usbliter8 DMA Underflow Achieves Permanent SecureROM Execution on A12/A13

The exploit requires physical possession, DFU mode, and an RP2350 microcontroller board. It completes in under two seconds by corrupting the DMA write pointer through repeated undersized Setup packets, bypassing the DART IOMMU that Apple left in bypass mode inside SecureROM on these chips. A11 avoids the issue through explicit DMA address resets after every packet; A14 and later configure DART correctly.

Affected devices span iPhone XS through SE (2nd gen), multiple iPads, Apple Watch Series 4/5, and HomePod mini. The public PoC already supports A12, A13, S4, and S5. Post-exploitation yields unsigned iBoot boot capability and production-mode demotion while leaving the Secure Enclave untouched so far.

This mirrors the 2019 checkm8 pattern but extends the hardware root-of-trust break two generations later. The DWC2 controller flaw itself is unfixable; only the IOMMU and driver configuration choices determined exploitability. No procurement or incident records indicate prior knowledge inside Apple supply-chain audits.

Future work will likely target remaining A12/A13 variants and probe secondary paths into the Secure Enclave. Affected devices will carry the permanent break for their operational lifetimes with no software remediation possible.