13.2 macOS panics on mrs("ACTLR_EL12")

[0x3c3e]

Overview

13.2 macOS panics on mrs("ACTLR_EL12")

PoC

>>> mrs("ACTLR_EL12")
0x1000
>>> cont

or sysctl -a
or sysctl machdep.cpu.sysreg_ACTLR_EL12

Env

• 13.2 22D49: development, kasan versions
• Mac mini M1 2020

[marcan]

Of course it's going to panic trying to access ACTLR_EL12, since that's an EL2 register and macOS is running at EL1.

If sysreg is trying to read that even when the OS was started at EL1, then that's arguably a macOS bug.