How can you not be romantic about UNIX domain sockets?

At DEFCON 34, the author gave a technical iOS talk and faced a crash during their demo. They discovered the crash occurred only after a freshly booted iOS device, ruling out randomness like ASLR or multi-thread race conditions. The project involved a VM with SSH server functionality inside an iOS app, which implemented multi-processing semantics by creating threads instead of child processes.

The VM also provided a logical code signing bypass for running unsigned exploits over SSH connections. The crash was traced to the initialization of the SSH connection, where the VM's TTY implementation kept failing verification checks. Debugging revealed an inconsistency in the inode numbers associated with the UNIX domain socket ends.

The issue stemmed from the kernel's logic in assigning an inode for sockets, which was initialized to zero. The initial call to fstat() on a socket yielded an inode of 0, causing subsequent calls to assign a different inode to the same socket. The bug had been present in the XNU kernel since its release in March 2001 with Mac OS X 10.0, affecting all earlier versions of iOS.

The author noted that this oversight could potentially impact many programs and wondered if other system services might be inadvertently causing the issue.