DFReroot 2.0.3-zzic — Galaxy S25 Ultra SM-S938B / S938BXXUCZZIC
Install df_installer_2.0.3-zzic.apk first; df_reroot_2.0.3-zzic.apk is also
bundled inside it, so it does not need to be sideloaded separately.
Compatibility state — read before installing
The fail-closed S25U_ZZIC profile refuses to run unless the device matches
the pinned firmware exactly. docs/S25U_ZZIC_COMPATIBILITY.md carries the
authoritative gate matrix; the table below is generated from the profile that
is actually compiled into this build.
| Gate | State | Evidence |
|---|---|---|
| A — exact target identity | physical PASS | all 12 fields matched on SM-S938B / CP2A.260605.016.S938BXXUCZZIC
|
| B — kernel identity / version / arch / page size | physical PASS | 6.6.127-android15-8-p33f4ffe-abogkiS938BXXUCZZIC-4k, aarch64, 4096
|
B — crash_dump64 identity
| pinned, direct hash | 9249d66445837c52…
|
| B — vendor ELF provenance | AVB-anchored | the direct read is EACCES from this SELinux domain, so identity rests on vbmeta digest 23a0e0b0a5b421d5… + verifiedbootstate=green + device_state=locked + veritymode=enforcing + /vendor erofs read-only
|
C — AMS / scheduleReceiver
| physical PASS | scheduleReceiver/12 observed on Android 17; getProcessRecordLocked is absent and the mProcessNames fallback is what resolves the ProcessRecord
|
D — network_stack boundary
| physical PASS | CONTROLLER binder received; the remote process now reports its own uid/context/LIBEXP_LOADED back to the UI
|
| G — kernel module ABI | UNVERIFIED | the ZZIC kernel has CONFIG_MODVERSIONS=y and the bundled module ships an empty __versions, so no symbol-CRC agreement can be demonstrated
|
H — installer / packages.xml
| physical PASS | ABX→TEXT→ABX round trip accepted by PMS; metadata and backup handling rewritten after the v2.0.2 field run |
On the exact ZZIC target this build will still refuse to root the device,
by design, at one boundary that no runtime option overrides:
[DFR][MODULE] GENERIC_ANDROID15_6_6_MODULE=UNVERIFIED
[DFR][MODULE] ZZIC_MODULE_POLICY=REFUSE_UNVERIFIED
runAll is expected to end res=3 with no patch #1, no patched bytes
and no page-cache write. On this build that outcome is the test passing:
every boundary before Gate G is proven on hardware and the fail-closed
refusal still holds. Running it is an evidence-collection step.
Checksums
d5dd1dc9094d59a9fb3ff972503059ddd61fcdf238a5e9972c2a5da82ebf90a4 df_reroot_2.0.3-zzic.apk
4772450a2f6c37f002c9b7c4cef60951491edab775eba532152f3c433b1748ac df_installer_2.0.3-zzic.apk
71a51d6c75941b5a7f83e1411bd6704504218837888050e5660f477be6bb18e9 build-provenance.txt
Build provenance (toolchain, commit, payload hashes) is attached as
build-provenance.txt.