arm64: handle inlined kCFI failure reporting

[xeropresence]

Summary

Extend KernelPatch's existing KP/KPM-only CFI exception policy to the arm64 cfi_handler entry point. This covers kernels where LTO inlines report_cfi_failure, bypassing the existing hook on that function.

Problem

On the stock Pixel 8 (shiba) GrapheneOS 2026081300 kernel, disassembly of cfi_handler shows inlined failure reporting instead of a call to the separately emitted report_cfi_failure symbol. Hooking the latter therefore does not intercept the actual trap path.

Kernel-to-KernelPatch callbacks can still fault under kCFI. Observed paths include directory iteration, RCU reclamation, and stop_machine during runtime hook removal. Adding separate typed trampolines at each call site works around the missed interception point but is unnecessary when the existing compatibility policy is applied at the trap handler.

Changes

• Resolve cfi_handler and arm64_skip_faulting_instruction and install an arm64-only before-hook when both exist.
• Decode the target register from the CFI BRK immediate in ESR.
• Reject user-mode traps and register 31, then apply the existing should_cfi_pass() address-range check.
• For permitted KP/KPM targets only, use the kernel's instruction-advance helper and return DBG_HOOK_HANDLED.
• Leave other targets on the original handler path. Preserve the existing report_cfi_failure and legacy __cfi_slowpath hooks, and the current cfi_bypass completion flag.

This does not make CFI globally permissive. It retains the existing scoped exception for KernelPatch text, hook memory, and KPM executable memory. No callback allocator, syscall-hook changes, task-observer changes, or persistent preset-layout changes are introduced.

Verification

Built the Android ARM64 payload and kptools on this branch.

Device testing used all three fixes on KernelPatch 0.13.8, with a Pixel 8 running GrapheneOS 2026081300:

• Directory scans and runtime hook removal completed with strict kCFI enabled.
• 128 RCU-backed profile replacements completed without CFI faults.