Out-of-bounds write in Apple IOGPUFamily

This repository is a small standalone proof-of-concept for CVE-2025-24257, not part of a known exploit framework. It contains two Objective-C source files and a README. The real exploit logic is entirely in CVE_2025_24257.m, with CVE_2025_24257.h only declaring the trigger function. The README appears inconsistent with the code: it describes a Windows download-and-run workflow and references executables, but the actual repository contains Objective-C source targeting Apple’s IOGPU/IOKit stack, so the README is likely generic or misleading rather than representative of the exploit implementation. The exploit targets Apple iOS 18.3 (22D60) and abuses the IOGPUFamily resource-group creation path. It opens the IOGPU service using IOServiceMatching("IOGPU") and IOServiceOpen with user client type 1, then calls IOConnectCallMethod with selector 9 (documented in comments as s_new_resource). The crafted input sets resType=3 and capacity=1. According to the source comments, the kernel computes bitmap_mask = (capacity >> 6) - 1, which underflows to 0xFFFFFFFF when capacity is less than 64. This leaves a tiny bitmap allocation paired with an enormous logical iteration bound. When the client connection is closed via IOServiceClose, kernel cleanup iterates far beyond the allocation and eventually hits unmapped memory, producing a kernel panic. Capabilities are limited to local denial of service: the PoC demonstrates a reachable kernel bug from a sandboxed, entitlement-free context and reliably crashes the device. There is no shellcode, no persistence, no network communication, and no attempt to turn the bug into privilege escalation or arbitrary code execution. The main fingerprintable targets in code are the IOGPU service name, user client type 1, and selector 9 on the IOGPU user client.