# AppleAVE2: reconstructing the IOKit wire format and driver validation path

> The AppleAVE2 investigation maps the kernel driver's IOKit user-client selectors and input structures while examining the work-buffer size calculation associated with CVE-2026-64747. It includes a userspace reachability program, wire-format notes, overflow arithmetic and patched-host logs. The author reports that a hardware capability gate prevented a live overflow on that host.

- Type: Case study
- Targets: Binary · Protocol
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-08
- Original resource: <https://github.com/eddinos2/CVE-2026-64747>
- Primary source: <https://github.com/eddinos2/CVE-2026-64747/blob/c62251cec162a5a499b42153c5f684ba4a3a7e12/README.md>
- Catalog page: <https://awesomerea.org/resources/appleave2-wire-format-case/>
- Record JSON: <https://awesomerea.org/resources/appleave2-wire-format-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/appleave2-wire-format-case/index.md)

## Requirements & limits

- **Prerequisites:** Building the reachability program requires an arm64 macOS environment with clang, IOKit and CoreFoundation.
- **Limits:** The reported host runs the fixed AppleAVE2 905.40.1 build; its capability gate rejects the overflow dimensions before the calculator runs.
- **License:** No licence file in the repository.

## Primary sources

1. <https://github.com/eddinos2/CVE-2026-64747/blob/c62251cec162a5a499b42153c5f684ba4a3a7e12/README.md>
2. <https://github.com/eddinos2/CVE-2026-64747/blob/c62251cec162a5a499b42153c5f684ba4a3a7e12/WIRE_FORMAT.md>

## More in Protocols

- [Indian Thunder Stroke: decoding motorcycle CAN signals](https://awesomerea.org/resources/indian-thunderstroke-canbus-case/index.md) · Case study
- [Smart Ring Dashboard: direct BLE access to generic smart rings](https://awesomerea.org/resources/smart-ring-dashboard-case/index.md) · Case study
- [Thermal Cam: decoding the Thermal Master P1 USB stream](https://awesomerea.org/resources/thermal-cam-p1-protocol-case/index.md) · Case study
- [ControlVault 3: reconstructing Linux fingerprint support](https://awesomerea.org/resources/controlvault3-linux-fingerprint-case/index.md) · Case study
- [glorouter: reconstructing the Huawei B311-221 HiLink API](https://awesomerea.org/resources/glorouter-case/index.md) · Case study
- [OpticFilm 135i: reconstructing native USB scanning on Linux](https://awesomerea.org/resources/opticfilm-135i-linux-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.