DFReroot 2.0.23-dzif — Galaxy S25 Ultra SM-S938B / ZZIC + DZIF exact profiles
Install df_installer_2.0.23-dzif.apk first; df_reroot_2.0.23-dzif.apk is also
bundled inside it, so it does not need to be sideloaded separately.
Compatibility state — read before installing
The fail-closed S25U_ZZIC profile refuses to run unless the device matches
the pinned firmware exactly. docs/S25U_ZZIC_COMPATIBILITY.md carries the
authoritative gate matrix; the table below is generated from the profile that
is actually compiled into this build.
| Gate | State | Evidence |
|---|---|---|
| A — exact target identity | physical PASS | all 12 fields matched on SM-S938B / CP2A.260605.016.S938BXXUCZZIC
|
| B — kernel identity / version / arch / page size | physical PASS | 6.6.127-android15-8-p33f4ffe-abogkiS938BXXUCZZIC-4k, aarch64, 4096
|
B — crash_dump64 identity
| pinned, direct hash | 9249d66445837c52…
|
| B — vendor ELF provenance | AVB-anchored | the direct read is EACCES from this SELinux domain, so identity rests on vbmeta digest 23a0e0b0a5b421d5… + verifiedbootstate=green + device_state=locked + veritymode=enforcing + /vendor erofs read-only
|
C — AMS / scheduleReceiver
| physical PASS | scheduleReceiver/12 observed on Android 17; getProcessRecordLocked is absent and the mProcessNames fallback is what resolves the ProcessRecord
|
D — network_stack boundary
| physical PASS | CONTROLLER binder received; the remote process now reports its own uid/context/LIBEXP_LOADED back to the UI
|
| G1 — kernel module loader/import ABI | physical PASS | bound to dirtyfrag-android15-6.6-S938BXXUCZZIC.ko (b941d3234ad57235…); exact ZZIC modversions are COMPLETE (5/5), and the helper success path executed on hardware
|
| G2 — runtime symbol discovery | physical PASS | the helper success path requires the sprint-symbol anchor plus kallsyms_lookup_name and selinux_state resolution
|
G3 — selinux_state layout
| physical PASS | exact ZZIC BTF predicts offset 0, and the hardware write produced the expected global state change |
| G4 — SELinux write safety | physical PASS | the system remained operational, KernelSU late-load completed and root survived manual restoration to Enforcing |
H — installer / packages.xml
| physical PASS | ABX→TEXT→ABX round trip accepted by PMS; metadata and backup handling rewritten after the v2.0.2 field run |
| I — automatic safe end state | physical PASS | the closeout ran unaided to a same-boot POST_ROOT_COMPLETE; the operator independently read Enforcing, sysfs 1, su in u:r:ksu:s0 and the pinned daemon installed
|
| AUTO_ROOT_FULL_BOOT | PARTIALLY ACCEPTED — ships disabled | the positive path is proven on hardware: an unattended attempt completed after a full reboot, the service's own per-boot journal recording phase=COMPLETE / native_started=1 / attempts=1 against the same boot_id as a valid post-root record, with SELinux read back Enforcing. Of the three boundaries one successful boot cannot speak for, two are observed — a framework restart triggers nothing, and the next full boot makes exactly one attempt, the boot's second broadcast refused in the log. The third, opting out suppressing the next boot, is untested: a run that appeared to show it was withdrawn because the receiver logged one message for six different refusals, and this build logs a classified verdict instead so the observation can be made. It ships OFF and still needs a verified manual completion on this exact build plus an explicit opt-in
|
G1 through G4 and Gate I are physically proven on ZZIC. The fail-closed
closeout is pinned to the DFR-specific ksud d0cb516da0047b1b… (6674552 bytes) and has now run
unaided on hardware. It still reports nothing as success until KernelSU works,
SELinux reads back Enforcing, the control channel works again and the same
boot is recorded - that conjunction is the gate, not a formality. Capture
the complete log from one boot, do not retry after /dev/df appears, and use
a hard reboot as the recovery path after any post-helper failure.
Auto Root after full boot is present in this build and disabled. It
cannot be enabled until a manual run on this exact versionCode, ksud digest
and firmware has ended in a verified same-boot POST_ROOT_COMPLETE, and the
owner then opts in. Once enabled it makes one attempt per full boot,
identified by a new boot_id, so a framework restart triggers nothing, and
any failure after the native run locks that boot until a hard reboot. It runs
the same gates as the button; it has no separate path and no override.
DZIF exact-target state
This APK also carries a fail-closed exact profile for S25U_DZIF (CP2A.260605.016.S938BXXUCDZIF).
Its identity, DFR-specific ksud and exact kernel module are independent from the ZZIC artifacts; neither exact module is reachable through the generic android15/6.6 family table.
| DZIF boundary | State | Evidence |
|---|---|---|
| exact firmware identity | pinned | SM-S938B / 6.6.127-android15-8-p33f4ffe-abogkiS938BXXUCDZIF-4k
|
| exact DirtyFrag module | offline PASS | dirtyfrag-android15-6.6-S938BXXUCDZIF.ko, sha256 512862ee484b16c2…
|
| CONFIG_MODVERSIONS | offline PASS | COMPLETE (5/5)
|
| DFR ksud | offline PASS | 6670840 bytes, sha256 3861dbd4e3b16f6e…
|
| StageHop / NetworkStack / libexp | physical PASS on DZIF | the earlier DZIF field run reached uid 1073 / u:r:network_stack:s0, scheduleReceiver/12, CONTROLLER and LIBEXP_LOADED=PASS
|
| remote syscall preflight | requires physical validation | transaction 6 runs inside NetworkStack and refuses before transaction 5 if NETLINK_XFRM, UDP_ENCAP, mmap/pipe/vmsplice/splice or fork/wait is denied |
| DirtyFrag page-cache write / post-root completion | UNVERIFIED on DZIF | the exact module is ABI-audited offline, but the destructive chain has not yet been accepted by a physical DZIF run |
For the first DZIF field run, capture the transaction-6 preflight output. A non-zero preflight result is a clean refusal: transaction 5 is not issued and nativeStarted remains false. Do not treat the offline Gate-G PASS as proof that CVE-2026-43284 is exploitable on this firmware.
Checksums
5ccf57057da24bc6c1cd630672d100317f6059472aa6ac470097072000301428 df_reroot_2.0.23-dzif.apk
2dff8e34c2d975d7649677ac3cef7200bc6014ad6fe8d217499d52e4f4e48b3b df_installer_2.0.23-dzif.apk
755c680667f0ad12181c18395b3e6bb866aa708c9b0bfccfe9b3fcf96198b454 build-provenance.txt
Build provenance (toolchain, commit, payload hashes) is attached as
build-provenance.txt.