Temp root recipe (Track B) — per-boot, end state

CVE-2026-43499 (GhostLock) device-specific port for F956BXXS4DZI1 (kernel 6.1.145-android14-11-33418572-abF956BXXS4DZI1). Build details and offsets live in the device folder of the payload source; hashes here identify the working artifacts.

Working artifacts (DZI1)

payload: sha256 27AF758BC76BF3126C6464A17490F1F153F80420C55771E8CBD0179F3E1B2EBE
su helper (persist build, SU_PERSIST_ONE_SHOT=1): sha256 772A04BF40062C7147CF24DC47C1AB5B43EDA4FC474C73D785DEE348827348D8

Recipe (verified, one shot per boot)

sh

push payload + helper to /data/local/tmp, chmod 755, then:

cd /data/local/tmp FOPS_DELAY_USEC=30000 \ GHOSTLOCK_ROOT_SHELL=1 \ GHOSTLOCK_HOME=/data/local/tmp \ GHOSTLOCK_HELPER_PATH=/data/local/tmp/pompomsu-helper \ GHOSTLOCK_KSUD_PATH=/data/local/tmp/ksud \ ./payload

The handoff drops you into a root shell (`uid=0(root) gid=0(root)
context=u:r:kernel:s0`). SELinux ends Permissive until reboot. With the persist helper
build, the su daemon survives the payload exit:

```sh```
# any adb shell, until next reboot:
/data/local/tmp/pompomsu-helper &lt;command&gt;   # run &lt;command&gt; as root
/data/local/tmp/pompomsu-helper             # root shell

Timing notes (empirically dialed)

Fresh boot + unlocked screen → hits on cycle 1-2 almost every time.
One attempt per boot. Retrying in the same boot corrupts futex state and can panic the device (matches the Kitploit S26 warning).
Do NOT quiesce the system. Airplane mode / load-gating made the race miss consistently on this kernel — normal scheduler/modem activity is part of the timing.
Busy boots (SIM re-provisioning, Play services churn) cause 10-miss streaks → reboot and retry.

Important

NEVER install the October 2026 SMR — it patches CVE-2026-43499. Keep OTA agents disabled (com.wssyncmldm, com.sec.android.soagent).
Root is per-boot. Nothing persists across a reboot except the files in /data/local/tmp.
Kernel-context shells can't reach servicemanager and can't set persist.* props — use runcon u:r:shell:s0 for binder calls while keeping uid 0.