Bootloop on ZQ9109 Android 10 (4.9.190) headunit / magiskinit: ENOENT on stage 2

[wischbgr]

Device

Device: ZQ9109 headunit
Android version: 10
Magisk version name: 30.7 (but also affects all release versions at least beginning of 25.2)
Magisk version code: 25200 - 30700
CPU: MT6765VXB
Kernel: 4.9.190

Log

Log from AEE (Android Exception Engine) crash-dump partition expdb:

.(0)[1:init]init 3: [libfs_mgr]Created logical partition product on device /dev/block/dm-0
.(0)[1:init]init 3: [libfs_mgr]Created logical partition vendor on device /dev/block/dm-1
.(0)[1:init]init 3: [libfs_mgr]Created logical partition system on device /dev/block/dm-2
.(0)[1:init]init 3: [libfs_mgr]superblock s_max_mnt_count:65535,/dev/block/platform/bootdevice/by-name/md_udc
.(0)[1:init]init 3: [libfs_mgr]Filesystem on /dev/block/platform/bootdevice/by-name/md_udc was not cleanly shutdown; state flags: 0x1, incompat feature flags: 0x46
.(0)[1:init]init 3: [libfs_mgr]check_fs(): mount(/dev/block/platform/bootdevice/by-name/md_udc,/metadata,ext4)=-1: No such file or directoryU
.(0)[1:init]init 7: [libfs_mgr]Not running /system/bin/e2fsck on /dev/block/mmcblk0p10 (executable not in system image)
.(0)[1:init]EXT4-fs (mmcblk0p10): recovery complete
.(0)[1:init]EXT4-fs (mmcblk0p10): mounted filesystem with ordered data mode. Opts: discard
.(0)[1:init]init 7: [libfs_mgr]__mount(source=/dev/block/platform/bootdevice/by-name/md_udc,target=/metadata,type=ext4)=0: Success
.(0)[1:init]init 7: GSI not detected, proceeding with normal boot
.(0)[1:init]init 7: [libfs_avb]Returning avb_handle with status: VerificationDisabled
b.(0)[1:init]init 7: Top-level vbmeta is disabled, skip Hashtree setup for /system
.(0)[1:init]init 7: [libfs_mgr]superblock s_max_mnt_count:65535,/dev/block/dm-2
.(0)[1:init]EXT4-fs (dm-2): mounted filesystem without journal. Opts: 
.(0)[1:init]init 7: [libfs_mgr]__mount(source=/dev/block/dm-2,target=/system,type=ext4)=0: Success
.(0)[1:init]init 7: Switching root to '/system'
.(4)[245:battery_thread]GM3log-nint-nafg 10 10 0 0 0 0 0
.(4)[245:battery_thread]FG daemon is disabled
.(0)[1:init]init 7: [libfs_avb]AVB HASHTREE disabled on: /vendor
.(0)[1:init]init 8: [libfs_mgr]superblock s_max_mnt_count:65535,/dev/block/dm-1
.(0)[1:init]EXT4-fs (dm-1): mounted filesystem without journal. Opts: 
.(0)[1:init]init 8: [libfs_mgr]__mount(source=/dev/block/dm-1,target=/vendor,type=ext4)=0: Success
.(0)[1:init]init 8: [libfs_avb]AVB HASHTREE disabled on: /product
.(0)[1:init]init 8: [libfs_mgr]superblock s_max_mnt_count:65535,/dev/block/dm-0
.(0)[1:init]EXT4-fs (dm-0): mounted filesystem without journal. Opts: 
.(0)[1:init]init 8: [libfs_mgr]__mount(source=/dev/block/dm-0,target=/product,type=ext4)=0: Success
.(0)[1:init]init 8: [libfs_mgr]superblock s_max_mnt_count:65535,/dev/block/platform/bootdevice/by-name/ziqi_dataE
.(0)[1:init]init 8: [libfs_mgr]Filesystem on /dev/block/platform/bootdevice/by-name/ziqi_data was not cleanly shutdown; state flags: 0x1, incompat feature flags: 0x46
.(0)[1:init]init 8: [libfs_mgr]check_fs(): mount(/dev/block/platform/bootdevice/by-name/ziqi_data,/mnt/vendor/ziqi_data,ext4)=-1: No such file or directory
.(0)[1:init]init 8: [libfs_mgr]Running /system/bin/e2fsck on /dev/block/mmcblk0p34
.(0)[1:init]e2fsck: executing /system/bin/e2fsck failed: No such file or directory
.(0)[1:init]e2fsck: e2fsck terminated by exit(255)
.(0)[1:init]init 3: [libfs_mgr]e2fsck returned status 0xff00
.(0)[1:init]EXT4-fs (mmcblk0p34): recovery complete
.(0)[1:init]EXT4-fs (mmcblk0p34): mounted filesystem with ordered data mode. Opts: noauto_da_alloc,discard
.(0)[1:init]init 3: [libfs_mgr]__mount(source=/dev/block/platform/bootdevice/by-name/ziqi_data,target=/mnt/vendor/ziqi_data,type=ext4)=0: Success
.(0)[1:init]init 3: [libfs_mgr]__mount(source=/dev/block/platform/bootdevice/by-name/boot,target=/boot(missing),type=emmc)=-1: No such file or directory
.(0)[1:init]init 3: Failed to mount /boot, ignoring mount for no_fail partition
.(0)[1:init]init 3: [libfs_mgr]__mount(source=/dev/block/platform/bootdevice/by-name/recovery,target=/recovery(missing),type=emmc)=-1: No such file or directory
.(0)[1:init]init 3: Failed to mount /recovery, ignoring mount for no_fail partition
.(0)[1:init]init 3: [libfs_mgr]__mount(source=/dev/block/platform/bootdevice/by-name/vbmeta_vendor,target=/vbmeta_vendor(missing),type=emmc)=-1: No such file or directory
.(0)[1:init]init 3: Failed to mount /vbmeta_vendor, ignoring mount for no_fail partitionK4
.(0)[1:init]init 3: [libfs_avb]AVB HASHTREE disabled on: /vbmeta_system
.(0)[1:init]init 8: [libfs_mgr]__mount(source=/dev/block/platform/bootdevice/by-name/vbmeta_system,target=/vbmeta_system(missing),type=emmc)=-1: No such file or directory
.(0)[1:init]init 8: Failed to mount /vbmeta_system, ignoring mount for no_fail partition
.(0)[1:init]init 8: Skipped setting INIT_AVB_VERSION (not in recovery mode)
.(1)[1:init]magiskinit: open '/proc/bootconfig': : No such file or directorypO
.(1)[1:init]magiskinit: Second Stage Init
.(4)[114:kworker/u16:2]mt635x-auxadc mt-pmic:mt635x-auxadc: name:VPROC_TEMP, channel=4, adc_out=0x5e1, adc_result=661SUBSYSTEM=platform
DEVICE=+platform:mt-pmic:mt635x-auxadc
.(6)[256:kworker/u16:7]mt635.(2)[1:swapper/0][Power/PPM] [1][2][10] = (43)
out=0x5f7, adc_result=671SUBSYSTEM=platform
DEVICE=+platform:mt-pmic:mt635x-auxadc
.(1)[1:init]EXT4-fs (mmcblk0p38): mounted filesystem with ordered data mode. Opts: (null)
.(1)[1:init]magiskinit: empty preinit: .magisk/mirror/unencrypted/magisk
.(1)[1:init]magiskinit: SePatchStrategy: LD_PRELOAD
.(1)[1:init]magiskinit: : No such file or directory
-(1)[1:init]Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
F-(1)[1:init]SMP: stopping secondary CPUs8R
-(1)[1:init]disable aee kernel api
-(1)[1:init]Kernel Offset: 0x0 from 0xffffff8008000000
-(1)[1:init]PHYS_OFFSET: 0x40000000
-(1)[1:init]Modules linked in:
-(1)[1:init]CPU: 1 PID: 1 Comm: init Tainted: G        W       4.9.190+ #1
-(1)[1:init]Hardware name: MT6762V/CB (DT)
-(1)[1:init]Call trace:
-(1)[1:init][<ffffff800808b4b8>] dump_backtrace+0x0/0x290
-(1)[1:init][<ffffff800808b4b0>] show_stack+0x14/0x1c
-(1)[1:init][<ffffff80083ef09c>] dump_stack+0xcc/0x104
-(1)[1:init][<ffffff8008770d7c>] mrdump_common_die+0xe8/0x170
-(1)[1:init][<ffffff8008770ec8>] ipanic+0xc4/0xf0
-(1)[1:init][<ffffff80080d0b9c>] atomic_notifier_call_chain+0x4c/0x84
-(1)[1:init][<ffffff80080a5d98>] panic+0x13c/0x270
-(1)[1:init][<ffffff80080aabec>] complete_and_exit+0x0/0x20
-(1)[1:init][<ffffff80080aacbc>] SyS_exit_group+0x0/0x10
-(1)[1:init][<ffffff80080aaccc>] __wake_up_parent+0x0/0x28
-(1)[1:init][<ffffff80080835c0>] el0_svc_naked+0x34/0x38
-(1)[1:init]mrdump: cpu[1] tsk:00000000a38c9754 ti:000000002acc061d
-(1)[1:init]mrdump: add UFS:0xffffff800a14a470 sz:0x0 failedT0
-(1)[1:init]mrdump: add CCCI:0xffffffc1787d0000 sz:0x0 failed
-(1)[1:init]mrdump: add MD:0xffffffc178000000 sz:0x0 failed
-(1)[1:init]exception reboot

Relevant part:

.(1)[1:init]magiskinit: empty preinit: .magisk/mirror/unencrypted/magisk
.(1)[1:init]magiskinit: SePatchStrategy: LD_PRELOAD
.(1)[1:init]magiskinit: : No such file or directory
-(1)[1:init]Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100

Description

Flashing a patched boot.img leads to permanent bootloop. vbmeta etc. is disabled by default in my firmware.
This error affects every Magisk release version I tried (25.2 - 30.7). Log is from 30.7.
Thanks in advance for looking into it 👍 I can also provide my boot.img if needed.

Btw. bootloops suck, I had to disassemble my car to get this log and fix my device ;-)

[wischbgr]

Disclaimer

The following was found/generated using claude-code by letting it compare the error agians the cloned Magisk repo. I checked the information briefly, but I am not proficient enough in this topic to verify it completely. Please use it as a an "starting point" and do NOT rely on this bug explanation on its own. It might be just AI hallucination after all.

Summary

On a device whose boot ramdisk has no /sbin directory but does have a pre-existing /debug_ramdisk directory, MagiskInit::patch_ro_root() silently fails to relocate the bundled overlay.d payload (magisk.xz, stub.xz, init-ld.xz) into the working directory. This cascades into a missing init-ld, a failed execve("/init", ...) in exec_init(), and finally a kernel panic (Attempted to kill init!) because magiskinit is running as PID 1 when the fallback std::process::exit(1) runs.

Reproduced identically across Magisk v25, v26, v27, v28, v29, and v30.7 — all fail the same way, so this is not a version regression, it's a structural bug in the /debug_ramdisk fallback branch of patch_ro_root().

Environment

• Device: aftermarket automotive head unit (ODM board, "ZQ9109" / k62v1_64_bsp)
• SoC: MediaTek MT6765/MT8768t (hwcode 0x766), DT hardware string reports MT6762V/CB
• Android 10 (QQ2A.200501.001.B3), kernel 4.9.190+, security patch 2020-07-05
• CONFIG_KALLSYMS=y, CONFIG_KALLSYMS_ALL=n (unrelated to this bug, noted for context)
• Boot image header v2, ramdisk is plain gzip CPIO (no GKI, no vendor_boot)
• vbmeta: VERIFICATION_DISABLED flag set (orange state) — confirmed not a factor
• Stock ramdisk root contains: apex, avb, debug_ramdisk, dev, fstab.mt6762, fstab.mt6765, init, mnt, proc, sys — no /sbin

Root cause

In native/src/init/rootdir.cpp, patch_ro_root():

if (access("/sbin", F_OK) == 0) {
    tmp_dir = "/sbin";
} else {
    tmp_dir = "/debug_ramdisk";
    xmkdir("/data/debug_ramdisk", 0);
    xmount("/debug_ramdisk", "/data/debug_ramdisk", nullptr, MS_MOVE, nullptr);
}

setup_tmp(tmp_dir.data());
chdir(tmp_dir.data());

if (tmp_dir == "/sbin") {
    ...
} else {
    // Restore debug_ramdisk
    xmount("/data/debug_ramdisk", "/debug_ramdisk", nullptr, MS_MOVE, nullptr);
    rmdir("/data/debug_ramdisk");
}

xrename("overlay.d", ROOTOVL);
...
if (access(ROOTOVL "/sbin", F_OK) == 0) {
    mv_path(ROOTOVL "/sbin", ".");
}
...
extract_files(false);
handle_sepolicy();
unlink("init-ld");

Since this device has no /sbin, the /debug_ramdisk branch is taken:

1. The original /debug_ramdisk is moved out of the way to /data/debug_ramdisk.
2. setup_tmp("/debug_ramdisk") mounts a fresh tmpfs at /debug_ramdisk.
3. chdir("/debug_ramdisk") sets the process's cwd to that fresh tmpfs inode.
4. The original /debug_ramdisk is then moved back on top of the same path.

Per standard Linux mount semantics, a process's cwd is a fixed reference to the inode/dentry it was set to — it does not "follow" a later mount stacked over the same path. After step 4, /debug_ramdisk is visibly the original content again, but the process's actual cwd still refers to the now-hidden, empty tmpfs from step 2.

xrename("overlay.d", ROOTOVL) (relative path) is then resolved against this hidden, empty cwd. overlay.d only exists at the ramdisk root (/overlay.d), so the rename fails. Critically:

• xrename (native/src/base/xwrap.rs) only logs the error and returns -1; it does not abort.
• patch_ro_root() (declared noexcept) does not check this return value.

Execution continues regardless:

• mv_path(ROOTOVL "/sbin", ".") is skipped, since access(ROOTOVL "/sbin", F_OK) fails (the rename never happened, so ROOTOVL/sbin doesn't exist).
• extract_files(false) (which looks for magisk.xz/stub.xz/init-ld.xz relative to cwd) finds nothing and silently no-ops — there is no else/log branch in this function at all.
• handle_sepolicy()'s LdPreload strategy then tries cstr!("init-ld").copy_to(preload_lib())?, which fails with ENOENT (this is the only visible symptom in dmesg: magiskinit: : No such file or directory). This error is itself swallowed by .ok() in handle_sepolicy().
• Because the overlay relocation never happened, /init is left in an unusable state by the time exec_init() (native/src/init/mount.rs) runs:

  pub(crate) fn exec_init(&mut self) {
      ...
      unsafe {
          libc::execve(raw_cstr!("/init"), self.argv.cast(), environ.cast())
              .check_err()
              .log_ok();
      }
      std::process::exit(1);
  }

  execve() fails, falls through to std::process::exit(1).
• Since this process is PID 1, the kernel reports:

  Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
  

Evidence (from MediaTek AEE expdb crash dump, captured across 3 separate boot attempts, all identical)

init 7: [libfs_avb]Returning avb_handle with status: VerificationDisabled
init 7: Top-level vbmeta is disabled, skip Hashtree setup for /system
init 7: Switching root to '/system'
...
magiskinit: Second Stage Init
magiskinit: empty preinit: .magisk/mirror/unencrypted/magisk
magiskinit: SePatchStrategy: LD_PRELOAD
magiskinit: : No such file or directory
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
CPU: 1 PID: 1 Comm: init Tainted: G        W       4.9.190+ #1
Hardware name: MT6762V/CB (DT)
Call trace:
 dump_backtrace+0x0/0x290
 ipanic+0xc4/0xf0
 panic+0x13c/0x270
exception reboot

Reproduction conditions

• Boot ramdisk has no /sbin directory.
• Boot ramdisk has a pre-existing /debug_ramdisk directory (so the else branch's move/restore dance actually runs, rather than /debug_ramdisk simply not existing).
• 2SI / dynamic-partitions device taking the patch_ro_root() path (confirmed via init 7: [libfs_mgr]Created logical partition system on device /dev/block/dm-2 in the log).

Suggested fix

After restoring the original /debug_ramdisk mount in the else branch, re-resolve cwd with an explicit chdir(tmp_dir.data()) call again before proceeding to xrename("overlay.d", ROOTOVL), so cwd actually points at the now-visible, restored directory rather than the stale tmpfs inode from setup_tmp(). Alternatively, perform the overlay.d rename and mv_path steps using absolute paths instead of paths relative to cwd, to avoid depending on cwd surviving a mount stacked on top of its own path.

Tested versions

v25.2, v26.4, v27.0, v28.0 (approx — exact patch versions tried), v29.0, v30.7 — all fail identically with the same log signature.