DFReroot 2.0.5-zzic — Galaxy S25 Ultra SM-S938B / S938BXXUCZZIC
Install df_installer_2.0.5-zzic.apk first; df_reroot_2.0.5-zzic.apk is also
bundled inside it, so it does not need to be sideloaded separately.
Compatibility state — read before installing
The fail-closed S25U_ZZIC profile refuses to run unless the device matches
the pinned firmware exactly. docs/S25U_ZZIC_COMPATIBILITY.md carries the
authoritative gate matrix; the table below is generated from the profile that
is actually compiled into this build.
| Gate | State | Evidence |
|---|---|---|
| A — exact target identity | physical PASS | all 12 fields matched on SM-S938B / CP2A.260605.016.S938BXXUCZZIC
|
| B — kernel identity / version / arch / page size | physical PASS | 6.6.127-android15-8-p33f4ffe-abogkiS938BXXUCZZIC-4k, aarch64, 4096
|
B — crash_dump64 identity
| pinned, direct hash | 9249d66445837c52…
|
| B — vendor ELF provenance | AVB-anchored | the direct read is EACCES from this SELinux domain, so identity rests on vbmeta digest 23a0e0b0a5b421d5… + verifiedbootstate=green + device_state=locked + veritymode=enforcing + /vendor erofs read-only
|
C — AMS / scheduleReceiver
| physical PASS | scheduleReceiver/12 observed on Android 17; getProcessRecordLocked is absent and the mProcessNames fallback is what resolves the ProcessRecord
|
D — network_stack boundary
| physical PASS | CONTROLLER binder received; the remote process now reports its own uid/context/LIBEXP_LOADED back to the UI
|
| G1 — kernel module loader/import ABI | physical PASS | bound to dirtyfrag-android15-6.6-S938BXXUCZZIC.ko (b941d3234ad57235…); exact ZZIC modversions are COMPLETE (5/5), and the helper success path executed on hardware
|
| G2 — runtime symbol discovery | physical PASS | the helper success path requires the sprint-symbol anchor plus kallsyms_lookup_name and selinux_state resolution
|
G3 — selinux_state layout
| physical PASS | exact ZZIC BTF predicts offset 0, and the hardware write produced the expected global state change |
| G4 — SELinux write safety | physical PASS | the system remained operational, KernelSU late-load completed and root survived manual restoration to Enforcing |
H — installer / packages.xml
| physical PASS | ABX→TEXT→ABX round trip accepted by PMS; metadata and backup handling rewritten after the v2.0.2 field run |
| I — automatic safe end state | PENDING PHYSICAL ACCEPTANCE | this build requires live KernelSU proof, automatic Enforcing restore/read-back, a second live proof and same-boot POST_ROOT_COMPLETE before UI success
|
| AUTO_ROOT_FULL_BOOT | NOT ACCEPTED — ships disabled | the boot path exists and is off: it needs a verified manual completion on this exact build plus an explicit opt-in, and has not been accepted on hardware |
G1 through G4 are physically proven on ZZIC. This build adds the fail-closed
Gate-I closeout and pins the DFR-specific ksud as 14fb9eaf14cb6dc0… (6670272 bytes). It must
not report success until KernelSU works, SELinux reads back Enforcing, the
KernelSU control channel works again and the same boot is recorded. Capture
the complete log from one boot, do not retry after /dev/df appears, and use
a hard reboot as the recovery path after any post-helper failure.
Auto Root after full boot is present in this build and disabled. It
cannot be enabled until a manual run on this exact versionCode, ksud digest
and firmware has ended in a verified same-boot POST_ROOT_COMPLETE, and the
owner then opts in. Once enabled it makes one attempt per full boot,
identified by a new boot_id, so a framework restart triggers nothing, and
any failure after the native run locks that boot until a hard reboot. It runs
the same gates as the button; it has no separate path and no override.
Checksums
fcdf529b56f7fa4bcceb7bd5e54be781a76b438add71ce2271c127147c2dfb01 df_reroot_2.0.5-zzic.apk
c7b49cfc7212dc1ffc898258e7cee7af0d4806a1124b41a25577885d9d0de913 df_installer_2.0.5-zzic.apk
dbc1db490b83fd07a138c41ae86a2358bed8001cb5a25f6ddc4b64dde7ad067f build-provenance.txt
Build provenance (toolchain, commit, payload hashes) is attached as
build-provenance.txt.