{
  "added_at": "2026-11-08",
  "additional_evidence_urls": [
    "https://github.com/eddinos2/CVE-2026-64747/blob/c62251cec162a5a499b42153c5f684ba4a3a7e12/WIRE_FORMAT.md"
  ],
  "category": "reconstruction-cases",
  "class": "software",
  "description_en": "The AppleAVE2 investigation maps the kernel driver's IOKit user-client selectors and input structures while examining the work-buffer size calculation associated with CVE-2026-64747. It includes a userspace reachability program, wire-format notes, overflow arithmetic and patched-host logs. The author reports that a hardware capability gate prevented a live overflow on that host.",
  "description_zh": "AppleAVE2 调查梳理内核驱动的 IOKit 用户客户端选择器和输入结构，并分析 CVE-2026-64747 涉及的工作缓冲区大小计算。仓库包含用户态可达性程序、通信格式说明、溢出计算和已修补主机的日志；作者称该主机的硬件能力检查阻止了实际溢出。",
  "entry_url": "https://awesomerea.org/resources/appleave2-wire-format-case/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/appleave2-wire-format-case/",
  "evidence_class": 2,
  "evidence_status": "observed",
  "evidence_url": "https://github.com/eddinos2/CVE-2026-64747/blob/c62251cec162a5a499b42153c5f684ba4a3a7e12/README.md",
  "group": "cases",
  "id": "appleave2-wire-format-case",
  "json_url": "https://awesomerea.org/resources/appleave2-wire-format-case/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/appleave2-wire-format-case/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/appleave2-wire-format-case/index.md",
  "name": "AppleAVE2: reconstructing the IOKit wire format and driver validation path",
  "name_zh": "AppleAVE2：重建 IOKit 通信格式与驱动验证路径",
  "record_type": "resource",
  "relationship": "independent-reconstruction",
  "requirement_facets": [
    "prerequisites",
    "limits",
    "license"
  ],
  "requirements": [
    "Building the reachability program requires an arm64 macOS environment with clang, IOKit and CoreFoundation.",
    "The reported host runs the fixed AppleAVE2 905.40.1 build; its capability gate rejects the overflow dimensions before the calculator runs.",
    "No licence file in the repository."
  ],
  "requirements_zh": [
    "构建可达性程序需要 arm64 macOS 环境，以及 clang、IOKit 和 CoreFoundation。",
    "报告所用主机运行已修补的 AppleAVE2 905.40.1；其硬件能力检查会在进入相关计算前拒绝溢出尺寸。",
    "仓库中没有许可证文件。"
  ],
  "scope": "unknown",
  "targets": [
    "binary",
    "protocol"
  ],
  "url": "https://github.com/eddinos2/CVE-2026-64747",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}