#Firmware compatibility

Which guest firmware and cloudOS pairings are known to boot, on which hosts. Check it before you pick a release for a new machine, or when a creation fails and you want to know whether the pairing was ever tested.

To see what the current catalog offers on your Mac, run:

vphone-cli fw catalog

#Tested Environments

These are the iPhone17,3 combinations run end to end with the native JB pipeline. The two PR #486 rows (PR #486) reached the lock screen and answered a vphoned ping; a fresh 26.6.2 vm create also completed every stage and exited successfully after its first-boot ping.

#Which cloudOS to use

Use the cloudOS 26.4 beta (26.4-23E5207q) unless you have a reason not to. It is the newest cloudOS that contains vphone600ap, the identity the guest's kernel, SEP and device tree come from, and it needs nothing beyond vphone-cli.

Every later cloudOS (checked on 2026-10-03) lists only the PCC boards and vresearch101ap: iPhone99,11 is gone from SupportedProductTypes, and there is no kernelcache.*.vphone600, sep-firmware.vphone600 or DeviceTree.vphone600ap. On such a cloudOS the research board stands in (the Research Board patch set):

• fw patch turns the research board's device tree and SEP into vphone600's and rebuilds its kernelcache with the vphone600 virtualization kexts, from a recipe for that kernelcache.
• KDK extraction is native; only the link needs root (vphone-cli fw kernelcache). See the kernelcache recipes and Firmware preparation.
• fw prepare refuses a cloudOS that no recipe covers.
• fw catalog lists each iOS release's own cloudOS beside the recommended one, and Launchpad offers it under Firmware.

Other iPhone and iPad versions may work with 26.4-23E5207q, but they have not passed the same end-to-end check.

#iOS 18 guests

iOS 18.1 to 18.7.2 run on their own release's cloudOS, with the userland of the iPhone XS family's IPSWs:

• Create them with vm create --device iPhone11,6. The Minimal preset is the default; --preset standard was checked on 18.6.
• fw catalog --device iPhone11,6 lists the releases.
• Their kernels are kernel-first. From macOS 26.4 on, another Mac or a macOS VM running macOS 15 or 26.0 to 26.3 links the mix over ssh (VPHONE_KMUTIL_SSH; see Firmware preparation).
• Launchpad offers them as the iPhone XS Max, with that Mac as the macOS builder.

18.1, 18.5 and 18.7.2 are checked on VMs; the other four recipes have not been booted yet.

#iPhone17,3 on iOS 27.0.1

iOS 27.0.1 (24A446) fails first boot on bundle 2.5.0 and earlier (reproduced 2026-10-04, also with the pristine Apple launchd): TXM's selector-24 pre-check rejects every binary at init, and the boot panics with unexpected SIGKILL of init. The former txm-boot-precheck_admission patch fixed it (see the research note). With the patch, iPhone17,3 27.0.1 on 26.4-23E5207q boots to the guest and answers a vphoned device.info (verified the same day). Bundle 2.6.0 is the first release that carries it.

This revision replaces that forced type-10 admission with txm-cfw-executable_remap, selected by standard without an OS-version gate. Host tests cover the original signature rejection paths. On iOS 27.1 (24A94425), the tester reports normal startup and App loading, and the runtime probe executes all 28 main/framework original-code remaps with actual RX mappings. The exact historical iOS 27.0.1 pairing has not been retested. See the replacement assessment.

#macOS 26.6.2 hosts

Checked on 2026-10-23 with Core Bundle 2.12.1, and again on 2026-10-24 with Core Bundle 2.12.2, on Mac mini M4 hosts (Mac16,10, 16 GB, macOS 26.6.2 25G83). Every machine was created from nothing, from the CLI. The research-board pairings staged their kernelcache mix as the user and linked it with sudo, then ran sudo vphone-cli vm create. "Default" marks the newest pairing fw catalog gives that device on this Mac, which is what Launchpad's New Machine selects. Each machine then booted twice headless: vphoned answered, device.info reported the release, and the guest's serial log showed no panic.

The tvOS 27.0 (24J361) and HomePod Software 27.2 (24K120) OTAs compress their payload with LZRAVEN, which only macOS 27 unpacks. On an older Mac, fw catalog leaves them out, so Launchpad's default for those devices is tvOS 26.6 and HomePod Software 27.0, and naming one of them is refused before anything is downloaded.

Apple TV 4K (4th generation), AppleTV18,1 / J265AP, is available for bring-up only, with tvOS 27.2 beta (24K120): its full OTA over the Apple TV HD 26.6 restore base and cloudOS 26.4 beta (23E5207q). It requires macOS 27 and the tvos-4k preset. On 2026-10-24 one machine was restored, had its custom firmware installed, and cold booted twice to vphoned and the 4K Language screen of the legacy TVSetup; setup itself was not completed. It is not in the tested table above. See the bring-up notes.

cloudOS 26.7 (23H20) has no iPhone release to pair with. Staged with iOS 26.6.2's userland, its mix links and its 28 kernelcache patches apply, but the CFW patch _vm_fault_enter_prepare finds no site in that kernel. It has not booted.

#Other iPhone models

Models other than iPhone17,3 are described in Other iPhone models.

#iPhone18,1 and iPhone18,2 on iOS 27

These need the kernel-boot-shared_region_size patch (issue #596, 27.0 and 27.0.1). It is on in the standard preset for an iOS 27 base since 2026-10-06.

Their dyld shared cache records a sharedRegionSize of 0x185804000 on 27.0.1, larger than the 0x180000000 shared region of the cloudOS 26.4 guest kernel, so the cache cannot map even with dyld-boot-maxslide taking its slide away. Without the patch, launchd panics on first boot with Library not loaded: /usr/lib/libSystem.B.dylib. iPhone17,3's 27.0.1 cache (0x17D508000) still fits.

The patch widens the arm64 region to 0x1C0000000, the largest size that stays under the 26.4 kernel's own task-map ceilings. When the machine's kernel carries the patch (its PatchReceipt.plist says so), cfw install measures the cache against the widened region, so these devices install and boot; this was validated on iPhone18,2 27.0.1 as above.

Without the patch (an older bundle, or the patch unticked), cfw install refuses such a cache with this explanation instead of leaving a guest that panics. Use iPhone17,3 for iOS 27, or iOS 26 on these devices.

#iPadOS

iPad guests are described in iPadOS guests.

#Earlier reported combinations

An earlier README recorded these host and firmware pairings. They predate the current single-mode flow or lack the same vphoned acceptance evidence, so treat them as research history, not as the current support matrix.

For the full list of patches and where each applies, see the patch inventory.

#See also

• Firmware preparation
• Other iPhone models
• iPadOS guests
• Create and run a machine