If you look at the disassembled code for IOIteratorNext in
IOKit.framework, you'll see there is no way this call sequence
should happen.
_IOIteratorNext:
+00 mfspr r0,lr
+04 stw r0,0x8(r1)
+08 stwu r1,0xffa0(r1)
+0C addi r4,r1,0x40
+10 bl 0x905cd014 ; symbol stub for: _io_iterator_next
+14 cmpwi cr7,r3,0x0
IOIteratorNext does not call CFRelease at + 0x10, it calls
_io_iterator_next by way of a dyld_stub, which loads a function
pointer and jumps to it. There are only two reasonable ways that
dyld's function pointer could be wrong.
- its prebound, incorrectly.
- its been stomped by a memory smasher.
My bet, from having witnessed this happen before, is the first.
-Ed
