{
  "schema": "moon-eclipse/kernel-matrix/1",
  "generatedAt": "2026-11-01",
  "description": "内核 release → 漏洞/配置自动匹配矩阵。数据来自官方 OTA 整包 + 工具内置 libextract 实测（2026-11-01）。",
  "source": "PLZ110 官方 OTA 整包（romprovider → 官方 CDN）经 libextract 解析",
  "matchOrder": [
    "release-exact",
    "release-normalized",
    "release-family"
  ],
  "unknownPolicy": "refuse",
  "kernels": [
    {
      "release": "6.12.38-android16-5-g844001fb8721-ab14552068-4k",
      "kernelMajor": 6,
      "android": "16",
      "status": "supported",
      "primitive": "present",
      "ghostlock": true,
      "diceSupported": false,
      "verifiedAt": "2026-11-01 16:48",
      "verifiedBy": "libextract（工具内置 CLI）解析官方 OTA 整包",
      "firmwares": [
        "16.0.7.201",
        "16.0.8.300",
        "16.0.9.400",
        "16.0.10.500"
      ],
      "profile": "kernel_profiles/6.12.38-android16-5-g844001fb8721-ab14552068-4k.conf",
      "blob": "profile_blobs/6.12.38-android16-5-g844001fb8721-ab14552068-4k.bin",
      "offsets": {
        "pselect": "0x90",
        "futex": "0x1c0",
        "buffer": "0x40",
        "waiter": "0xa0",
        "shift": "0",
        "mm_struct": "0x4C0",
        "init_task": "0x240CF00",
        "kernel_phys_load": "0xC7800000"
      },
      "note": "16.0.7.201/16.0.8.300/16.0.9.400/16.0.10.500 四版 boot.img 不同但内核 offsets 逐字节相同；v1.8.0 起已内置该内核 profile+blob，可直接自动匹配。"
    },
    {
      "release": "6.12.69-android16-6-g242e1a07f878-ab15865446-4k",
      "kernelMajor": 6,
      "android": "16",
      "status": "patched",
      "primitive": "fixed",
      "ghostlock": false,
      "diceSupported": false,
      "verifiedAt": "2026-11-01 15:51",
      "verifiedBy": "libextract --analysis 解析官方 OTA 整包",
      "firmwares": [
        "17.0.0.107"
      ],
      "profile": "",
      "blob": "",
      "offsets": {},
      "note": "rtmutex UAF 修复已进内核（remove_waiter@0x12a7cf4 不再读 current），CVE-2026-43499 不可用；GhostLock / pkj110 均不适用。"
    }
  ]
}