every few seconds (the phone is reset, never shut down)
+# Into jb/ios27/ (never in the repository, like the rest of jb/). Needs Xcode's iPhoneOS SDK. No root.
+set -euo pipefail
+REPO=$(cd "$(dirname "$0")/../../.." && pwd)
+OUT=${JB_ROOT:-$REPO/jb}/ios27
+SDK=$(xcrun --sdk iphoneos --show-sdk-path) || { echo "build-tools.sh: no iPhoneOS SDK (Xcode)" >&2; exit 1; }
+mkdir -p "$OUT"
+for tool in jb_seed var_sync; do
+	xcrun --sdk iphoneos clang -arch arm64 -isysroot "$SDK" -miphoneos-version-min=15.0 -O2 -Wall -Wextra -Werror \
+		-o "$OUT/$tool" "$REPO/userland/src/$tool.c"
+	codesign -f -s - "$OUT/$tool" 2>/dev/null
+	# arm64 and nothing else: an arm64e slice would need the PAC rewrite the rest of the root went through
+	[[ "$(lipo -archs "$OUT/$tool")" == arm64 ]] || { echo "build-tools.sh: $tool is not plain arm64" >&2; exit 1; }
+done
+(cd "$OUT" && shasum -a 256 jb_seed var_sync > SHA256SUMS)
+echo "build-tools.sh: $OUT/jb_seed, $OUT/var_sync"
diff --git a/tools/ios27/sileo/jobs.py b/tools/ios27/sileo/jobs.py
new file mode 100755
index 000000000..cc9e4bb51
--- /dev/null
+++ b/tools/ios27/sileo/jobs.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""SPDX-License-Identifier: MIT-0
+jobs.py ROOT add [--selftest]|remove|list : the launchd jobs of the package manager's prefix on an attached iOS 27 root. iOS's launchd
+reads its jobs from one file, /System/Library/xpc/launchd.plist, not from the directories, so they are entries there
+(written in place: the file keeps its owner and mode).
+  com.scion.jbseed    /usr/local/bin/jb_seed, once a boot: the image's /jb copied to /private/var/jb the first time, then
+                      prep.sh (dpkg's "firmware" record, Sileo and the prefix's applications registered with uicache)
+  com.scion.varsync   /usr/local/bin/var_sync 5, for the whole run: the volume to the flash every 5 s
+  com.scion.sileotest only with --selftest (a test root): tools/ios27/sileo/selftest.sh, once a boot. On a first boot
+                      there is no /var/jb/bin/sh yet when launchd loads it; WatchPaths starts it when prep.sh has made
+                      /private/var/jb/.prepared
+All run as root, none listens on anything, both write to a log in /private/var/log (not to /dev/console: a job with
+that as its output kept backboardd from starting on this port). remove takes all three out."""
+import plistlib, sys
+
+PREFIX = '/System/Library/LaunchDaemons/'
+JOBS = {
+    'com.scion.jbseed': {
+        'Label': 'com.scion.jbseed',
+        'ProgramArguments': ['/usr/local/bin/jb_seed'],
+        'RunAtLoad': True,
+        'AbandonProcessGroup': True,         # prep.sh leaves its registrations of applications running aside
+        'LimitLoadToSessionType': 'System',
+        'ProcessType': 'Background',
+        'StandardOutPath': '/private/var/log/scion-jbseed.log',
+        'StandardErrorPath': '/private/var/log/scion-jbseed.log',
+    },
+    'com.scion.varsync': {
+        'Label': 'com.scion.varsync',
+        'ProgramArguments': ['/usr/local/bin/var_sync', '5'],
+        'RunAtLoad': True,
+        'KeepAlive': True,
+        'LimitLoadToSessionType': 'System',
+        'ProcessType': 'Background',
+        'StandardOutPath': '/private/var/log/scion-varsync.log',
+        'StandardErrorPath': '/private/var/log/scion-varsync.log',
+    },
+}
+
+TEST = {
+    'com.scion.sileotest': {
+        'Label': 'com.scion.sileotest',
+        'ProgramArguments': ['/var/jb/bin/sh', '/usr/local/libexec/scion-sileo-selftest.sh'],
+        'RunAtLoad': True,
+        'WatchPaths': ['/private/var/jb/.prepared'],
+        'LimitLoadToSessionType': 'System',
+        'ProcessType': 'Background',
+    },
+}
+
+def main():
+    selftest = '--selftest' in sys.argv
+    if selftest:
+        sys.argv.remove('--selftest')
+    if len(sys.argv) != 3 or sys.argv[2] not in ('add', 'remove', 'list') or (selftest and sys.argv[2] != 'add'):
+        raise SystemExit(__doc__)
+    if selftest or sys.argv[2] != 'add':
+        JOBS.update(TEST)
+    path = sys.argv[1] + '/System/Library/xpc/launchd.plist'
+    with open(path, 'rb') as f:
+        d = plistlib.load(f)
+    jobs = d['LaunchDaemons']
+    ours = {PREFIX + label + '.plist': job for label, job in JOBS.items()}
+    if sys.argv[2] == 'list':
+        for key in ours:
+            print(key, 'present' if key in jobs else 'absent')
+        return
+    # a label of ours under some other key would be a second job of the same name: stop
+    for key, job in jobs.items():
+        if isinstance(job, dict) and job.get('Label') in JOBS and key not in ours:
+            raise SystemExit('jobs.py: %s is in the file already as %s' % (job.get('Label'), key))
+    before = dict(jobs)
+    for key, job in ours.items():
+        if sys.argv[2] == 'add':
+            jobs[key] = job
+        else:
+            jobs.pop(key, None)
+    if sys.argv[2] == 'add' and not selftest:           # a root that had the test job and is made again without it
+        jobs.pop(PREFIX + 'com.scion.sileotest.plist', None)
+    if jobs == before:
+        print('jobs.py: nothing to change (%s)' % sys.argv[2])
+        return
+    data = plistlib.dumps(d, fmt=plistlib.FMT_BINARY)
+    plistlib.loads(data)
+    with open(path, 'r+b') as f:
+        f.truncate(0)
+        f.write(data)
+    print('jobs.py: %s: %s' % (sys.argv[2], ', '.join(JOBS)))
+
+main()
diff --git a/tools/ios27/sileo/prep-apps.py b/tools/ios27/sileo/prep-apps.py
new file mode 100755
index 000000000..ea318476f
--- /dev/null
+++ b/tools/ios27/sileo/prep-apps.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""SPDX-License-Identifier: MIT-0
+prep-apps.py PREFIX : give a package-manager prefix (a /jb or /private/var/jb of an iOS 27 root) the app-icon fix of
+tools/ios27/sileo/scion-apps-sync.sh. Idempotent; used by 60-sileo.sh and by edits of a pulled phone root.
+  PREFIX/usr/libexec/scion-apps-sync   the script (copied from next to this file)
+  PREFIX/prep.sh                       once a boot: uicache diverted (dpkg-divert, so a uikittools upgrade keeps it) to a
+                                       wrapper that runs scion-apps-sync first (as root), then scion-apps-sync itself
+"""
+import os, shutil, sys
+
+if len(sys.argv) != 2:
+    raise SystemExit(__doc__)
+pre = sys.argv[1]
+here = os.path.dirname(os.path.abspath(__file__))
+dst = os.path.join(pre, 'usr/libexec/scion-apps-sync')
+os.makedirs(os.path.dirname(dst), exist_ok=True)
+shutil.copyfile(os.path.join(here, 'scion-apps-sync.sh'), dst)
+os.chmod(dst, 0o755)
+
+block = r'''# scion: the prefix's applications copied where LaunchServices registers them (usr/libexec/scion-apps-sync), at every
+# boot and from uicache, which every package bringing an application runs: diverted once to a wrapper
+if [ ! -e /var/jb/usr/bin/uicache.scion-real ] && [ -x /var/jb/usr/bin/uicache ]; then
+	/var/jb/usr/bin/dpkg-divert --quiet --local --rename --divert /var/jb/usr/bin/uicache.scion-real --add /var/jb/usr/bin/uicache &&
+	printf '#!/var/jb/bin/sh\n# scion (prep.sh): the copies in /Applications first (root only), then the real uicache\n[ "$(/var/jb/usr/bin/id -u)" != 0 ] || /var/jb/usr/libexec/scion-apps-sync >> /private/var/log/scion-apps-sync.log 2>&1\nexec /var/jb/usr/bin/uicache.scion-real "$@"\n' > /var/jb/usr/bin/uicache &&
+	/var/jb/usr/bin/chmod 0755 /var/jb/usr/bin/uicache
+fi
+/var/jb/usr/libexec/scion-apps-sync >> /private/var/log/scion-apps-sync.log 2>&1
+'''
+p = os.path.join(pre, 'prep.sh')
+s = open(p).read()
+key = 'for app in /var/jb/Applications/*.app; do'
+if block not in s:
+    i = s.find('# scion s3:')
+    if i < 0:
+        i = s.find('# scion: copies of the prefix')
+    if i < 0:
+        i = s.find(key)
+    assert i >= 0, 'prep.sh changed: no place for the block'
+    s = s[:i] + block + s[i:]
+    open(p, 'w').write(s)
+    print('prep-apps: %s: scion-apps-sync and the uicache wrapper added' % pre)
+else:
+    print('prep-apps: %s: already there' % pre)
diff --git a/tools/ios27/sileo/prepare.sh b/tools/ios27/sileo/prepare.sh
new file mode 100755
index 000000000..f4c87881a
--- /dev/null
+++ b/tools/ios27/sileo/prepare.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# SPDX-License-Identifier: MIT-0
+# prepare.sh : the inputs of tools/ios27/fullroot/steps.d/60-sileo.sh, made before the root build (no root; network
+# for two downloads, once): the Procursus bootstrap and Sileo alone, both pinned by SHA-256 in tools/mk-jb.sh
+# (PREINSTALL= ELLEKIT=: no OpenSSH, no tweak injection, nothing "newest"), and jb_seed and var_sync for iOS.
+# Needs zstd, python3, Xcode's iPhoneOS SDK. Everything goes to jb/ (JB_ROOT), which is never in the repository.
+set -euo pipefail
+REPO=$(cd "$(dirname "$0")/../../.." && pwd)
+command -v zstd >/dev/null || { echo "prepare.sh: zstd is needed (brew install zstd)" >&2; exit 1; }
+PREINSTALL= ELLEKIT= "$REPO/tools/mk-jb.sh"
+"$REPO/tools/ios27/sileo/build-tools.sh"
diff --git a/tools/ios27/sileo/scion-apps-sync.sh b/tools/ios27/sileo/scion-apps-sync.sh
new file mode 100755
index 000000000..83537e069
--- /dev/null
+++ b/tools/ios27/sileo/scion-apps-sync.sh
@@ -0,0 +1,49 @@
+#!/var/jb/bin/sh
+# SPDX-License-Identifier: MIT-0
+# scion-apps-sync (tools/ios27/sileo/scion-apps-sync.sh, installed by 60-sileo.sh as /var/jb/usr/libexec/scion-apps-sync):
+# the prefix's applications where LaunchServices registers them on this port. Run as root by prep.sh at every boot and by
+# the uicache wrapper (the trigger of every package that brings an application), so an app installed from Sileo gets
+# its home-screen icon.
+#
+# Why: on the S9's iOS 27, LaunchServices refuses uicache's registration of any bundle ("Unable to register", for
+# /var/jb/Applications and /Applications alike; seen on phone 1, 13 Nov 2026), while lsd's own rebuild registers what is
+# in /Applications. So every /var/jb/Applications/X.app gets a real copy /Applications/X.app, marked .scion-prefix-app,
+# root's, nothing writable by others, a giveMeRoot set-user-ID again. A copy that differs from the prefix's (diff -r)
+# is made again; a marked copy whose application is gone from the prefix is removed. iOS's own
+# applications (no mark) are never touched. When anything changed, the LaunchServices databases are dropped and lsd
+# is restarted, so it rebuilds them.
+P=/var/jb/usr/bin
+changed=0
+for app in /var/jb/Applications/*.app; do
+	[ -d "$app" ] || continue
+	name=${app##*/}
+	dst=/Applications/$name
+	if [ -e "$dst" ] && [ ! -e "$dst/.scion-prefix-app" ]; then
+		continue                                        # one of iOS's own: never touched
+	fi
+	if [ -e "$dst/.scion-prefix-app" ] && $P/diff -rq -x .scion-prefix-app "$app" "$dst" > /dev/null 2>&1; then
+		continue                                        # the same as the prefix's
+	fi
+	$P/rm -rf "$dst.scion-new"
+	if $P/cp -a "$app" "$dst.scion-new" && : > "$dst.scion-new/.scion-prefix-app" &&
+	    /var/jb/usr/sbin/chown -R 0:0 "$dst.scion-new" && $P/chmod -R go-w "$dst.scion-new"; then
+		[ ! -f "$dst.scion-new/giveMeRoot" ] || $P/chmod 4755 "$dst.scion-new/giveMeRoot"
+		$P/rm -rf "$dst" && $P/mv "$dst.scion-new" "$dst" && changed=1 && echo "scion-apps-sync: $name copied to /Applications"
+	else
+		$P/rm -rf "$dst.scion-new"
+		echo "scion-apps-sync: $name could not be copied"
+	fi
+done
+for dst in /Applications/*.app; do
+	[ -e "$dst/.scion-prefix-app" ] || continue
+	[ -d "/var/jb/Applications/${dst##*/}" ] && continue
+	$P/rm -rf "$dst" && changed=1 && echo "scion-apps-sync: ${dst##*/} removed from /Applications (its package is gone)"
+done
+if [ $changed = 1 ]; then
+	for c in /private/var/mobile/Containers/Data/InternalDaemon/*/Library/Caches/*com.apple.LaunchServices-*.csstore; do
+		[ -f "$c" ] && $P/rm -f "$c"
+	done
+	$P/killall -9 lsd 2>/dev/null
+	echo "scion-apps-sync: LaunchServices databases dropped, lsd restarted (it rebuilds them)"
+fi
+exit 0
diff --git a/tools/ios27/sileo/selftest.sh b/tools/ios27/sileo/selftest.sh
new file mode 100755
index 000000000..22a52e530
--- /dev/null
+++ b/tools/ios27/sileo/selftest.sh
@@ -0,0 +1,116 @@
+#!/var/jb/bin/sh
+# SPDX-License-Identifier: MIT-0
+# selftest.sh : what the package manager's prefix is on this phone, said into a file at every boot. The iOS 27 port has
+# no shell to ask, so a test root carries this as a launchd job (SILEO_SELFTEST=1 with tools/ios27/fullroot/steps.d/
+# 60-sileo.sh; a release root does not). It runs as root, once a boot, after jb_seed has prepared the prefix, and
+# appends to /private/var/scion-test/selftest.log (read back from the root in TWRP: tools/ios27/sileo/README.md).
+#   every boot   owners and modes, nothing writable by everybody, the set-ID programs, no account with a password,
+#                no OpenSSH, dpkg's database whole, Sileo registered, the repositories, the boot counter and the
+#                kept file (one line a boot in mobile's Documents: persistence), the network as it stands
+#   with a repository in /private/var/scion-test/repo (tools/ios27/sileo/mk-test-repo.py; test.conf names PKG, RUN,
+#   APP and APPID): the first boot installs PKG with apt-get from it, runs it, removes it, installs it again and
+#   installs APP; every later boot wants both still installed, PKG still running and APP still registered.
+# A line starts with "ok", "FAIL" or "info"; the last line of a boot is "RESULT boot N: PASS" or "... FAIL (n)".
+PATH=/var/jb/usr/bin:/var/jb/bin:/var/jb/usr/sbin:/var/jb/sbin:/usr/bin:/bin:/usr/sbin:/sbin
+HOME=/var/root
+export PATH HOME
+T=/private/var/scion-test
+mkdir -p $T
+exec >> $T/selftest.log 2>&1
+# a prefix from an earlier boot: this boot's jb_seed (owners, prep.sh) gets its time first
+[ ! -e /var/jb/.prepared ] || sleep 45
+n=0
+while [ ! -e /var/jb/.prepared ] && [ $n -lt 120 ]; do sleep 5; n=$((n + 1)); done
+B=$(($(cat $T/boots 2>/dev/null || echo 0) + 1))
+echo $B > $T/boots
+F=0
+ok() { echo "ok   $*"; }
+bad() { echo "FAIL $*"; F=$((F + 1)); }
+info() { echo "info $*"; }
+want() { [ "$2" = "$3" ] && ok "$1: $2" || bad "$1: $2 (wanted $3)"; }
+echo "=== selftest boot $B, $(date -u +%Y-%m-%dT%H:%M:%SZ), waited $((n * 5)) s for the prefix"
+[ -e /var/jb/.prepared ] || { bad "no prepared prefix at /var/jb after 600 s"; echo "RESULT boot $B: FAIL ($F)"; exit 1; }
+info "$(uname -srm | cut -c1-90)"
+info "stamp $(cut -c1-40 /var/jb/.scion-stamp 2>/dev/null)"
+
+# owners and modes
+want "/var/jb" "$(stat -c '%u:%g %a' /private/var/jb)" "0:0 755"
+want "giveMeRoot" "$(stat -c '%u:%g %a' /var/jb/Applications/Sileo.app/giveMeRoot)" "0:0 4755"
+want "/var/jb/var/mobile" "$(stat -c '%u:%g' /var/jb/var/mobile)" "501:501"
+for f in /jb /usr/local/bin/jb_seed /usr/local/bin/var_sync /bin/cp /var/jb/usr/bin/dpkg /var/jb/etc/master.passwd; do
+	want "owner of $f" "$(stat -c '%u:%g' $f)" "0:0"
+done
+want "not root's outside var/ in the prefix and in /jb" "$(find /var/jb/usr /var/jb/bin /var/jb/sbin /var/jb/Applications /var/jb/Library /var/jb/etc /jb ! -user 0 2>/dev/null | wc -l | tr -d ' ')" "0"
+want "writable by everybody in the prefix" "$(find /private/var/jb ! -type l -perm -0002 2>/dev/null | wc -l | tr -d ' ')" "0"
+info "set-ID programs: $(find /private/var/jb -type f -perm /6000 2>/dev/null | sed 's|/private/var/jb/||' | sort | tr '\n' ' ')"
+# (no awk in the plain bootstrap: grep and cut only)
+want "accounts with a password" "$(grep -v '^#' /var/jb/etc/master.passwd | grep ':.*:.*:.*:.*:.*:.*:.*:.*:' | cut -d: -f2 | grep -v -x -e '[*]' -e '!' | wc -l | tr -d ' ')" "0"
+[ ! -e /var/jb/usr/sbin/sshd ] && ok "no OpenSSH server in the prefix" || bad "an OpenSSH server is in the prefix"
+if command -v netstat >/dev/null 2>&1; then
+	info "listening TCP sockets: $(netstat -an -p tcp 2>/dev/null | grep -c LISTEN) ($(netstat -an -p tcp 2>/dev/null | grep LISTEN | tr -s ' ' | cut -d' ' -f4 | tr '\n' ' '))"
+else
+	info "no netstat on this root: listening sockets not listed"
+fi
+
+# dpkg and Sileo
+want "dpkg --audit" "$(dpkg --audit 2>&1 | wc -l | tr -d ' ')" "0"
+want "Sileo in dpkg" "$(dpkg-query -W -f='${Status}' org.coolstar.sileo 2>&1)" "install ok installed"
+info "packages: $(dpkg-query -W 2>/dev/null | wc -l | tr -d ' '), firmware $(dpkg-query -W -f='${Version}' firmware 2>&1)"
+# uicache can neither register nor list on this port (it answers "Unable to register" for every path and lists
+# nothing): Sileo is registered by lsd's own rebuild, from its copy in /Applications (60-sileo.sh)
+[ -x /Applications/Sileo.app/Sileo ] && [ -e /Applications/Sileo.app/.scion-prefix-app ] && ok "Sileo's copy in /Applications" || bad "no copy of Sileo in /Applications"
+want "owner of /Applications/Sileo.app/giveMeRoot" "$(stat -c '%u:%g %a' /Applications/Sileo.app/giveMeRoot 2>/dev/null)" "0:0 4755"
+info "repositories: $(ls /var/jb/etc/apt/sources.list.d | tr '\n' ' ')"
+
+# what was written before is read after
+K=/private/var/mobile/Documents/scion-persist.txt
+echo "boot $B $(date -u +%H:%M:%SZ)" >> $K
+chown 501:501 $K
+want "lines in the kept file" "$(wc -l < $K | tr -d ' ')" "$B"
+
+# install, run, remove, from a repository on the phone itself
+if [ -f $T/repo/Packages ] && [ -f $T/repo/test.conf ]; then
+	. $T/repo/test.conf
+	S=/var/jb/etc/apt/sources.list.d/scion-test.sources
+	only="-o Dir::Etc::sourcelist=$S -o Dir::Etc::sourceparts=- -o APT::Get::List-Cleanup=0"
+	inst() { dpkg-query -W -f='${Status}' "$1" 2>/dev/null; }
+	if [ ! -e $T/installed ]; then
+		printf 'Types: deb\nURIs: file:%s/repo\nSuites: ./\nComponents:\nTrusted: yes\n' $T > $S
+		apt-get update $only > $T/apt-update.log 2>&1 && ok "apt-get update from $T/repo" || bad "apt-get update (see apt-update.log): $(tail -2 $T/apt-update.log | tr '\n' ' ')"
+		apt-get install -y $only "$PKG" > $T/apt-install.log 2>&1
+		want "$PKG after apt-get install" "$(inst "$PKG")" "install ok installed"
+		$RUN > $T/run.out 2>&1 && ok "ran: $RUN: $(head -2 $T/run.out | tr '\n' ' ')" || bad "$RUN: $(head -2 $T/run.out | tr '\n' ' ')"
+		apt-get remove -y "$PKG" > $T/apt-remove.log 2>&1
+		case "$(inst "$PKG")" in "install ok installed") bad "$PKG still installed after apt-get remove" ;; *) ok "$PKG removed" ;; esac
+		apt-get install -y $only "$PKG" >> $T/apt-install.log 2>&1
+		want "$PKG installed again, to be kept" "$(inst "$PKG")" "install ok installed"
+		if [ -n "${APP:-}" ]; then
+			apt-get install -y $only "$APP" > $T/apt-app.log 2>&1
+			want "$APP after apt-get install" "$(inst "$APP")" "install ok installed"
+		fi
+		: > $T/installed
+		sync
+	else
+		want "$PKG kept across the boot" "$(inst "$PKG")" "install ok installed"
+		$RUN > $T/run.out 2>&1 && ok "ran: $RUN" || bad "$RUN: $(head -2 $T/run.out | tr '\n' ' ')"
+		[ -z "${APP:-}" ] || want "$APP kept across the boot" "$(inst "$APP")" "install ok installed"
+	fi
+	[ -f $S ] && ok "the added repository is still listed" || bad "the added repository is gone"
+	if [ -n "${APPID:-}" ]; then
+		sleep 10
+		uicache -l 2>/dev/null | grep -q "$APPID" && ok "$APPID registered with LaunchServices" || bad "$APPID is not registered (an application installed by a package is not registered on this port yet: uicache cannot)"
+	fi
+else
+	info "no repository in $T/repo: the install test is not run"
+fi
+
+# the network, as it stands (nothing here needs it)
+info "addresses: $(ifconfig -a 2>/dev/null | grep 'inet ' | grep -v 127.0.0.1 | tr -s ' \t' ' ' | cut -d' ' -f3 | tr '\n' ' ')"
+if apt-get update -o Acquire::http::Timeout=15 -o Acquire::https::Timeout=15 -o Acquire::Retries=0 -o Dir::Etc::sourcelist=/var/jb/etc/apt/sources.list.d/procursus.sources -o Dir::Etc::sourceparts=- -o APT::Get::List-Cleanup=0 > $T/apt-net.log 2>&1 &&
+	! grep -q '^W:\|^E:\|^Err' $T/apt-net.log; then
+	info "network: apt-get update from apt.procurs.us worked"
+else
+	info "network: apt.procurs.us not reached ($(grep -m1 '^W:\|^E:\|^Err' $T/apt-net.log | cut -c1-120))"
+fi
+[ $F = 0 ] && echo "RESULT boot $B: PASS" || echo "RESULT boot $B: FAIL ($F)"
+sync
diff --git a/tools/ios27/wifi/64-wifi-nettest.sh b/tools/ios27/wifi/64-wifi-nettest.sh
new file mode 100755
index 000000000..b804d88c7
--- /dev/null
+++ b/tools/ios27/wifi/64-wifi-nettest.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+# 64-wifi-nettest.sh ROOT [undo] : a TEST root's network check at every boot (never a release root). SPDX-License-Identifier: MIT-0
+#
+# Adds the job com.scion.nettest to iOS's launchd cache (/System/Library/xpc/launchd.plist) and its script
+# /usr/local/libexec/scion-nettest.sh. Once a boot, after the package manager's prefix is there (/private/var/jb/.prepared,
+# 60-sileo.sh), it waits up to NETTEST_WAIT seconds (default 900) for an IPv4 address on any interface but lo0, then says into
+# /private/var/log/scion-nettest.log: the interfaces and routes, an HTTP GET of a public page done by user space (bash's
+# /dev/tcp, so the name goes through iOS's own resolver), and `apt-get update` (https, the prefix's sources). Nothing listens.
+# Hosts to fetch: /private/var/scion-test/nettest-hosts (default "example.com captive.apple.com"; an address works without DNS).
+# The interface to test is named in /private/var/scion-test/nettest-if (default: whatever has an address; "pdp_ip0" for the
+# modem's), so the same step tests Wi-Fi (en0) and the cellular interface.
+set -euo pipefail
+R=$1
+J=$R/System/Library/xpc/launchd.plist
+[[ -f $J ]] || { echo "64-wifi-nettest: $R has no launchd.plist" >&2; exit 1; }
+S=$R/usr/local/libexec/scion-nettest.sh
+if [[ ${2:-} == undo ]]; then
+	rm -f "$S"
+else
+	mkdir -p "$R/usr/local/libexec" "$R/private/var/scion-test"
+	cat > "$S" <<'SH'
+#!/var/jb/bin/bash
+# scion-nettest (tools/ios27/wifi/64-wifi-nettest.sh): a test root's network check, once a boot
+export PATH=/var/jb/usr/bin:/var/jb/bin:/var/jb/usr/sbin:/usr/bin:/bin:/usr/sbin:/sbin
+L=/private/var/log/scion-nettest.log
+exec >>"$L" 2>&1
+W=${NETTEST_WAIT:-900}
+IF=$(cat /private/var/scion-test/nettest-if 2>/dev/null || true)
+echo "=== $(date -u +%FT%TZ) nettest (interface: ${IF:-any})"
+addr=
+for i in $(seq 1 $((W / 5))); do
+	if [[ -n $IF ]]; then addr=$(/sbin/ifconfig "$IF" 2>/dev/null | grep 'inet ' | head -1)
+	else addr=$(/sbin/ifconfig -a 2>/dev/null | grep 'inet ' | grep -v '127.0.0.1' | head -1); fi
+	[[ -n $addr ]] && break
+	sleep 5
+done
+echo "address after $((i * 5)) s: ${addr:-none}"
+/sbin/ifconfig -a 2>&1 | grep -E '^[a-z]|inet |status' | head -40
+/usr/sbin/netstat -rn -f inet 2>&1 | head -20
+[[ -n $addr ]] || { echo "=== no address: no fetch"; exit 0; }
+fetch() {   # fetch HOST PATH: an HTTP/1.1 GET by bash itself (a name goes through iOS's resolver); 20 s a line at most
+	local t0=$(date +%s) out=/tmp/scion-nettest.$$
+	echo "fetch http://$1$2: start"
+	( exec 3<>"/dev/tcp/$1/80" || exit 7
+	  printf 'GET %s HTTP/1.1\r\nHost: %s\r\nConnection: close\r\nUser-Agent: scion-nettest\r\n\r\n' "$2" "$1" >&3
+	  n=0
+	  while [ $n -lt 30 ] && IFS= read -r -t 20 line <&3; do printf '%s\n' "$line"; n=$((n + 1)); done ) > $out 2>&1
+	local rc=$?
+	echo "fetch http://$1$2: rc $rc, $(wc -c < $out) bytes in $(( $(date +%s) - t0 )) s, first lines:"
+	head -3 $out | tr -d '\r'; grep -o '<title>[^<]*' $out | head -1
+	rm -f $out
+}
+for h in $(cat /private/var/scion-test/nettest-hosts 2>/dev/null || echo example.com captive.apple.com); do
+	fetch "$h" /
+done
+if [[ ! -f /private/var/scion-test/nettest-noapt ]]; then
+	echo "--- apt-get update"
+	/var/jb/usr/bin/timeout 180 /var/jb/usr/bin/apt-get update 2>&1 | tail -8
+fi
+echo "=== $(date -u +%FT%TZ) nettest done"
+SH
+	chmod 0755 "$S"
+	[[ $EUID != 0 ]] || chown 0:0 "$S"
+fi
+/usr/bin/python3 - "$J" "${2:-add}" <<'PY'
+import plistlib, sys
+path, how = sys.argv[1:]
+key = '/System/Library/LaunchDaemons/com.scion.nettest.plist'
+d = plistlib.load(open(path, 'rb')); jobs = d['LaunchDaemons']; before = key in jobs
+if how == 'undo':
+    jobs.pop(key, None)
+else:
+    jobs[key] = {'Label': 'com.scion.nettest', 'ProgramArguments': ['/var/jb/bin/bash', '/usr/local/libexec/scion-nettest.sh'],
+                 'RunAtLoad': True, 'WatchPaths': ['/private/var/jb/.prepared'], 'LaunchOnlyOnce': True,
+                 'LimitLoadToSessionType': 'System', 'ProcessType': 'Background'}
+data = plistlib.dumps(d, fmt=plistlib.FMT_BINARY); plistlib.loads(data)
+with open(path, 'r+b') as f:
+    f.truncate(0); f.write(data)
+print('64-wifi-nettest: com.scion.nettest %s (was %s)' % ('removed' if how == 'undo' else 'added', 'there' if before else 'absent'))
+PY
diff --git a/tools/modem/ext4ro-test.c b/tools/modem/ext4ro-test.c
new file mode 100644
index 000000000..c4d85c9b1
--- /dev/null
+++ b/tools/modem/ext4ro-test.c
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: MIT-0
+/*
+ * tools/modem/ext4ro-test.c: the kernel's read-only ext4 reader (drivers/modem/hakios.ext4ro.h) run on the host
+ * against an image file, to check it before a phone does: ext4ro-test IMAGE PATH [EXPECTED_SHA256]
+ *
+ * Reads IMAGE only (opened O_RDONLY), finds PATH in it, and says the file's size and the first 8 hex digits of its
+ * SHA-256; with EXPECTED_SHA256 it says MATCH or DIFFERENT. It never prints or writes the file's bytes (the file it is
+ * meant for, a phone's nv_data.bin, is private).
+ *
+ * Build (macOS): cc -O2 -o ext4ro-test ext4ro-test.c -I ../../drivers/modem
+ */
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+#include <unistd.h>
+#include <CommonCrypto/CommonDigest.h>
+
+#include "hakios.ext4ro.h"
+
+static int
+image_read(void *ctx, uint64_t off, void *dst, uint32_t len)
+{
+	ssize_t n = pread(*(int *)ctx, dst, len, (off_t)off);
+
+	return n == (ssize_t)len ? 0 : EIO;
+}
+
+int
+main(int argc, char **argv)
+{
+	struct ext4ro fs = { 0 };
+	uint64_t size = 0, cap = 64u << 20;
+	unsigned char md[CC_SHA256_DIGEST_LENGTH];
+	char hex[2 * CC_SHA256_DIGEST_LENGTH + 1];
+	uint8_t *buf;
+	int fd, e;
+
+	if (argc < 3) {
+		fprintf(stderr, "usage: ext4ro-test IMAGE PATH [EXPECTED_SHA256]\n");
+		return 2;
+	}
+	if ((fd = open(argv[1], O_RDONLY)) < 0) {
+		perror(argv[1]);
+		return 1;
+	}
+	fs.read = image_read;
+	fs.ctx = &fd;
+	if ((e = ext4ro_open(&fs)) != 0) {
+		printf("ext4ro: open: errno %d\n", e);
+		return 1;
+	}
+	printf("ext4ro: block %u bytes, inode %u bytes, %u inodes a group, descriptors %u bytes, %llu blocks%s\n",
+	    fs.block_size, fs.inode_size, fs.inodes_per_group, fs.desc_size, (unsigned long long)fs.blocks,
+	    fs.is64 ? ", 64-bit" : "");
+	fs.blk = malloc(fs.block_size);
+	fs.blk2 = malloc(fs.block_size);
+	buf = malloc(cap);
+	if ((e = ext4ro_read_file(&fs, argv[2], buf, cap, &size)) != 0) {
+		printf("ext4ro: %s: errno %d\n", argv[2], e);
+		return 1;
+	}
+	CC_SHA256(buf, (CC_LONG)size, md);
+	for (int i = 0; i < CC_SHA256_DIGEST_LENGTH; i++) {
+		snprintf(hex + 2 * i, 3, "%02x", md[i]);
+	}
+	printf("ext4ro: %s: %llu bytes, sha256 %.8s...\n", argv[2], (unsigned long long)size, hex);
+	if (argc > 3) {
+		printf("ext4ro: %s\n", strcasecmp(hex, argv[3]) == 0 ? "MATCH" : "DIFFERENT");
+		return strcasecmp(hex, argv[3]) == 0 ? 0 : 1;
+	}
+	return 0;
+}
diff --git a/userland/src/jb_seed.c b/userland/src/jb_seed.c
index 5677790ff..82e428d7e 100644
--- a/userland/src/jb_seed.c
+++ b/userland/src/jb_seed.c
@@ -81,6 +81,13 @@ remove_tree(const char *path)
 	}
 }
 
+/*
+ * Owners. Everything in the bootstrap and in Sileo's package is root:wheel but var/mobile (for_mobile() below), so
+ * the copy is made root:wheel whatever the image says. An image made or edited without root (a mount without owners
+ * on the builder's machine) carries the builder's user ID, or 99, "unknown", which the kernel shows to each process as
+ * that process's own: a prefix whose programs any application could rewrite, and a giveMeRoot whose set-user-ID bit
+ * names nobody.
+ */
 static int
 copy_file(const char *from, const char *to, const struct stat *st)
 {
@@ -104,7 +111,7 @@ copy_file(const char *from, const char *to, const struct stat *st)
 		}
 	}
 	/* owner first: chown takes set-user-ID off, and giveMeRoot and login live by it */
-	ok = ok && n == 0 && fchown(out, st->st_uid, st->st_gid) == 0 && fchmod(out, st->st_mode & 07777) == 0;
+	ok = ok && n == 0 && fchown(out, 0, 0) == 0 && fchmod(out, st->st_mode & 07777) == 0;
 	close(out);
 	close(in);
 	return ok;
@@ -136,7 +143,7 @@ copy_tree(const char *from, const char *to)
 			ssize_t length = readlink(f, link, sizeof(link) - 1);
 
 			link[length > 0 ? length : 0] = 0;
-			ok = length > 0 && symlink(link, t) == 0 && lchown(t, entry.st_uid, entry.st_gid) == 0;
+			ok = length > 0 && symlink(link, t) == 0 && lchown(t, 0, 0) == 0;
 		} else if (ok) {
 			ok = copy_file(f, t, &entry);
 		}
@@ -147,7 +154,75 @@ copy_tree(const char *from, const char *to)
 	}
 	closedir(dir);
 	/* last: the directory was 0700 while it was filled */
-	return ok && chown(to, st.st_uid, st.st_gid) == 0 && chmod(to, st.st_mode & 07777) == 0;
+	return ok && chown(to, 0, 0) == 0 && chmod(to, st.st_mode & 07777) == 0;
+}
+
+/* PATH and all under it root:wheel, modes as they are (chown takes the set-ID bits off: put back); how many were not */
+static int
+root_tree(const char *path)
+{
+	struct stat st;
+	DIR *dir;
+	struct dirent *de;
+	char entry[1024];
+	int n = 0;
+
+	if (lstat(path, &st) != 0) {
+		return 0;
+	}
+	if ((st.st_uid != 0 || st.st_gid != 0) && lchown(path, 0, 0) == 0) {
+		n++;
+		if ((st.st_mode & S_IFMT) != S_IFLNK) {
+			chmod(path, st.st_mode & 07777);
+		}
+	}
+	if ((st.st_mode & S_IFMT) == S_IFDIR && (dir = opendir(path)) != NULL) {
+		while ((de = readdir(dir)) != NULL) {
+			if (strcmp(de->d_name, ".") != 0 && strcmp(de->d_name, "..") != 0 && join(entry, sizeof(entry), path, de->d_name)) {
+				n += root_tree(entry);
+			}
+		}
+		closedir(dir);
+	}
+	return n;
+}
+
+/*
+ * The same for what an iOS 27 root carries for the prefix outside it (tools/ios27/fullroot/steps.d/60-sileo.sh):
+ * this program, var_sync, the five names in /bin that Sileo runs, and the image's copy of the prefix. A root built as
+ * root has them root's already and nothing is touched; one edited without root gets them made so here, by the first
+ * process that runs any of it. Only these names, and a name in /bin only if it is a link into the prefix.
+ */
+static void
+claim(const char *from)
+{
+	static const char *const paths[] = { "/usr/local/bin/jb_seed", "/usr/local/bin/var_sync", "/bin/chmod", "/bin/cp",
+		                             "/bin/mkdir", "/bin/mv", "/bin/rm",
+		                             "/usr/local/libexec/scion-sileo-selftest.sh" /* a test root's */ };
+	struct stat st;
+	char link[64];
+	int n = 0;
+
+	for (size_t i = 0; i < sizeof(paths) / sizeof(paths[0]); i++) {
+		if (lstat(paths[i], &st) != 0 || (st.st_uid == 0 && st.st_gid == 0)) {
+			continue;
+		}
+		if ((st.st_mode & S_IFMT) == S_IFLNK) {
+			ssize_t length = readlink(paths[i], link, sizeof(link) - 1);
+
+			link[length > 0 ? length : 0] = 0;
+			if (strncmp(link, "/var/jb/", 8) == 0 && lchown(paths[i], 0, 0) == 0) {
+				n++;
+			}
+		} else if ((st.st_mode & S_IFMT) == S_IFREG && lchown(paths[i], 0, 0) == 0) {
+			chmod(paths[i], 0755);
+			n++;
+		}
+	}
+	n += root_tree(from);
+	if (n > 0) {
+		printf("jb_seed: %d paths of the image made root's (it was made without owners)\n", n);
+	}
 }
 
 /* The user's corner of the prefix: applications run as mobile and keep their data there (Sileo's database). */
@@ -342,6 +417,7 @@ main(void)
 		return 0;
 	}
 	setpriority(PRIO_PROCESS, 0, 10);
+	claim(from);
 	if (strcmp(fs.f_fstypename, "hfs") == 0) {
 		(void)reseed_if_changed(from);
 		if (stat(PREFIX MARK, &st) != 0 && !seed(from)) {