[joeblack2k]

Status: experimental, do not merge as supported

This PR adds a candidate built-in profile for:

• Samsung Galaxy Tab A9+ 5G (SM-X216B / gta9p)
• X216BXXSCEZE8
• Android 16 / One UI 8
• kernel 6.1.128-android14-11-32532371-abX216BXXSCEZE8

Verified

• The HOCON profile resolves in the installed app as Supported / Profile ready.
• GLK1 export succeeds and produces a 1920-byte native document.
• Exact geometry comes from a device-verified companion Galaxy target:
  • compact 6.1 waiter layout
  • select-stack route, waiter shift 1
  • task/cred/SELinux/KASLR offsets
  • mm_struct_sz = 960, four KernelSnitch collisions
  • physical load 0xa8000000, DRAM base 0x80000000
• The companion Galaxy runner achieves verified uid=0(root), u:r:kernel:s0, and automatic recovery after reboot through a host-side watcher.

Not yet verified

The app-native CVE route still resets during the compact pselect race after loading this profile. The profile therefore must not be advertised in Supported Devices or merged as supported until the app route reaches an independently verified root helper. This draft is for comparison with the verified Galaxy implementation and CI validation.

Validation performed

• :profile-core:exportKernelProfiles succeeds.
• Native golden hash added for the generated 1920-byte GLK1 document.
• Legacy migration fixture updated for the new 6.x profile.
• App unit tests were not run locally because this host lacks an Android SDK platform; CI should validate them.

No bootloader unlock, flash, wipe, or partition modification is involved.