fix: kext: sysfs_iokit: read kext list from gLoadedKextSummaries

The kext failed to start on macOS 26.5: the kernel rejected it with

    Failed to bind '__ZN6OSKext18copyLoadedKextInfoEP7OSArrayS1_' in
    'com.beako.filesystems.sysfs' (at offset 0xc8 in __DATA_CONST,
    __auth_got) as could not find a kext which exports this symbol

The release kernel pruned the kpi.libkern symbol set - nm against
kernel.release.t8142 (25F84) shows neither OSKext::copyLoadedKextInfo()
nor kmod_get_info() exported. Nothing in the loaded-kext query path
survived.

The module list is now read from gLoadedKextSummaries, the kernel's
exported, write-protected loaded-kext summary table (the one the panic
log and lldb consume). It is rebuilt on every kext load/unload under the
summary lock; the build of the mirror structs mirrors
OSKextLoadedKextSummaryHeader/Summary from OSKextLibPrivate.h.

Read side is defensive: the table version and entry_size are validated
before walking it, so a layout drift fails loudly instead of traversing
garbage, and zero-address entries (empty slots) are skipped. The summary
carries no retain count, so refcnt publishes as 0; OSKextVersion is
decoded back to major.minor[.revision][d|a|b|f<n>] as the kernel's own
version string would render it.

The table is not reference-counted and can be freed when it grows, so a
concurrent rebuild may race a read; as a best-effort snapshot taken off
the VFS lock path this is acceptable, and a version==0 table mid-rebuild
is detected and skipped.

Author: somestupidgirl

kext/sysfs_iokit.cpp

@@ -37,23 +37,45 @@
 #include <libkern/c++/OSCollectionIterator.h>
 
 /*
- * OSKext::copyLoadedKextInfo() is declared here rather than by including
- * <libkern/c++/OSKext.h>, which is unusable from a kext build: it pulls in
- * <libkern/OSKextLibPrivate.h>, a private header the SDK does not ship. A
- * one-method declaration is enough - a static member call mangles from the
- * class name and parameter types alone, so this emits exactly the same symbol
- * reference the real header would, without vendoring private headers.
+ * The release kernel no longer exports OSKext::copyLoadedKextInfo() - the
+ * kpi.libkern symbol set was pruned (verified against kernel.release.t8142 for
+ * macOS 26.5.2, build 25F84). The loaded-kext snapshot is instead read from
+ * the kernel's own loaded-kext summary table, published as the exported global
+ * gLoadedKextSummaries: a write-protected header followed by one entry per
+ * loaded kext, rebuilt on every kext load/unload
+ * (libkern/c++/OSKext.cpp: OSKext::updateLoadedKextSummaries()). It is the same
+ * table the panic log and lldb consume.
  *
- * The return type is spelled OSDictionary* because OSPtr<T> is a plain T* in
- * kext builds, and the return type takes no part in C++ mangling regardless.
- *
- * Caller owns a reference to the returned dictionary.
+ * The structures mirror OSKextLoadedKextSummaryHeader/OSKextLoadedKextSummary
+ * from <libkern/OSKextLibPrivate.h>. entry_size is validated at read time so a
+ * layout drift fails loudly instead of walking garbage. name[] is KMOD_MAX_NAME
+ * (64) bytes as fixed in <mach/kmod.h>.
  */
-class OSKext {
-public:
-    static OSDictionary *copyLoadedKextInfo(OSArray *kextIdentifiers,
-                                            OSArray *keys);
+#define SYSFS_KEKXT_SUMMARY_VERSION 2
+
+struct sysfs_oskext_summary {
+	char     name[64];
+	uint8_t  uuid[16];
+	uint64_t address;
+	uint64_t size;
+	uint64_t version;              /* packed OSKextVersion, decoded below */
+	uint32_t loadTag;
+	uint32_t flags;
+	uint64_t reference_list;
+	uint64_t text_exec_address;
+	size_t   text_exec_size;
+};
+
+struct sysfs_oskext_summary_header {
+	uint32_t version;
+	uint32_t entry_size;
+	uint32_t numSummaries;
+	uint32_t reserved;
+	struct sysfs_oskext_summary summaries[0];
 };
+
+extern struct sysfs_oskext_summary_header *gLoadedKextSummaries;
+
 #include <libkern/libkern.h>
 
 #include <string.h>
@@ -361,46 +383,34 @@ sysfs_count_entries(void)
 /*
  * Capture the loaded kext list into the snapshot, for /sys/module.
  *
- * copyLoadedKextInfo() is asked for only the four keys we publish rather than
- * the full per-kext dictionary, which keeps the work (and the time the kext
- * lock is held) proportional to what we actually use. A kext missing any of
- * them is still listed - the value simply reads as zero or empty - because a
- * present-but-incomplete module is more useful than a hidden one.
+ * The list is read from gLoadedKextSummaries, the kernel's exported loaded-kext
+ * summary table (mirror structs above). It is write-protected and rebuilt on
+ * every kext load/unload, and it is built for exactly this kind of external
+ * read (panic log, lldb). Entries with a zero address are empty slots and are
+ * skipped. The table is not reference-counted, so refcnt is published as 0;
+ * name, load_tag, load_size and version are populated from the summary.
+ *
+ * version is a packed OSKextVersion: major*1e8 + minor*1e6 + revision*1e4 +
+ * stage*1e3 + stage_level, with stages dev=1, alpha=3, beta=5, candidate=7,
+ * release=9 (libkern/OSKextVersion.c). It is rendered the way the kernel's own
+ * OSKextVersionGetString() would: "major.minor[.revision][a|b|f|d<n>]".
  *
  * Failure here is never fatal: the snapshot is published regardless and
  * /sys/module reads as empty, exactly as it does before the first refresh.
  */
 static void
 sysfs_snap_build_modules(struct sysfs_snapshot *snap)
 {
-    static const char * const wanted[] = {
-        "OSBundleLoadTag",
-        "OSBundleLoadSize",
-        "OSBundleRetainCount",
-        "CFBundleVersion",
-    };
-
-    OSArray *keys = OSArray::withCapacity(4);
-    if (keys == nullptr) {
-        return;
-    }
-    for (unsigned i = 0; i < 4; i++) {
-        const OSSymbol *sym = OSSymbol::withCString(wanted[i]);
-        if (sym != nullptr) {
-            keys->setObject(const_cast<OSSymbol *>(sym));
-            sym->release();
-        }
-    }
+    struct sysfs_oskext_summary_header *hdr = gLoadedKextSummaries;
 
-    OSDictionary *info = OSKext::copyLoadedKextInfo(nullptr, keys);
-    keys->release();
-    if (info == nullptr) {
+    if (hdr == nullptr ||
+        hdr->version != SYSFS_KEKXT_SUMMARY_VERSION ||
+        hdr->entry_size != sizeof(struct sysfs_oskext_summary)) {
         return;
     }
 
-    uint32_t cap = info->getCount();
+    uint32_t cap = hdr->numSummaries;
     if (cap == 0) {
-        info->release();
         return;
     }
     if (cap > SYSFS_IOKIT_MAXMODULES) {
@@ -411,47 +421,46 @@ sysfs_snap_build_modules(struct sysfs_snapshot *snap)
     struct sysfs_snap_module *arr =
         (struct sysfs_snap_module *)sysfs_alloc(bytes);
     if (arr == nullptr) {
-        info->release();
-        return;
-    }
-
-    OSCollectionIterator *it = OSCollectionIterator::withCollection(info);
-    if (it == nullptr) {
-        sysfs_free(arr, bytes);
-        info->release();
         return;
     }
 
     uint32_t n = 0;
-    OSObject *k;
-    while ((k = it->getNextObject()) != nullptr && n < cap) {
-        OSString *ident = OSDynamicCast(OSString, k);
-        if (ident == nullptr) {
-            continue;
-        }
-        OSDictionary *kd = OSDynamicCast(OSDictionary, info->getObject(ident));
-        if (kd == nullptr) {
+    for (uint32_t i = 0; i < cap; i++) {
+        const struct sysfs_oskext_summary *s = &hdr->summaries[i];
+
+        if (s->address == 0 && s->text_exec_address == 0) {
             continue;
         }
 
         struct sysfs_snap_module *m = &arr[n];
-        strlcpy(m->name, ident->getCStringNoCopy(), sizeof(m->name));
-
-        OSNumber *num = OSDynamicCast(OSNumber, kd->getObject("OSBundleLoadTag"));
-        m->load_tag = (num != nullptr) ? num->unsigned64BitValue() : 0;
-        num = OSDynamicCast(OSNumber, kd->getObject("OSBundleLoadSize"));
-        m->load_size = (num != nullptr) ? num->unsigned64BitValue() : 0;
-        num = OSDynamicCast(OSNumber, kd->getObject("OSBundleRetainCount"));
-        m->refcnt = (num != nullptr) ? num->unsigned64BitValue() : 0;
-
-        OSString *ver = OSDynamicCast(OSString, kd->getObject("CFBundleVersion"));
-        if (ver != nullptr) {
-            strlcpy(m->version, ver->getCStringNoCopy(), sizeof(m->version));
+        strlcpy(m->name, s->name, sizeof(m->name));
+        m->load_tag  = s->loadTag;
+        m->load_size = s->size;
+        m->refcnt    = 0;           /* not present in the summary */
+
+        uint64_t v = s->version;
+        if (v != 0) {
+            unsigned major = (unsigned)(v / 100000000u);
+            unsigned minor = (unsigned)((v / 1000000u) % 100u);
+            unsigned rev   = (unsigned)((v / 10000u) % 100u);
+            unsigned stage = (unsigned)((v / 1000u) % 10u);
+            if (rev != 0) {
+                snprintf(m->version, sizeof(m->version),
+                    "%u.%u.%u", major, minor, rev);
+            } else {
+                snprintf(m->version, sizeof(m->version),
+                    "%u.%u", major, minor);
+            }
+            if (stage != 9) {       /* kOSKextVersionStageRelease */
+                size_t o = strlen(m->version);
+                snprintf(m->version + o, sizeof(m->version) - o, "%c%u",
+                    stage == 1 ? 'd' : stage == 3 ? 'a' :
+                    stage == 5 ? 'b' : stage == 7 ? 'f' : '?',
+                    (unsigned)(v % 1000u));
+            }
         }
         n++;
     }
-    it->release();
-    info->release();
 
     snap->modules      = arr;
     snap->module_cap   = cap;