mix-up: i have many open and closed reports. when i asked about the status of the "0day" and "closed" report, they mixed things up and gave me the status of another report. My case is: duplicated, credited, no bounty. so i take back calling it "a cheat". The CVE is CVE-2026-28854. This CVE contains patches for multiple vulnerabilities. Two of my reports were merged, but the root causes of the two vulnerabilities are different. One patch is in userland, another, the "0day", is in the kernel. There was no integrity verification before, and this time Apple added one. This integrity verification fixes many other vulnerabilities. In other words, merged although the root causes are different.I discussed some "merge" issues at offensivecon, this is one of the main downsides of ASB. E.G: if i submitted these two vulnerabilities to apple, they might get merged. Two different patches, only 1 CVE. But after the patches, if you bypass both of them, you might get 2 CVEs because the root causes are different. some comments under this post asking why it took 3 years to disclose, i already talked about this at offensivecon. Apple was different from other vendors. In the past, macOS bug bounties were really high. An unsandboxed LPE could get up to $30,000, which other vendors just couldn't match(not anymore, Apple has significantly reduced the payouts now).The downside is the extremely long time it took to fix vulnerabilities. Very few were fixed within 3 months. Most took 6 months, 1 year, 2 years or more. That's also why i disclosed these vulnerabilities at offensivecon this year. Some last related vulnerabilities i submitted 2 years ago were fixed this year. So to be honest, i don't recommend macOS vulnerability research to students under pressure to publish papers. Because you might graduate before Apple even fixes your bugs