AArch64 `FEAT_PAuth_LR` instructions unsupported, leads to other issues

Environment

Tue Sep 29 12:23:56 PDT 2026
radare2 6.2.3 +37766 abi:147 @ darwin-arm_64
birth: git.6.2.2-277-g42f682c722 2026-09-29__12:19:52
commit: 42f682c722f1c962a60ac5375adef63ee3ecd7cc
options: gpl -O2 cs:5 cl:2 make
Darwin arm64

Description

Apple's A20 SoC (iPhone 18 Pro series) supports FEAT_PAuth_LR and firmware for those devices uses the new PACIBSPPC, RETABSPPC, etc. instructions.

These instructions are not supported by Capstone 5, and therefore lead to other analysis breakage.

As an example, using the attached file:

r2 -F kernelcache com.apple.kernel-24A437-iPhone19,2
[0xfffffe000b47c000]> pd 10
            ; CODE XREF from section.18.__TEXT_BOOT_EXEC.__bootcode @ +0x2c(x)
            0xfffffe000b47c000      fea7c1da       invalid

We can see that this is the unsupported PACIBSPPC instruction:

; echo 'pacibsppc' | /opt/homebrew/opt/llvm/bin/llvm-mc -triple=aarch64 -mattr=+pauth-lr -show-encoding
        pacibsppc                               // encoding: [0xfe,0xa7,0xc1,0xda]

This breaks things like function start detection (which either returns one instruction past the real start, or fails entirely), and likely much more.

I've attached a patch which cheaply adds support for these instructions by decoding them as their nearest equivalents. This fixed some stuff for me, but I doubt this is the correct long-term solution.

Test

com.apple.kernel-24A437-iPhone19,2.zip

feat_pauth_lr_hack.patch