Calif MIE exploitation challenge

Work timeline & time flamegraph — July 31 → August 5, 2026
43.0 h
Active time (sleep excluded)
8.82 M
Est. tokens (main + subagents)
18
Phases
205.0 k
Est. tokens / active hour

Timeline

Jul 28 10:00
Jul 29 10:00
Jul 30 10:00
Jul 31 10:00
Aug 1 10:00
Aug 2 10:00
Aug 3 10:00
Aug 4 10:00
P0Initial PoCs: RqLs trigger + WebDAV leak
210m · 660 k
P1Calif MIE kickoff: write primitive confirmed
195m · 668 k
P2Readback struggles & infra stabilization
47m · 495 k
P3Locator attempts (anchors, histograms, bands)
167m · 452 k
P4Slide discovery (churn + consensus)
62m · 157 k
P5Grind loops: gap-persistent sweeps
40m · 100 k
P6Static write-verify + slide via stack remnant
138m · 280 k
P7Parse-switch analysis + DH2Q + deposit
93m · 391 k
P8Root-cause + documentation
41m · 94 k
P9Readback design + VM bootstrap campaign
320m · 720 k
P10Oracle semantics + auto-reboot pipelines
240m · 480 k
P11Write-verify ×3 + slide routine (9 slides)
130m · 449 k
P12Escalation writes + alignment & contention rules
165m · 702 k
P13Sterility wall + heap-garbage correction
150m · 605 k
P14Pivot: anchor ladder + KDP/nvram + kread tooling
190m · 788 k
P15smbfs parse RE + handoff race redesign
145m · 689 k
P16Zone-freelist plateaus + zone_pipeline campaign
155m · 726 k
P17Overnight plateau grinder + buffer-VA derivation
95m · 367 k

Time flamegraph

P0 · 210m
P1 · 195m
P3 · 167m
P6 · 138m
P9 · 320m
P10 · 240m
P11 · 130m
P12 · 165m
P13 · 150m
P14 · 190m
P15 · 145m
P16 · 155m

Phases

PhaseWindow (UTC)Active minHoursMain tokSub tokWhat happened
P0Initial PoCs: RqLs trigger + WebDAV leak 07-28 10:00 → 07-31 14:002103.5h 512,000148,000Bug analysis from the Calif blog (RqLs create-context confusion + WebDAV uninitialized buffer); evil SMB server; trigger_fsgetpath PoC; evil_webdav_server + leak_client; first VM panics (unaligned CAS, invalid mutex) — both bugs firing.
P1Calif MIE kickoff: write primitive confirmed 07-31 14:00 → 08-01 00:001953.2h 395,868272,071Blog analysis (SMB RqLs confusion + WebDAV leak), evil SMB (:4445/:4446) & WebDAV (:8080) servers, fsgetpath key-oracle, write primitive CONFIRMED (12+ HITs: file_id + ENOENT).
P2Readback struggles & infra stabilization 08-01 00:00 → 08-01 09:00470.8h 58,421436,491panic-before-verify era: verify_loop, pin_late stray loops causing VM panic-loops (sweep auto-start), stray-process hunts, mount wedges, leak pileups, boot-settle discipline.
P3Locator attempts (anchors, histograms, bands) 08-01 09:00 → 08-01 16:301672.8h 452,2420solveB_full anchors, calib_candidates, zone-band ptr->blob histograms, plan_round per-page analysis, grind_big band sweep — all disproven (stale-gen VAs / clog economics).
P4Slide discovery (churn + consensus) 08-01 16:30 → 08-01 20:30621.0h 156,8610churn_vt OSData/OSArray churn -> 72 text pointers -> consensus solve -> KASLR slide 0x10718000 (2 exact + 8 near symbol matches).
P5Grind loops: gap-persistent sweeps 08-01 20:30 → 08-02 02:00400.7h 100,1680probe_map (down-sweep w/ gap state), walk_down, sweep_window, fd_run; HITs every ~2 boots; mount/leak hardening (boot settle, agent warm-up, orphan purge).
P6Static write-verify + slide via stack remnant 08-02 02:00 → 08-02 07:301382.3h 280,0860slidingbucket fail (Xsan slide), #mem-dynamic-control target: right-key EIO x2 vs wrong-key retry = WRITE VERIFIED; deep.bin: photographed kernel stack -> slide 0x5d8000 (94% symbolization).
P7Parse-switch analysis + DH2Q + deposit 08-02 07:30 → 08-02 11:00931.6h 201,055190,315Subagent branch analysis: 16-byte equality oracle identified; DH2Q path confirmed (2/2 panics = stack write lands); deposit steering attempts; fake-vnode concept.
P8Root-cause + documentation 08-02 11:00 → 08-02 12:00410.7h 94,0750DH2Q mutex-validation root cause (errno high byte never 0x22 -> dead end); AGENT.md seed knowledge; this timeline.
P9Readback design + VM bootstrap campaign 08-02 15:30 → 08-03 01:003205.3h 720,0000G-4 readback trick + VM static target (vm-kernelcache G=0xfffffe000a8be9c0); leak sterility proven (no text ptrs); spray_race fill bug (+8..15 zero); sweep panics root-caused (released sprays = torn VAs); OOL live-record swath (queued mach OOL, receive=readback); zone-map layout mapped (fixed offsets, random base).
P10Oracle semantics + auto-reboot pipelines 08-03 01:00 → 08-03 06:302404.0h 480,0000Oracle cracked: errno useless (ENOENT both ways), server-log create count is the truth (1=match, 3=retry, hang=hostile lock, creates=0=unarmed mount); 0xAA/0xBB=XNU poison control-key bug; slide=last_op-0xfffffe0009b9fe64 proven via panic symbolization; pipelines v1-v12 grinding ~70 boots (cluster-anchored probes, auto-reboot); bootstrap still open.
P11Write-verify ×3 + slide routine (9 slides) 08-03 06:30 → 08-03 14:301302.2h 341,000108,000Static write at G + G-4 byte-exact readback on 3 boots (criterion a DONE); text-consensus slide routine proven on 9 boots (0x26d78000, 0x12f1c000, 0xbfac000 ...); panic-log thread/task captures (criterion b partial).
P12Escalation writes + alignment & contention rules 08-03 14:30 → 08-03 22:301652.8h 478,000224,000isAMFIGetOutOfMyWay write landed ×2 (system destabilizes = proof of effect); 4-mod-8 alignment rule root-caused (_securelevel unaligned panics); 0x22 mutex-typing rule for contention; Calif friendship = parent/child lease keys decoded.
P13Sterility wall + heap-garbage correction 08-03 22:30 → 08-04 08:301502.5h 519,00086,000VM leaks stop producing text pointers entirely; pipeline4 grinds 30+ boots; heap-garbage-vs-real pointer root cause (0xfffffe00_2x family); symbolization (symfrac) validator added; kpwatch/esc_watch armed.
P14Pivot: anchor ladder + KDP/nvram + kread tooling 08-04 15:30 → 08-04 20:301903.2h 612,000176,000Grinding killed. Blind ladder of historical OOL band (band mapped, all hostile). vm_kread/rootchain/roothelp + key-file servers built. nvram.bin boot-args patching PROVEN (benign edits boot); debug=0x144 halts for KDP, KDP over virtio dead; slide=0/0x1000000 unbootable on VMAPPLE.
P15smbfs parse RE + handoff race redesign 08-04 20:30 → 08-04 23:301452.4h 428,000261,000Subagent RE (src+binary verified): last_op/activation are TRANSIENT (zeroed on unlock) — race mandatory; full write-set enum (u32@+2c, u16@+50, flag RMWs); no list-insert/callout; parent-compare order; RO-cred (ZC_READONLY) + PAC-signed ptr dead ends; handoff race designed (racecap2).
P16Zone-freelist plateaus + zone_pipeline campaign 08-04 23:30 → 08-05 02:001552.6h 587,000139,000Zone/band freelist links in leaks → 171-vote buffer-VA plateaus; proc-zone discovery (0x578 stride — anchor-free survey path); chain validation; coalescing-vs-fragmentation + zfree-poison mechanics; zone_pipeline v1→v17 evolution; overnight 60-cycle grinder.
P17Overnight plateau grinder + buffer-VA derivation 08-05 02:00 → 08-05 08:10951.6h 305,00062,00010+ chain-validated plateaus overnight; buffer VA derived exactly via link-target/dump-offset mapping; live-buffer-occupancy insight (probes at the buffer VA hang because webdavfs keeps the file cache live); LIFO chunk-reuse probing; stride classification of freelist families (proc 0x578 vs kalloc arrays).

Active time counts minutes with recorded session activity; gaps > 25 min (VM/host sleep) are excluded. Token estimates ≈ wire bytes / 4 (main agent per phase window; subagents at their start phase), cross-checked against API usage records. ±10%. Regenerated from data.json by gen.py.