Track B history — the root journey (EZIH → DZI1 → persist end state)

CVE-2026-43499 (GhostLock) device-specific port. Full recipe in temp-root.md; this is the chronology of how it got reliable.

Milestones

1. EZIH root proven — payload v5 (5CD46863…, EZIH offsets, mm_struct_sz 0x400). First stable temp root on the stock bit-4 build.
2. DZI1 port (after the downgrade): rebuilt payload with mm_struct_sz 0x3c0 → 0x400 for the DZI1 kernel entry + removed umh_skip_pre_drain from the offsets entry. Result: leak + CFI + pipe write + SELinux permissive + UMH helper all verified on kernel 6.1.145-android14-11-33418572-abF956BXXS4DZI1 with FOPS_DELAY_USEC=30000 (payload 27AF758B…).
3. Helper socket-steal fix — the su daemon accepted non-root entry; added the root-only guard in daemon_main (helper 918BBE6D…).
4. The persist build — SU_PERSIST_ONE_SHOT=1 (su_daemon_persist.c): after the one-shot handoff shell exits, the daemon stays alive. Any adb shell can then run pompomsu-helper <cmd> → uid 0, kernel context, until the next reboot (helper 772A04BF…).

Timing knowledge (earned the hard way)

• Fresh boot + unlocked screen → first or second attempt hits, almost always.
• One attempt per boot. In-boot retries corrupt futex state → panics. (Matches the Kitploit S26 warning: reboot before retrying.)
• Do not quiesce the system. Airplane mode and load-gating (loadavg waits) made the race miss consistently — normal scheduler/modem activity is part of the timing window. Busy boots (SIM provisioning, Play churn) also degrade the hit rate → reboot.
• The winning loop: reboot → settle ~30 s → wake/stayon → one shot → check uid → if miss, reboot (automated; see temp-root.md).

Quirks worth knowing (generic)

• Kernel-context root shells (u:r:kernel:s0) cannot look up binder services and cannot write persist.* properties. runcon u:r:shell:s0 keeps uid 0 and restores servicemanager access — but runcon itself only works while SELinux is permissive.
• ksud (KernelSU daemon) is build-specific: the EZIH ksud was refused by DZI1. Root-shell mode doesn't need it.
• The helper's client argv-mode is broken on this build — pipe commands into the no-arg helper (root shell reads stdin) instead.