Out-of-bounds read in Apple IOSurfaceAccelerator

Repository is a small, self-contained Objective-C proof-of-concept for CVE-2026-43655, an AppleM2ScalerCSCDriver / IOSurfaceAccelerator use-after-free reachable from a default iOS app sandbox. Structure is minimal: README.md provides the technical write-up and reproduction steps, ScalerTeardownUAF.m contains the full exploit logic and iOS UI wrapper, and entitlements.plist contains only get-task-allow for signing. The code is not part of a larger exploit framework. The main exploit flow is implemented in ScalerTeardownUAF.m inside UAFVC::runUAF. It obtains the AppleM2ScalerCSCDriver service with IOServiceGetMatchingService, opens a victim connection with IOServiceOpen, creates source and destination IOSurface objects, and submits a synchronous baseline request via IOConnectCallMethod selector 1. It then sets a victim marker value 0xDEAD0001 using selector 10, submits 50 asynchronous operations by setting TSD offset 0x008 to 1, and closes the victim connection with IOServiceClose. After teardown, it opens 50 replacement spray connections to the same driver, sets each spray connection marker to 0xBEEF0002 via selector 10, and repeatedly submits additional async operations to encourage allocator reuse and scheduler activity. The exploit capability is to reliably prime a stale scheduler entry in a shared kernel scheduler and demonstrate that the scheduler later dereferences freed-and-reused operation memory. The intended observable is a panic/reboot where register x9 contains 0xBEEF0002, proving the scheduler read replacement connection data rather than the original victim marker. The README further explains that the actual trigger may occur later when SpringBoard/compositor activity drives another scaler scheduling cycle, making this a cross-connection and potentially cross-process trigger condition. No network communication, remote C2, or external URLs are present. The relevant fingerprintable targets are local IOKit service names, bundle identifiers, and build/package file paths. Overall, this is a genuine local kernel crash/UAF reproduction PoC focused on demonstrating memory lifetime corruption rather than achieving privilege escalation or code execution.