Memory Tagging Under Pressure: Hunting a TOCTOU in the iPhone 17 Kernel

MTE is increasingly relied upon as a hardening primitive in modern kernels, where tag generation and publication must remain correct under concurrent execution. This talk presents a static and dynamic assessment of the MTE tag-generation path in the iOS 26.x kernel targeting iPhone 17-class devices. We analyze the helper routine irg_mte_function and its caller contexts with the goal of identifying ordering gaps that could permit a TOCTOU condition during tag creation, object reuse, and pointer publication. Using IDA Pro and custom IDA Python tooling, we enumerate direct call sites, classify explicit barriers, atomic operations, and lock-adjacent contexts, and correlate the recovered graph to userland trigger surfaces including Mach IPC / ipc_port zone allocation, queued Mach-message pressure, and BSD socket / Skywalk slab paths. We further validate reachability on a physical iPhone 17e running iOS 26.5.1 using MTETrigger.app, exercising FAST, FLOOD, PREFILL_FLOOD, PENDING_FLOOD, and background task modes. The results show that the relevant MTE helper path is reachable from stock userland and can be placed under high alloc/free pressure. Without SRD or jailbroken hardware, dynamic validation remains limited at the exact same-object tag-store/load boundary, motivating kernel-side instrumentation as follow-up work.