ksyms: bound credential and task structure scans

[xeropresence]

Summary

Keep credential/task offset probes inside their scan buffers and bound the ambient-capability comparison by the kernel-allocated credential's size.

Problem

Several offset-discovery loops advance in four-byte steps but read a kernel_cap_t or pointer. Testing only the starting offset allows the final load to extend beyond the configured scan boundary.

The ambient-capability probe has another boundary: after cap_task_prctl, the task can reference a slab-allocated credential rather than the CRED_MAX_SIZE scratch buffer. Scanning that object as though it were the full scratch-buffer size can read past the allocation. On hardware-tagged KASAN kernels configured to panic on a fault, this is a boot failure rather than a harmless speculative probe.

Changes

• Require each complete capability or pointer load to fit within its existing scan boundary.
• Resolve ksize for the newly installed credential and bound the ambient-capability comparison by both that size and CRED_MAX_SIZE.
• Preserve the existing scan stride and comparison logic, including support for randomized layouts.
• If ksize cannot be resolved, retain the existing fixed scan limit rather than introducing a new boot prerequisite.

The patch does not hardcode GrapheneOS structure offsets or randomization seeds, disable KASAN/RANDSTRUCT, or change the persistent preset format. It also does not claim to make every unrelated structure probe allocation-aware.

Verification

Built the Android ARM64 payload and kptools on this branch.

Device testing used all three fixes on KernelPatch 0.13.8, with a Pixel 8 running GrapheneOS 2026081300:

• Credential discovery completed with CONFIG_RANDSTRUCT_FULL and hardware-tagged KASAN enabled.
• Root access worked with SELinux Enforcing.