CVE-2026-84558
XNU reference-counting bug
A deterministic refcount bug in the macOS/iOS kernel that lets any unprivileged process trigger a denial of service. Reported to Apple and awarded US$1,000.
CVE-2026-84558 →I study computer science at the University of Wollongong and like to reverse engineer and patch limitations that annoy me
Atlassian
University of Wollongong
CVE-2026-84558
A deterministic refcount bug in the macOS/iOS kernel that lets any unprivileged process trigger a denial of service. Reported to Apple and awarded US$1,000.
CVE-2026-84558 →macOS · Code signing
Patched the kernel, appinstalld and dyld to study how macOS decides what code it trusts and installs. Tools are open source: dyld-patcher, appinstalld-patcher, amfi-patcher.
iOS · Reverse engineering
A compatible reimplementation of Apple's MetricKit, built from reverse engineering the original, so device-compiled apps run in the Simulator.
GitHub →Bluetooth · Swift
A replacement control app for Nura headphones. Reverse-engineered the undocumented BLE protocol from the Android app and packet captures, recovered the session key, and rebuilt the custom AES-128-GCM framing. Written in SwiftUI and CoreBluetooth.
GitHub →Firmware
Ported coreboot to a previously unsupported Lenovo desktop. It boots fully with only 70 KB of closed-source blobs (Intel MRC and a stripped ME).
GitHub →Linux kernel
A kernel module that turns off the CPU cache on a running x86_64 system.
GitHub →University of Wollongong
WAM 84.06