Quest 3S build 1176880143900610 repeats after entering CFI stage

[byf3332]

I am testing on a Quest 3S with the following build:

ro.build.version.incremental=1176880143900610
ro.build.fingerprint=oculus/panther/panther:14/UP1A.231005.007.A1/1176880143900610:user/release-keys
uname -a:
Linux localhost 5.10.226-g9505bf1c2b1a #1 SMP PREEMPT Sun Sep 14 21:09:09 PDT 2025 aarch64 Toybox

The run reaches the CFI stage, then appears to repeat with a new mm_struct leak and replace_fake_fops message. After some attempts the headset will crash and reboot.

I could not find a package for this exact incremental build. I tried q3s_1176880118700610 and q3_51154110174900520; both have the same kernel version string, 5.10.226-g9505bf1c2b1a.

[+] preload starting pid=6856
[*] ksym config: applied 28 overrides from /data/local/tmp/ionstack.conf
[+] slide-kaslr-ok pid=6856 base=ffffffd596800000 slide=000000158e800000
[+] KernelSnitch mm_struct leak 0xffffff8008605000
[*] replace_fake_fops this may cause deadlock
[*] CVE-2026-43499 32-bit ARM stage pid=11682
[*] waiter: FUTEX_WAIT_REQUEUE_PI on f_wait -> pi_target
[*] main: FUTEX_CMP_REQUEUE_PI on f_wait -> pi_target
[*] main: exploit chain complete.
[*] enter CFI stage
[+] KernelSnitch mm_struct leak 0xffffff8003b0a800
[*] replace_fake_fops this may cause deadlock

Around the same time, logcat shows many background/empty processes being killed:

ActivityManager: Killing ... (adj ...): empty #...
Zygote: Process ... exited due to signal 9 (Killed)

Kernel logcat does not show a visible panic/oops/watchdog entry during the same window.

Is this build expected to work, or does it need a different config/package?