`analyze_kallsym_info error on 4.4.302 Neutron clang kernel: "bad rela offset" past image_size`

[kgursu]

Please check before submitting an issue | 在提交 Issue 前请检查

• I searched the issues and didn't found anything relevant | 我已经搜索了 Issues 列表，没有发现于本问题相关内容
• If the patch fails or the image cannot be booted after flashing the new boot.img, visit KernelPatch to clarify your doubts | 修复失败或刷入修补后镜像不能启动，请前往 KernelPatch 提问
• I will upload the bug report file in APatch Manager > Settings > Send logs | 我会上传 Bug Report 文件从 APatch 管理器 > 设置 > 发送日志
• I know how to reproduce the issue, which might not be specific to my device | 我知道如何重新复现这个问题

Version requirements | 版本要求

• I'm using the latest CI version of APatch Manager | 我正在使用最新 CI 版本

Bug description | 描述 Bug

I worked with an AI and it gave me this output here.

Summary

kptools -p fails at analyze_kallsym_info. Relocation entry application is
aborted by a bounds check, and every subsequent kallsyms lookup fails as a
result.

Device / build

Device	jackpotlte (Samsung Galaxy A8 2018, SM-A530F)
SoC	Exynos 7885
ROM	XROM V161 (Android 16 base)
Kernel	4.4.302-p6-Eureka_R25U
Toolchain	Neutron clang 18.0.0git
Build date	Wed Jun 17 06:27:23 KST 2026

Note: this kernel has a non-standard arm64 header (magic at 0x30). A second
magic was written into the unused NOP slot at 0x38 so kptools could get past
header validation. The failure below happens after that.

Full output

+ ./kptools -p -i kernel.ori -S su -k kpimg -o kernel
[-] tools/patch.c:634/patch_update_img(); analyze_kallsym_info error
[+] kernel image_size: 0x016b7350
[+] kernel uefi header: false
[+] kernel load_offset: 0x00080000
[+] kernel kernel_size: 0x01d12000
[+] kernel page_shift: 12
[+] new kernel image ...
[+] is_gki: false
[+] linux_banner 1: Linux version 4.4.302-p6-Eureka_R25U (Furina@Love) (Neutron clang version 18.0.0git ) #1 SMP PREEMPT Wed Jun 17 06:27:23 KST 2026
[+] linux_banner offset: 0xf178bd
[+] kernel version major: 4, minor: 4, patch: 255
[+] kallsyms_token_table offset: 0x00d95ec8
[+] endian: little
[+] kallsyms_token_index offset: 0x00d96210
[+] arm64 relocation kernel_va: 0xffffff8010000000
[+] arm64 relocation table range: [0x0122f3e0, 0x015554f8), count: 0x00021961
[?] bad rela offset: 0xffffff80116b93f0
[?] find kallsyms_markers error
[+] kallsyms_markers range: [0x00d95bd8, 0x00d95ec4), count: 0x000000ba
[+] try kallsyms_offsets first for 64-bit relative-base kernel
[?] find approximate kallsyms_offsets error
[-] tools/kallsym.c:375/find_approx_addresses(); find approximate kallsyms_addresses error
[+] kallsyms_markers range: [0x00d95bd8, 0x00d95ec4), count: 0x000000ba
[+] try kallsyms_offsets first for 64-bit relative-base kernel
[?] find approximate kallsyms_offsets error
[-] tools/kallsym.c:375/find_approx_addresses(); find approximate kallsyms_addresses error
+ patch_rc=1

Analysis

The offending relocation target is 0xffffff80116b93f0. Against the reported
relocation base kernel_va = 0xffffff8010000000 this is file offset
0x016b93f0. Reported image_size is 0x016b7350, so the target sits 0x20A0
bytes past the end of the parsed image, and the bounds check rejects it.

The header's image_size field at 0x10 is 0x01D12000, which is the in-memory
size including BSS. If the check compares against the on-disk size rather than
the in-memory size, relocation targets that legitimately land in BSS would be
rejected. That would explain why the apply <N> relocation entries line, present
in working runs, never appears here. Relocations are never applied, so the
kallsyms walk operates on unrelocated data and every lookup after
kallsyms_token_index fails.

Possibly related

• Successful patch with questionable "no symbol", not booting. Awaiting untested builds bmax121/KernelPatch#158 (4.14.355, Neutron clang 19)
• Failed to patch :( bmax121/APatch#1209 (4.14.355, clang 19)
• Patch Failed (Google pixel 2 xl) (4.4.302) kallsyms_num_syms error bmax121/KernelPatch#105 (4.4.302, clang 17)

All are clang-built relocatable kernels failing in find_approx_addresses.

Reproduce method | 复现方法

1. Click Install
2. Select a boot image to patch
3. Pointing to the kernel image (boot.img fails from the start, then used a patched version of boot image, which is boot-kfix.img boot-kfix.txt)
4. Patching fails while giving an output.

Expected behavior | 预期行为

I expected to get a patched version of kernel image.

Actual behavior | 实际行为

Failure with the mentioned output.

Screenshots | 截图

No response

Logs | 日志

No response

Device name | 设备名称

jackpotlte (Samsung Galaxy A8 2018, SM-A530F)

OS version | 系统版本

16

APatch version | FolkPatch 版本

5.0 (115003)

Kernel version | 内核版本

4.4.302-p6-Eureka_R25U

KernelPatch version | KernelPatch 版本

0.13.3

Other information | 其他信息

FolkPatch_bugreport_2026-07-31_21_21.tar.gz
Original kernel file: kernel.txt
Kallsyms info: kallsyms.txt

zcat /proc/config.gz | grep KALLSYMS
CONFIG_KALLSYMS=y
# CONFIG_KALLSYMS_ALL is not set