apple-sdk-repros

Runnable reproductions of soundness defects in Apple SDK frameworks.

One directory per method or bug, each with a standalone repro.m, a README.md naming the Apple Feedback ID and what the repro proves, and results/ holding one dated record per platform and exact OS build. .github/workflows/track.yml reruns every tracked repro monthly on the macOS majors still receiving Apple security patches and commits a fresh result when one changes. scripts/run-in-tart.sh runs the same repros against macOS majors GitHub's hosted runners don't offer, using tart.

Framework	Method	Status	Feedback
AppKit	+[NSColorPanel sharedColorPanel] lazy-init race	fault: reproduced	not worth filing
AppKit	+[NSDocumentController sharedDocumentController] lazy-init race	fault: reproduced	not worth filing
DeviceCheck	-[DCAppAttestService appAttestController] lazy-init race	fault: reproduced	FB25187723
Foundation	+[NSAppleEventManager sharedAppleEventManager] lazy-init race	fault: reproduced	FB25188007
Foundation	+[NSScriptCoercionHandler sharedCoercionHandler] lazy-init race	fault: reproduced	FB25188007
LocalAuthentication	-[LAContext biometryType] / -[LAContext domainState] cached-pointer race	dynamic-window: window-detected	FB25157119
LocalAuthentication	+[LAContext newInstanceId] / +[LAContext newCommandId] counter race	fault: reproduced	FB25157108
QuartzCore	+[CAAnimation defaultValueForKey:] lazy-cache race	dynamic-window: window-detected	FB25188025
QuartzCore	+[CAEmitterCell defaultValueForKey:] lazy-init race	fault: reproduced	FB25188025
ScreenCaptureKit	-[SCContentSharingPicker defaultConfiguration] lazy-init race	fault: reproduced	FB25187882
ScreenCaptureKit	-[SCContentSharingPicker setDefaultConfiguration:] setter race	fault: reproduced	FB25187882
ScreenCaptureKit	-[SCContentSharingPicker setMaximumStreamCount:] setter race	fault: reproduced	FB25187882
UIKit	-[UIMenuController setMenuItems:] setter race	fault: reproduced	not worth filing
UIKit	-[UIPrintInteractionController setPrintFormatter:] setter race	fault: reproduced	not worth filing
UIKit	-[UIPrintInteractionController setPrintInfo:] unlocked-store race	fault: reproduced	not worth filing
UIKit	-[UIPrintInteractionController setPrintPageRenderer:] setter race	fault: reproduced	not worth filing
UIKit	-[UIPrintInteractionController setPrintingItems:] setter race	fault: reproduced	not worth filing
UIKit	+[UIAccelerometer sharedAccelerometer] lazy-init race	fault: reproduced	not worth filing
UIKit	+[UIMenuController sharedMenuController] lazy-init race	fault: reproduced	not worth filing
UIKit	+[UIPrintInteractionController sharedPrintController] lazy-init race	fault: reproduced	not worth filing

Findings not filed with Apple

The AppKit and UIKit findings marked "not worth filing" race classes that Apple declares main-thread-only (NS_SWIFT_UI_ACTOR, imported as @MainActor in Swift). Their repros call them from several background threads at once, which breaks that contract. On the main thread alone, their unlocked lazy initialization and property stores can never race. They stay here to show what breaking the contract does.