Theettam 2.6 — SELinux fsck+adbd spoof (all 7 flavors)

Theettam Kernel — peridot 6.1.175. All 7 flavors green.

New in 2.6 — SELinux DirtySepolicy spoofs (SukiSU flavors)
selinux_hide now reports these VoltageOS device-policy edges as denied to detection apps (Duck Detector's DirtySepolicy canaries), while the live rules stay intact:

• fsck_untrusted → self:capability sys_admin — hardened (context-based match; the 2.5 version used a SECCLASS_CAPABILITY constant that could silently no-op)
• adbd → adbroot:binder call — new (the Lineage adb-root edge)

Together these clear the two "Allowed" DirtySepolicy edges → fully-green SELinux card on the SukiSU-Ultra and Premium SukiSU flavors, without turning off USB debugging. (KSUN/ReSukiSU/APatch don't ship SukiSU selinux_hide, so this doesn't apply to them.)

If you flashed 2.5 and fsck_untrusted still read allowed — that was the SECCLASS no-op. Flash a SukiSU-Ultra 2.6 build to get the working masks.

Flavors: KSUN3.3.0 · KSUN+SUSFS · KSUN+SUSFS+DroidSpaces · SukiSU-Ultra+SUSFS (masks) · Premium SukiSU+SUSFS+DroidSpaces (masks) · ReSukiSU+SUSFS · APatch/KPM.

Companion: VoltageOS users → ROM Prop Hide module. Remaining Custom-ROM warning (libstagefright/hal_lineage) needs a ROM rebuild.

Base: peridot 6.1.175 (ACK android14-6.1-lts + BORE + ADIOS).

Theettam 2.5 — SELinux fsck_untrusted spoof + all 7 flavors

Theettam Kernel — peridot 6.1.175 (POCO F6 / Redmi Turbo 3, SM8635). All 7 root flavors, green.

New in 2.5

• 🛡️ SELinux DirtySepolicy spoof (SukiSU flavors) — selinux_hide now reports the fsck_untrusted → self:capability sys_admin edge as denied to detection apps (Duck Detector's DirtySepolicy canary). The live policy rule is untouched, so fsck/adoptable-storage still works — only the app-visible SELinux decision flips. Applies to SukiSU-Ultra + SUSFS and Premium SukiSU flavors (KSUN/ReSukiSU/APatch don't ship SukiSU's selinux_hide).
• 🎨 Theettam-branded installer (ASCII banner + Malayalam-search message), carried over from 2.4.1.

Flavors — flash the one you want in OrangeFox / recovery:

• KSUN3.3.0 — KernelSU-Next v3.3.0 (plain, no SUSFS)
• KSUN3.3.0-SUSFS2.2.0 — KernelSU-Next + SUSFS v2.2.0
• KSUN3.3.0-SUSFS2.2.0-DroidSpaces — KSUN + SUSFS + DroidSpaces
• SukiSU-Ultra-SUSFS2.2.0 — SukiSU-Ultra + SUSFS v2.2.0 + KPM (has the fsck_untrusted spoof)
• Theettam-Premium-SukiSU-SUSFS-DroidSpaces — SukiSU-Ultra + SUSFS + DroidSpaces (has the fsck_untrusted spoof)
• ReSukiSU-SUSFS2.2.0 — ReSukiSU + SUSFS v2.2.0
• APatch-KernelPatch0.13.2 — APatch (real KPM)

Companion: VoltageOS users → flash the ROM Prop Hide module for 0-Danger in Duck Detector. (Remaining Custom-ROM warning = ROM-baked libstagefright/hal_lineage, needs a ROM rebuild.)

Base: peridot 6.1.175 (ACK android14-6.1-lts + BORE + ADIOS).

Theettam 2.4.1 — Theettam-branded installer (all 7 flavors)

Theettam Kernel — peridot 6.1.175 (POCO F6 / Redmi Turbo 3, SM8635). All 7 root flavors, freshly built and green.

New in this release

• Duck Detector shows green. 0 Detections. Warning or any other are from ROM side.
• Hide SeLinux from sukisu ultra. Flash https://t.me/theettamsu/187 if VoltageOS.
• Enable Anonymous linking in ZygiskNext
• Enable AVC log spoofing in Sukisu susfs section

Flavors — flash the one you want in OrangeFox / recovery:

• KSUN3.3.0 — KernelSU-Next v3.3.0 (plain, no SUSFS)
• KSUN3.3.0-SUSFS2.2.0 — KernelSU-Next + SUSFS v2.2.0
• KSUN3.3.0-SUSFS2.2.0-DroidSpaces — KSUN + SUSFS + DroidSpaces
• SukiSU-Ultra-SUSFS2.2.0 — SukiSU-Ultra + SUSFS v2.2.0 + KPM
• Theettam-Premium-SukiSU-SUSFS-DroidSpaces — SukiSU-Ultra + SUSFS + DroidSpaces
• ReSukiSU-SUSFS2.2.0 — ReSukiSU + SUSFS v2.2.0
• APatch-KernelPatch0.13.2 — APatch (real KPM)

Companion: VoltageOS users wanting all-green in Duck Detector — also flash the ROM Prop Hide module.

Base: peridot 6.1.175 (ACK android14-6.1-lts + BORE + ADIOS).

Theettam ROM Prop Hide v1.0.1

For VoltageOS peridot users — flash this to get all-green in Duck Detector (0 Danger).

Standalone Magisk / KernelSU / SukiSU / APatch module. At each boot, via resetprop:

• Deletes VoltageOS identity props: ro.modversion, ro.voltage.*, org.voltage.version
• Normalises ro.build.flavor → peridot_global-user
• Deletes sys.oem_unlock_allowed (its presence contradicts a locked/verified-boot state and reads as a coherence Danger to policy scanners)

Live property-trie edits only — no property-area residue. Reversible: uninstall + reboot. Does not touch verified-boot / StrongBox / Play Integrity. ROM-baked signatures (LineageOS libstagefright symbol, hal_lineage sepolicy) are out of scope for a module and need a ROM rebuild.

Flash the zip in your root manager and reboot.

Source: theettam/modules/theettam_romhide/

Theettam 2.4 — Mbappu edition

Theettam 2.4 for peridot (POCO F6 / Redmi Turbo 3, SM8635) — GKI 6.1.175. Flash the Image; keep stock vendor_dlkm.

What's new in 2.4

• DAMON proactive reclaim + LRU-sort activated (built-in, sysfs-gated — dormant until enabled).
• Boeffla wakelock blocker — sysfs blocklist, empty by default (opt-in; never block modem wakelocks or VoLTE breaks).
• ZRAM writeback capability.
• Neutron clang 23 (LLVM trunk) toolchain.
• SukiSU version fix — reports the real KSU_VERSION 40837 instead of the 13000 fallback.
• New APatch flavor — the only build with working Kernel Patch Modules (.kpm); SukiSU-Ultra's KPM is stubbed upstream.
• DroidSpaces promoted from experimental — boots with containers working; USER_NS also bundled into Premium.
• Already in the base: BBRv3, TEO idle governor, MGLRU, BORE, ADIOS, HZ=300, CAKE, uclamp.

The 7 flavors — install the matching manager only

Zip	Root	Manager
KSUN3.3.0 · KSUN3.3.0-SUSFS2.2.0 · …-DroidSpaces	KernelSU-Next	KernelSU-Next
SukiSU-Ultra-SUSFS2.2.0 · Premium-SukiSU-SUSFS-DroidSpaces	SukiSU-Ultra	SukiSU-Ultra
ReSukiSU-SUSFS2.2.0	ReSukiSU	ReSukiSU
APatch-KernelPatch0.13.2	APatch / KernelPatch	APatch (superkey theettam-change-me — change it)

Boot status

Core flavors (KSUN, SukiSU, ReSukiSU, Premium, DroidSpaces) are boot-confirmed on peridot. APatch is experimental — it patches cleanly and is provided for testing; flash with fastboot recovery ready.

---

🔋 New: Theettam Tweaks module (Theettam-Tweaks-v1.0.zip)

Optional flashable with independent, reversible battery/perf levers — screen-off wakelock trip (data-path only; calls/alarms untouched), VM+I/O tuning, and battery/balanced/performance profiles (cycle via the Action button). Uninstall + reboot fully reverts. Config: /data/adb/modules/theettam_tweaks/tweaks.conf.

---

🔄 Refreshed — upstream root sync (all 7 rebuilt)

• SukiSU-Ultra: integrated the 3 kernel commits from main onto our susfs_new base (x64 dispatcher, tracepoint min-priority, NULL checks) — driver now reports KSU_VERSION 40840, functionally current with main's kernel. (The remaining gap to 40856 is manager-APK/dependency commits that don't touch the kernel.)
• SUSFS 8199bb65 → 090cf407 (still v2.2.0): OPEN_REDIRECT UAF / memory-leak / deadlock fixes — applies to every SUSFS flavor incl. Premium.
• ReSukiSU aa327366 → 0b4f56fd: +16 commits (susfs management rewrite, version-magic-mismatch compat, ksud/manager fixes).

All 7 flavors integrated with no rejects and rebuilt green.

Theettam APatch (real KPM) — alpha — peridot 6.1.175

Standalone real-KPM build for peridot (POCO F6 / Redmi Turbo 3, SM8635).

Root here is APatch / KernelPatch — not KernelSU or SukiSU. This is the only way to get working Kernel Patch Modules (.kpm) on this device: SukiSU-Ultra's KPM is stubbed on every branch, whereas APatch's KernelPatch is the original, functional KPM engine.

What it is

• Clean Theettam 6.1.175 Image (BTF on → VoLTE works; BORE + ADIOS from defconfig; no KSU)
• Patched post-build with KernelPatch 0.13.2 (kptools + kpimg, version d02) — this is KABI-safe (the compiled Image is patched, not the source, so stock vendor_dlkm keeps loading)

Manager & superkey

• Install the APatch app: https://github.com/bmax121/APatch/releases/latest
• Superkey is baked in as theettam-change-me — open APatch and change it immediately (Settings → superkey). Anyone who knows the superkey can get root.

Testing KPM

Attached demo modules load via the APatch app (KPM section) or kpm load:

• demo-hello.kpm — simplest, confirms KPM works
• demo-syscallhook.kpm, demo-inlinehook.kpm — hook demos

⚠️ Experimental — boot-test before relying on it

KernelPatch patched the Image cleanly in CI, but it has not been booted on-device yet. APatch inline-hooks a hardened GKI kernel, so confirm on a device you can recover (fastboot). Report: boots → root granted in APatch → demo-hello.kpm loads → VoLTE call. Keep stock vendor_dlkm.

Theettam Premium alpha 2 — SukiSU-Ultra + SUSFS + DroidSpaces

Theettam Premium — all-in-one Image for peridot (POCO F6 / Redmi Turbo 3, SM8635).
Built from peridot-6.1.175 as a matrix flavor, through the same path as the flavors that boot on device.

What's in it

• SukiSU-Ultra root (KSU_VERSION 40837 — latest, pin 278d822a)
• SUSFS v2.2.0 (root/mount hiding)
• DroidSpaces — full profile (USER_NS on), SYSVIPC relocated into KABI reserve slots 6/7/8
• BTF on → netd/IMS/VoLTE work

Note on KPM

KPM is not included. Every current SukiSU-Ultra branch and release ships KPM as non-functional stubs (the kernel-side loader/query functions do nothing), so it cannot work on GKI regardless of build flags — advertising it would be misleading. Root, hiding, and containers all work without it.

⚠️ Alpha — needs on-device confirmation

SukiSU-Ultra + DroidSpaces as one Image is a new combination. Flash only if you can recover (fastboot). Please test and report:

• Boots to UI
• VoLTE call places/receives
• SukiSU-Ultra manager shows version 40837
• Rootless container under DroidSpaces

Keep stock vendor_dlkm.

Theettam Kernel 2.1 — peridot 6.1.175 (July CLO refresh)

6.1.175 + the July 2026 CLO/Qualcomm vendor refresh. Everything from 2.0.1, plus a
fresh round of upstream security and device-driver fixes.

---

⬇ Pick one

	Zip	Root	SUSFS
🪶	KernelSU-Next	KernelSU-Next v3.3.0	—
⭐	KernelSU-Next + SUSFS	KernelSU-Next v3.3.0	v2.2.0 — start here
🧩	SukiSU Ultra + SUSFS	SukiSU-Ultra	v2.2.0 + KPM
🧬	ReSukiSU + SUSFS	ReSukiSU	v2.2.0 (native)

AnyKernel3 flashes the Image only — stock vendor_dlkm is kept. Keep a backup and fastboot recovery ready.

🆕 New since 2.0.1 — the July CLO vendor refresh

GuidixX 16.2's July update, merged onto the boot-tested 175 base:

• CLO/Qualcomm platform KERNEL.PLATFORM.3.0.r1-13300 + LineageOS sm8650 device bits
• July Android Security Bulletin (ASB-2026-07-06)
• ~25 security/vendor fixes backported ahead of ACK: HID OOB read, dm-bow UAF, f2fs UAF/OOB, qrtr-ns UAF, qcom haptics/thermal/spi-resume, and several device-safety reverts
• CONFIG_CONNECTOR=y (process-event monitoring)

Everything from 2.0.1 is carried unchanged — BORE, ADIOS, BBRv3, the version spoof, all four root/SUSFS flavors.

🔍 Merge audited — nothing of yours was overwritten

• 779/780 ACK 174→175 LTS-delta files verified at 175; the one exception (timer.h) is byte-identical to 2.0.1 and deliberately kept (2-arg hrtimer tracepoint, required to compile). No regression to 174.
• Zero July commits touched BORE, BBRv3, the uname spoof, ADIOS, or the SYSVIPC relocation.
• Only 2 merge conflicts, both resolved to the known-correct side (kept MODULE_SIG=n; took the qrtr UAF fix).
• Config delta vs 2.0.1: only CONFIG_CONNECTOR=y added; GuidixX's MODULE_SIG_SHA256 correctly rejected.

Boot status

Boot-confirmed on-device. The 6.1.175 + July CLO base is identical across all four flavors, and the per-flavor root/SUSFS integration is unchanged from the boot-tested 2.0.1 — so a clean boot on one confirms the shared base for all. Fallback: v2.0.1 remains available.

_{Built from 8825c91b · July CLO refresh via GuidixX/kernel_xiaomi_sm8635 · BORE/ADIOS by firelzrd · SUSFS by simonpunk · Experimental: DroidSpaces (LXC containers)}

Theettam Kernel 2.0.1 — peridot 6.1.175

peridot on GKI 6.1.175 — via a real 3-way merge of ACK android14-6.1-lts.
A bugfix release: same features as 2.0, one kernel bug fixed.

---

⬇ Pick one

	Zip	Root	SUSFS
🪶	KernelSU-Next	KernelSU-Next v3.3.0	—
⭐	KernelSU-Next + SUSFS	KernelSU-Next v3.3.0	v2.2.0 — start here
🧩	SukiSU Ultra + SUSFS	SukiSU-Ultra	v2.2.0 + KPM
🧬	ReSukiSU + SUSFS	ReSukiSU	v2.2.0 (native)

All four are boot-tested on-device. AnyKernel3 flashes the Image only — stock vendor_dlkm is kept.

🧪 5th, experimental: KSUN + SUSFS + DroidSpaces (LXC containers) — not part of the 4 above

	Zip	Root	SUSFS
🧪	KSUN + SUSFS + DroidSpaces	KernelSU-Next v3.3.0	v2.2.0

Different config than the four above — needed CONFIG_SYSVIPC for container support, which took two
bootlooped attempts to get right (full story). Boot-tested and a
real Alpine Linux container confirmed running, but on one device, one test session — not the same
track record as the four flavors above. Full release, raw verification log, and known limitations:
droidspaces-v1 →

Tip

Keep a backup of boot.img / vendor_boot.img and fastboot recovery ready, as always.

---

🩹 Root or modules not mounting?

Most common cause: more than one KernelSU-family manager installed. Each flavor pairs with exactly
one manager, and the kernel crowns a single manager app at boot. With KernelSU-Next, SukiSU and ReSukiSU
managers all installed, the wrong one can end up crowned — root looks half-working and modules stop
mounting.

Try in this order:

1. Uninstall every manager except the one for your flavor.

   Your zip	Install only this manager
   KSUN3.3.0 · KSUN3.3.0-SUSFS2.2.0	KernelSU-Next
   SukiSU-Ultra-SUSFS2.2.0-KPM	SukiSU
   ReSukiSU-SUSFS2.2.0	ReSukiSU

2. Reboot. The manager is crowned during boot, so uninstalling one only takes effect after a restart.

3. Reflash your flavor's zip — 2.0.1 or 2.0 —
   then reboot. Flashing does not touch /data, so your modules and allowlist survive.

4. Check the manager matches the kernel. A manager much older or newer than the kernel's driver can
   fail to talk to it. Use the manager build that pairs with your flavor's driver version.

Still stuck? Note your flavor, manager app + version, and whether modules mount at all — that trio is
enough to tell a crowning problem from a real bug.

---

🐛 Fixed since 2.0

susfs: the ksu/priv_app SIDs resolved before the SELinux policy loaded.

susfs_ksu_resolve_sids() ran from kernelsu_init() — long before policy load, where
security_secctx_to_secid() doesn't fail but returns SECINITSID_KERNEL (1). The resolver discarded the
return code and never checked the value, so both SIDs latched to 1 for the entire boot:

KernelSU: susfs: ksu_sid=1 priv_app_sid=1

Those two SIDs feed exactly one thing: susfs's AVC denial-log spoofing, which disguises ksu-domain
denials as priv_app in the audit log. Pinned at 1, it never matched a real ksu denial (they leaked into
the log) and instead rewrote kernel-domain denials. Now a SID is only latched once it comes back greater
than SECINITSID_KERNEL, with a retry on the supercall path — which only runs post-policy, and is exactly
where a manager enables the spoof.

Scope: the hook sits behind a default-off static key, and none of the actual hiding was affected —
sus_path / sus_mount / sus_kstat go through the driver's own correctly-resolved is_ksu_domain().
2.0 hides correctly; this only matters if you enable avc log spoofing. ReSukiSU was never affected —
its native driver already resolved post-policy.

🔧 Also

• ReSukiSU c61e643a → aa32736680c9 — two commits, both userspace/ksud, so the Image is unchanged
• SukiSU now cloned from its canonical home (SukiSU-Ultra/SukiSU-Ultra) rather than via redirect
• Upstreams are checked automatically on the 5th and 20th — ACK, the device base, all three root drivers, SUSFS

🔍 Everything from 2.0 — unchanged

6.1.175 via ACK android14-6.1-lts (1010 commits, 838 auto-merged, 6 conflicts resolved toward the
device side) · BORE CPU scheduler (sysctl kernel.sched_bore=0 disables at runtime) · ADIOS I/O
scheduler (default) · BBRv3 (default) · stock GKI version string · zero regressions from 1.9-vali
across all 827 defconfig symbols, all 10 SUSFS options, and the AnyKernel3 flasher.

New here? Read Upgrading an Android GKI device kernel to a newer LTS.

---

_{Built from 1f2c32d1cf7a · Previous: v2.0 · Fallback: v1.9-vali (6.1.173) · Experimental: DroidSpaces (LXC containers)
Built on GuidixX/kernel_xiaomi_sm8635 · BORE/ADIOS by firelzrd · SUSFS by simonpunk}

Theettam Kernel 2.0 — peridot 6.1.175 (4 root flavors)

The first LTS bump past 6.1.173 for peridot — a real 3-way merge of ACK android14-6.1-lts.

---

⬇ Pick one

	Zip	Root	SUSFS
🪶	KernelSU-Next	KernelSU-Next v3.3.0	—
⭐	KernelSU-Next + SUSFS	KernelSU-Next v3.3.0	v2.2.0 — start here
🧩	SukiSU Ultra + SUSFS	SukiSU-Ultra	v2.2.0 + KPM
🧬	ReSukiSU + SUSFS	ReSukiSU	v2.2.0 (native)

Use the manager matching your flavor. AnyKernel3 flashes the Image only — stock vendor_dlkm is kept.

Tip

All four flavors are boot-tested on-device. Still: back up boot.img and vendor_boot.img,
and keep fastboot recovery ready.

---

🩹 Root or modules not mounting?

Most common cause: more than one KernelSU-family manager installed. Each flavor pairs with exactly
one manager, and the kernel crowns a single manager app at boot. With KernelSU-Next, SukiSU and ReSukiSU
managers all installed, the wrong one can end up crowned — root looks half-working and modules stop
mounting.

Try in this order:

1. Uninstall every manager except the one for your flavor.

   Your zip	Install only this manager
   KSUN3.3.0 · KSUN3.3.0-SUSFS2.2.0	KernelSU-Next
   SukiSU-Ultra-SUSFS2.2.0-KPM	SukiSU
   ReSukiSU-SUSFS2.2.0	ReSukiSU

2. Reboot. The manager is crowned during boot, so uninstalling one only takes effect after a restart.

3. Reflash your flavor's zip — 2.0.1 or 2.0 —
   then reboot. Flashing does not touch /data, so your modules and allowlist survive.

4. Check the manager matches the kernel. A manager much older or newer than the kernel's driver can
   fail to talk to it. Use the manager build that pairs with your flavor's driver version.

Still stuck? Note your flavor, manager app + version, and whether modules mount at all — that trio is
enough to tell a crowning problem from a real bug.

---

✨ What's new since 1.9-vali

🐧 6.1.173 → 6.1.175	Full ACK android14-6.1-lts merge — 1010 commits, 838 files auto-merged, 6 conflicts resolved toward the device side
⚡ BORE	Burst-Oriented Response Enhancer — sysctl kernel.sched_bore=0 disables it at runtime
💾 ADIOS	Adaptive Deadline I/O Scheduler, now the default
✅ Zero regressions	All 827 defconfig symbols, all 10 SUSFS options on every flavor, and the AnyKernel3 flasher (12/12 files byte-identical) carried over from 1.9-vali. The only deltas are additions.

🔍 Version reporting — unchanged from 1.9-vali

Layer	Effect
CONFIG_LOCALVERSION	reports 6.1.175-android14-11-ga3b9c44908dd-ab13320413 — stock GKI form
CONFIG_UNAME_OVERRIDE	com.google.android.gms is served 6.1.118-android14-11-ga3b9c44908dd-ab13320413
SUSFS spoof_uname	manager-configurable spoofing on top

uname -r returning the real version to your shell is correct — the GMS override is targeted by caller cmdline.

🔍 Testing status — all four boot-confirmed

Flavor	On 6.1.175
KernelSU-Next v3.3.0	✅ boot-tested
KernelSU-Next + SUSFS v2.2.0	✅ boot-tested
SukiSU-Ultra + SUSFS v2.2.0 + KPM	✅ boot-tested
ReSukiSU + SUSFS v2.2.0	✅ boot-tested
6.1.175 + BORE + ADIOS base (no root)	✅ boot-tested

The base was boot-tested on its own before any root went near it, so BORE and ADIOS were
cleared as variables independently of the root ports.

The driver pins, the SUSFS pin (8199bb65, v2.2.0) and the integration scripts are
byte-identical to the 1.9-vali builds, and none of the eleven fs/ files SUSFS touches
differ between 173 and 175 — the port carried over untouched. Only the base moved.

---

🙏 Credits

Built on GuidixX/kernel_xiaomi_sm8635 — device support and
most of the tuning come from there. BORE and ADIOS by Masahito Suzuki (firelzrd). SUSFS by
simonpunk. Root engines by their respective projects. ACK android14-6.1-lts by Google.

_{Fallback: v1.9-vali (6.1.173) remains available and boot-proven.}