The modern checkm8 continuation patches code signing, mount policy and task ports, and has no page-protection patch at all. What the gap in its own patch set says about the boundary everyone assumes is being crossed.
The bootrom era was unpatchable but fully readable. The userland era inverted both properties: every bug had a fix, and most of the tool’s shipped life has no published source at all.
The boot ROM is the one component no update can reach, so a bug in it is a bug in the hardware’s own trust anchor. What checkm8 established about unpatchable vulnerabilities, read from the public record rather than from a device.
WebKit and the app layer are the Apple surfaces you can actually study without a research device. How the browser’s processes are isolated from each other, what crosses between them, and where a third-party app’s own checks sit relative to the server’s.
A boundary-first map of the iOS stack, from app sandbox and XPC through XNU subsystems to PAC, SPTM, and the Secure Enclave, with the evidence gates I use before calling anything a finding.
Removing refusal behavior from an open model is technically easy. The hard part is proving what changed, containing the new failure modes, and keeping an agent with tools inside a safe boundary.