Kernel mitigation bypass via spilled signing inputs

Kernel mitigation bypass in Apple iOS and iPadOS before 16.4 and watchOS before 9.4 allows attackers to subvert pointer authentication. The XNU sign_thread_state path spills signing inputs into writable memory, allowing forged exception-state values to invoke an arbitrary kernel function. Existing kernel code execution and arbitrary kernel memory modification are prerequisites, so the flaw extends a compromise rather than providing initial access.