SK Core Explorer guided tour

These are actual interface views of one verified artificial StatsServer parser overflow. The original firmware accepts the request; the demonstration patch deliberately introduces the bug.

00:00:00.000 — Start with StatsServer’s recovered address space: virtual mappings, physical backing, GL0/GL1 permissions, and four saved threads.

00:00:07.650 — This is a deliberately added bug in the real StatsServer Tightbeam read parser. The 17th byte targets the next granule after a 16-byte allocation.

00:00:15.300 — The recovered fault thread produces a real 12-frame LLDB backtrace. Code and the original exception registers remain visible together.

00:00:22.950 — Crash Inspector keeps the original exception and post-forwarding register banks separate.

00:00:28.600 — The fault-time tag map shows logical tag 14 meeting allocation tag 9. MTE rejected the byte before it changed the neighboring allocation.

00:00:36.250 — The guest’s actual xzone metadata identifies the allocated 16-byte block. The synthetic copy extends one byte beyond it.

00:00:43.900 — The original 1,164-byte StatsServer panic was captured after forwarding. It includes the syndrome, task and thread identity, and panic backtrace.