DFReroot 2.0.4-zzic — Galaxy S25 Ultra SM-S938B / S938BXXUCZZIC
Install df_installer_2.0.4-zzic.apk first; df_reroot_2.0.4-zzic.apk is also
bundled inside it, so it does not need to be sideloaded separately.
Compatibility state — read before installing
The fail-closed S25U_ZZIC profile refuses to run unless the device matches
the pinned firmware exactly. docs/S25U_ZZIC_COMPATIBILITY.md carries the
authoritative gate matrix; the table below is generated from the profile that
is actually compiled into this build.
| Gate | State | Evidence |
|---|---|---|
| A — exact target identity | physical PASS | all 12 fields matched on SM-S938B / CP2A.260605.016.S938BXXUCZZIC
|
| B — kernel identity / version / arch / page size | physical PASS | 6.6.127-android15-8-p33f4ffe-abogkiS938BXXUCZZIC-4k, aarch64, 4096
|
B — crash_dump64 identity
| pinned, direct hash | 9249d66445837c52…
|
| B — vendor ELF provenance | AVB-anchored | the direct read is EACCES from this SELinux domain, so identity rests on vbmeta digest 23a0e0b0a5b421d5… + verifiedbootstate=green + device_state=locked + veritymode=enforcing + /vendor erofs read-only
|
C — AMS / scheduleReceiver
| physical PASS | scheduleReceiver/12 observed on Android 17; getProcessRecordLocked is absent and the mProcessNames fallback is what resolves the ProcessRecord
|
D — network_stack boundary
| physical PASS | CONTROLLER binder received; the remote process now reports its own uid/context/LIBEXP_LOADED back to the UI
|
| G1 — kernel module loader/import ABI | PASS (offline) | bound to dirtyfrag-android15-6.6-S938BXXUCZZIC.ko (b941d3234ad57235…); exact ZZIC modversions are COMPLETE (5/5)
|
| G2 — runtime symbol discovery | RUNTIME UNVERIFIED | kallsyms_lookup_name / selinux_state are resolved at runtime; the first hardware run must prove that path
|
G3 — selinux_state layout
| supported offline | exact ZZIC BTF places enforcing at offset 0; runtime confirmation is still pending
|
| G4 — SELinux write safety | UNVERIFIED | CRC agreement proves the loader ABI, not that writing selinux_state.enforcing = 0 is safe
|
H — installer / packages.xml
| physical PASS | ABX→TEXT→ABX round trip accepted by PMS; metadata and backup handling rewritten after the v2.0.2 field run |
G1 is closed offline, so this build is allowed to proceed past the old
module-policy refusal. The first run is therefore a real hardware experiment:
it may reach the page-cache writes and the helper may set SELinux permissive.
G2 and G4 are still unverified, and automatic restoration to Enforcing
after KernelSU readiness is not yet proven. Keep a verified packages.xml
backup, capture the complete log from one boot, do not retry after /dev/df
appears, and use a hard reboot as the recovery path if the run fails after
the helper has executed.
Checksums
3d6f465f3fac49714ef7285e9c2d6f275ea354cec323edea5a0a6c76f7d08963 df_reroot_2.0.4-zzic.apk
32e636aa384c46c0f268f2925e1d28189d10426fe3dde2cf91049bce1d8bf63b df_installer_2.0.4-zzic.apk
4bade9b9aebdeb16ae1f239a1c1a01b6752e8d0b0fcf4f427209063c86dbf9fc build-provenance.txt
Build provenance (toolchain, commit, payload hashes) is attached as
build-provenance.txt.