Space switching fails silently on macOS 14.8.9 (23J631) x86_64 (with fix commit)

Hey, after updating to 14.8.9 space switching stopped working completely (alt+1/2/... and everything space related), window stuff (focus, resize, swap) still works fine. sudo yabai --load-sa also just returns 1.

Machine: Intel Mac, yabai 7.1.25 bottle, SIP partially disabled (fs + debugging restrictions off), macOS 14.8.9 build 23J631.

Turns out the SA still loads but the pattern scan comes up short. From the unified log (eventMessage CONTAINS "yabai-sa"):

[yabai-sa] could not locate pointer to dock.spaces! spaces functionality will not work!
[yabai-sa] could not locate pointer to dppm! moving spaces will not work!
[yabai-sa] failed to get pointer to setFrontWindow function..

so only 4 of the 7 attrib bits resolve and the handshake reports the payload as unsupported.

What I found in the 23J631 Dock binary:

1. dock_spaces: the old pattern sits on a call site where objc_msgSend is called through a register (call r13), but the new Dock loads it from the GOT instead (mov rbx,[rip+..] / call rbx), so those bytes are gone. The surrounding idiom (lea rax,[rip+G]; mov rdi,[rax]; mov rsi,[rip+selref]) is still everywhere, the spaces singleton just moved to 0x1003F3C50 (I checked it against a bunch of _TtC4Dock6Spaces call sites).
2. dppm: same thing, the receiver load for moveSpace:toDisplay:displayUUID: moved. In this build DPDesktopPictureManagerProtocol is implemented by _TtC4Dock35WallpaperAgentDesktopPictureManager, instance global at 0x1003F3CD8.
3. set_front_window: the function didn't change at all (prologue still matches the old pattern byte for byte, still references com.apple.window_proxies.startup), it just moved to 0x499BE which is below the scan start 0x4A000, so the scan never sees it. Only the start offset needs to change.

I patched all three on a branch, x64 only:

https://github.com/asmvik/yabai/compare/master...lazywalker:yabai:fix/sa-patterns-macos-14.8.9

• new minorVersion >= 8 branch for dock_spaces (scan start 0x4000, anchored on the new call site, disp32 values fixed so it only matches once, G = 0x1003F3C50)
• same for dppm (scan start 0x290000, G2 = 0x1003F3CD8)
• set_front_window: start lowered to 0x40000, pattern untouched

Two caveats: this is x86_64 only, I don't have an ARM machine to check what 14.8.9 did over there. And the new patterns hardcode the disp32 values so they're pinned to 23J631, same shelf life as the old ones I guess.

Happy to adjust if anything's off.