IOHIDFamily memory corruption leading to app termination

Repository contains two standalone Xcode iOS application PoCs targeting CVE-2026-28992 in Apple IOHIDFamily, specifically IOHIDEventServiceFastPathUserClient. It is not part of an exploit framework. The repo structure is split into two app projects: UAFPoc/ for a kernel use-after-free/copyEvent race and AOPPanicPoc/ for an AOP/SPU panic via termination race and mailbox saturation. Most files are standard Xcode scaffolding (AppDelegate, SceneDelegate, storyboards, plist, assets); the substantive exploit logic is concentrated in AOPPanicPoc/AOPPanicPoc/ViewController.m, while README.md and report.txt document both bugs in detail. Core capability: from a normal sandboxed iOS app with no special entitlements, the code dynamically uses IOKit APIs to locate/open IOHIDEventService with IOServiceOpen(..., type=2), creating IOHIDEventServiceFastPathUserClient connections. The exploit abuses an authorization bypass by supplying XML properties FastPathHasEntitlement and FastPathMotionEventEntitlement to selector 0 (open), which the vulnerable gate incorrectly trusts. After bypassing the gate, the PoCs create high-frequency connection lifecycle races using IOConnectCallMethod selector 0/1 and mach_port_destroy or mach_port_destruct to trigger asynchronous teardown paths. The documented UAF vector uses multiple connections to the same provider so that close/terminate frees provider-side objects while concurrent open/copyEvent activity iterates shared collections under inconsistent locking, producing a kernel UAF and panic/reboot. The AOP panic vector repeatedly opens and destroys gated connections to SPU-backed providers, saturating the outbox and causing an AOP firmware assertion and device reboot. No remote C2, network scanning, or external callback infrastructure is present; this is a local denial-of-service/kernel crash PoC rather than a code-execution implant. The exploit appears to be proof-of-concept quality: reliable enough to reproduce crashes on listed test devices, but focused on panic/reboot rather than privilege escalation or a post-exploitation payload.