Skip to content

[Bug] SIGILL crash on injection into zygote on Android 17 Beta 4 #132

@lkxe

Description

@lkxe

Steps to reproduce/复现步骤

  1. Pixel 10 Pro XL running Android 17 Beta 4 (CP21.260330.008)
  2. Stock Kernel 6.6.118 from requested Google tarball with official KernelSU + SUSFS
  3. Flash NeoZygisk module via KernelSU manager
  4. Reboot

Expected behaviour/预期行为

NeoZygisk injects into zygote successfully, Zygisk modules load normally.

Actual behaviour/实际行为

The injector crashes with SIGILL immediately when attempting to call dlopen in the zygote process via ptrace:

[ 2026-04-21T14:05:50.938        0:   907:   907 V/zygisk-core64   ] calling remote function 0x7ab7f8b020 with 2 args, return to 0x7aa3c3f000
[ 2026-04-21T14:05:50.938        0:   907:   907 E/zygisk-core64   ] process stopped unexpectedly after remote call: 0x47f stopped by signal=ILL(4),event=(no event) at ip=0x7AB7F8B020, expected stop at 0x7AA3C3F000
[ 2026-04-21T14:05:50.938        0:   907:   907 E/zygisk-core64   ] remote call to dlopen failed, retrieving error message with dlerror
[ 2026-04-21T14:05:50.938        0:   907:   907 V/zygisk-core64   ] found remote libdl.so!dlerror at 0x7ab7f8b040 (local base 0x7472fd3000, remote base 0x7ab7f87000)

Root implementation/Root 方案

KernelSU Main branch / I believe it is 32475

System Module List/系统模块列表

NeoZygisk
Vector

NeoZygisk version/NeoZygisk 版本

v2.3-282-de38c62

Android version/Android 版本

17 Beta 4 CP21.260330.008

Version requirement/版本要求

Logs/日志

Logs from /data/adb/lspd/
kmsg.log
verbose_2026-04-21T14:05:56.875167.log

Full KernelSU Log
KernelSU_bugreport_2026-04-21_14_26.tar.gz

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions