According to TAG’s analysis, DarkSword “uses CVE-2025-43520, a kernel-mode race condition in XNU’s virtual filesystem (VFS) implementation” I’m guessing it’s https://github.com/apple-oss-distributions/xnu/blob/bbb1b6f9e71b8cdde6e5cd6f4841f207dee3d828/bsd/vfs/vfs_cluster.c#L3700 ? There’s several VFS changes; not sure if this is the right one. If it is this one, I guess you’d somehow Make a contiguous memory region,start reading a file into it,then switch it to a non-contiguous region after it’s validated the region, but before it actually starts reading the file,so it ends up writing what it thinks is your contiguous area, but actually is the first part of your area followed by some other memory?