[Bug] Note10+ d2s Bootloop with Pre-built 2026-01-16

[fuengfah]

Bug Description

Since Pre-built 2025-12-03, NativeTest detect Surrounding Suspicious and this cause some banking apps closed
JMO
SCB
Yono SBI

Reproduction Steps

Check NativeTest app if you have Surrounding Suspicious detected
Try install, hide then open above banking apps.

Expected Behavior

I tested with other kernel from someone in Eternity telegram group ( sorry I don't have his Github repo link)
It KSUN v32918 with SuSFS2.0 backport with SuSFS add_try_umount feature enabled.

NativeTest only show Found Injection no Surrounding Suspicious. All above banking apps open fine (not open then close)

I attached recorded screen

8mb-Derek.mp4

Actual Behavior

This latest Pre-build when open baning apps it just closed.

8mb-Jack.mp4

Additional Context

I am not sure is it because new KSU v3 hook or SuSFSv2 cause this issue. I tried to ask in telegram group what cause Suspicious Surrounding there is no exact answer some said because /system mount or SuSFS not properly patch

[JackA1ltman]

Theoretically, in the latest version of SuSFS, "add_try_umount" has been removed, it's a function that shouldn't exist, in fact, the whole umount function has been removed, and the umount should be taken care of by MetaModules or KernelSU.

I haven't done a mass app test yet though, I'll take the time to do that.

[fuengfah]

Theoretically, in the latest version of SuSFS, "add_try_umount" has been removed, it's a function that shouldn't exist, in fact, the whole umount function has been removed, and the umount should be taken care of by MetaModules or KernelSU.

It's sidex15's backport that bring back SusFS try_umount. But anyway my concern is about Surrounding Suspicious that cause some banking apps to crash

I haven't done a mass app test yet though, I'll take the time to do that.

I am not sure whether the problem come from SuSFS patch or SukiSU modification. Maybe if possible whenever you have time to create one without SuSFS enable.

This Surrounding Suspicious problem just happen since Pre-built 2025-12-03

[JackA1ltman]

Theoretically, in the latest version of SuSFS, "add_try_umount" has been removed, it's a function that shouldn't exist, in fact, the whole umount function has been removed, and the umount should be taken care of by MetaModules or KernelSU.

It's sidex15's backport that bring back SusFS try_umount. But anyway my concern is about Surrounding Suspicious that cause some banking apps to crash

I haven't done a mass app test yet though, I'll take the time to do that.

I am not sure whether the problem come from SuSFS patch or SukiSU modification. Maybe if possible whenever you have time to create one without SuSFS enable.

This Surrounding Suspicious problem just happen since Pre-built 2025-12-03

SukiSU-Ultra already has umount categorized as a KernelSU feature.

I merge based on upstream simonpunk updates, so if simonpunk doesn't perform a feature withdrawal, I wouldn't consider reintroducing it into the patch.

I think the above problem has something to do with this commit, which deprecated some of the key functions.

Commit:
bd8c4fc

[JackA1ltman]

Because of the negative changes upstream, I am therefore considering not making SuSFS a recommended item anymore.

However, since I personally follow the updates performed upstream, I may not consider targeted feature retention for some KernelSU forks, so for example the try_umount feature may need to be ported manually by yourself.

[fuengfah]

for example the try_umount feature may need to be ported manually by yourself.

That ok, I do not need SuSFS try_umount feature backport. I can work with SukiSu Umount Management with mountify just fine.

I think the above problem has something to do with this commit, which deprecated some of the key functions.Commit:

I will try to flash kernel prebuilt form 2025-12-01

[JackA1ltman]

My device Root hiding is actually pretty basic.

If you have additional Root hiding requests you might want to venture into other people's builds. Since I prefer to merge upstream updates, I'm actually still focusing on stabilizing the compilation and executing the device normally, but I do fail to take into account hiding the root traces (I don't actually know much about the technology related to root hiding XD)

[fuengfah]

My device Root hiding is actually pretty basic.

If you have additional Root hiding requests you might want to venture into other people's builds. Since I prefer to merge upstream updates, I'm actually still focusing on stabilizing the compilation and executing the device normally, but I do fail to take into account hiding the root traces (I don't actually know much about the technology related to root hiding XD)

Latest Pre-built 2026-01-16 cause device bootloop.
Please see attached log files

dmesg.log
logcat.txt

`
avc: denied { sys_nice } for capability=23 scontext=u:r:ueventd:s0 tcontext=u:r:ueventd:s0 tclass=capability permissive=1

avc: denied { entrypoint } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { map } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

avc: denied { read } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

avc: denied { execute } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

avc: denied { getattr } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

avc: denied { read } for name="bin" dev="rootfs" ino=8909 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1
avc: denied { open } for path="/system/lib64/libbase.so" dev="rootfs" ino=11859 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { write } for name="socket" dev="tmpfs" ino=23185 scontext=u:r:logd:s0 tcontext=u:object_r:socket_device:s0 tclass=dir permissive=1
avc: denied { add_name } for name="logd" scontext=u:r:logd:s0 tcontext=u:object_r:socket_device:s0 tclass=dir permissive=1
avc: denied { create } for name="logd" scontext=u:r:logd:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file permissive=1
`

[JackA1ltman]

My device Root hiding is actually pretty basic.
If you have additional Root hiding requests you might want to venture into other people's builds. Since I prefer to merge upstream updates, I'm actually still focusing on stabilizing the compilation and executing the device normally, but I do fail to take into account hiding the root traces (I don't actually know much about the technology related to root hiding XD)

Latest Pre-built 2026-01-16 cause device bootloop. Please see attached log files

dmesg.log logcat.txt

` avc: denied { sys_nice } for capability=23 scontext=u:r:ueventd:s0 tcontext=u:r:ueventd:s0 tclass=capability permissive=1

avc: denied { entrypoint } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 avc: denied { map } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

avc: denied { read } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

avc: denied { execute } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

avc: denied { getattr } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

avc: denied { read } for name="bin" dev="rootfs" ino=8909 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=1 avc: denied { open } for path="/system/lib64/libbase.so" dev="rootfs" ino=11859 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 avc: denied { write } for name="socket" dev="tmpfs" ino=23185 scontext=u:r:logd:s0 tcontext=u:object_r:socket_device:s0 tclass=dir permissive=1 avc: denied { add_name } for name="logd" scontext=u:r:logd:s0 tcontext=u:object_r:socket_device:s0 tclass=dir permissive=1 avc: denied { create } for name="logd" scontext=u:r:logd:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file permissive=1 `

To be honest, I'm not quite sure why. I just merged the upstream updates.
Did you install MetaModules?

[fuengfah]

My device Root hiding is actually pretty basic.
If you have additional Root hiding requests you might want to venture into other people's builds. Since I prefer to merge upstream updates, I'm actually still focusing on stabilizing the compilation and executing the device normally, but I do fail to take into account hiding the root traces (I don't actually know much about the technology related to root hiding XD)

Latest Pre-built 2026-01-16 cause device bootloop. Please see attached log files
dmesg.log logcat.txt
` avc: denied { sys_nice } for capability=23 scontext=u:r:ueventd:s0 tcontext=u:r:ueventd:s0 tclass=capability permissive=1
avc: denied { entrypoint } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 avc: denied { map } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { read } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { execute } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { getattr } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

To be honest, I'm not quite sure why. I just merged the upstream updates. Did you install MetaModules?

Yes I have MM installed and also tried clean flash my ROM after finish setup new device I flashed Latest Pre-built 2026-01-16 again still get bootloop.

@JackA1ltman Did ksud feature avc_spoof is ENABLED (1) by default when building kernel?

[JackA1ltman]

My device Root hiding is actually pretty basic.
If you have additional Root hiding requests you might want to venture into other people's builds. Since I prefer to merge upstream updates, I'm actually still focusing on stabilizing the compilation and executing the device normally, but I do fail to take into account hiding the root traces (I don't actually know much about the technology related to root hiding XD)

Latest Pre-built 2026-01-16 cause device bootloop. Please see attached log files
dmesg.log logcat.txt
` avc: denied { sys_nice } for capability=23 scontext=u:r:ueventd:s0 tcontext=u:r:ueventd:s0 tclass=capability permissive=1
avc: denied { entrypoint } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 avc: denied { map } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { read } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { execute } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { getattr } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

To be honest, I'm not quite sure why. I just merged the upstream updates. Did you install MetaModules?

Yes I have MM installed and also tried clean flash my ROM after finish setup new device I flashed Latest Pre-built 2026-01-16 again still get bootloop.

@JackA1ltman Did ksud feature avc_spoof is ENABLED (1) by default when building kernel?

Yes, but enabling AVC shouldn't be the crux of the issue. It's merely used for masking, and if you haven't enabled the option in the KernelSU Manager, it's not actually applied.

[fuengfah]

My device Root hiding is actually pretty basic.
If you have additional Root hiding requests you might want to venture into other people's builds. Since I prefer to merge upstream updates, I'm actually still focusing on stabilizing the compilation and executing the device normally, but I do fail to take into account hiding the root traces (I don't actually know much about the technology related to root hiding XD)

Latest Pre-built 2026-01-16 cause device bootloop. Please see attached log files
dmesg.log logcat.txt
` avc: denied { sys_nice } for capability=23 scontext=u:r:ueventd:s0 tcontext=u:r:ueventd:s0 tclass=capability permissive=1
avc: denied { entrypoint } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 avc: denied { map } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { read } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { execute } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { getattr } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

To be honest, I'm not quite sure why. I just merged the upstream updates. Did you install MetaModules?

Yes I have MM installed and also tried clean flash my ROM after finish setup new device I flashed Latest Pre-built 2026-01-16 again still get bootloop.
@JackA1ltman Did ksud feature avc_spoof is ENABLED (1) by default when building kernel?

Yes, but enabling AVC shouldn't be the crux of the issue. It's merely used for masking, and if you haven't enabled the option in the KernelSU Manager, it's not actually applied.

I asked someone in Samsung group, they said it
`
Selinux avc problem

The solution restore old selinux if its your kernel
Samsung selinux its special

If you use a generic nonGKI selinux the boot will fail
`
Hope this will help

[JackA1ltman]

My device Root hiding is actually pretty basic.
If you have additional Root hiding requests you might want to venture into other people's builds. Since I prefer to merge upstream updates, I'm actually still focusing on stabilizing the compilation and executing the device normally, but I do fail to take into account hiding the root traces (I don't actually know much about the technology related to root hiding XD)

Latest Pre-built 2026-01-16 cause device bootloop. Please see attached log files
dmesg.log logcat.txt
` avc: denied { sys_nice } for capability=23 scontext=u:r:ueventd:s0 tcontext=u:r:ueventd:s0 tclass=capability permissive=1
avc: denied { entrypoint } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1 avc: denied { map } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { read } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { execute } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1
avc: denied { getattr } for path="/system/bin/logd" dev="rootfs" ino=9009 scontext=u:r:logd:s0 tcontext=u:object_r:rootfs:s0 tclass=file permissive=1

To be honest, I'm not quite sure why. I just merged the upstream updates. Did you install MetaModules?

Yes I have MM installed and also tried clean flash my ROM after finish setup new device I flashed Latest Pre-built 2026-01-16 again still get bootloop.
@JackA1ltman Did ksud feature avc_spoof is ENABLED (1) by default when building kernel?

Yes, but enabling AVC shouldn't be the crux of the issue. It's merely used for masking, and if you haven't enabled the option in the KernelSU Manager, it's not actually applied.

I asked someone in Samsung group, they said it
`
Selinux avc problem

The solution restore old selinux if its your kernel
Samsung selinux its special

If you use a generic nonGKI selinux the boot will fail
`
Hope this will help

Is the recommendation for the Samsung community to disable the AVC feature? Honestly, Samsung and OnePlus devices are truly two brands that march to the beat of their own drum.