Initial skeleton: README, CVE inventory, roadmap, ARCH, ethics + copy_fail_family module absorbed from DIRTYFAIL

modules/_stubs/dirty_pipe_cve_2022_0847/MODULE.md

@@ -0,0 +1,47 @@
+# Dirty Pipe — CVE-2022-0847
+
+> ⚪ **PLANNED** module. See [`../../ROADMAP.md`](../../ROADMAP.md)
+> Phase 2.
+
+## Summary
+
+Pipe-buffer `PIPE_BUF_FLAG_CAN_MERGE` was incorrectly inherited by
+`copy_page_to_iter_pipe()` and `push_pipe()` paths, allowing an
+unprivileged user to write into the page cache of any file readable
+by them.
+
+## Affected kernels
+
+- ≤ 5.16.11
+- ≤ 5.15.25 LTS
+- ≤ 5.10.102 LTS
+
+## Upstream patch
+
+`9d2231c5d74e13b2a0546fee6737ee4446017903` ("lib/iov_iter: initialize
+"flags" in new pipe_buffer")
+
+## Why this module is here
+
+Even in 2026, many production deployments still run vulnerable
+kernels (RHEL 7/8, older Ubuntu LTS, embedded). Bundling Dirty Pipe
+makes IAMROOT useful as a "historical sweep" tool on long-tail
+systems.
+
+## Implementation plan
+
+- C exploit ported from public PoCs (credit upstream authors in
+  `NOTICE.md` when implemented)
+- `detect()`: kernel version check + `/proc/version` parse + test
+  for fixed-version backports
+- `exploit()`: writes `iamroot::0:0:dirtypipe:/:/bin/bash` into
+  `/etc/passwd`, then `su iamroot` — same shape as copy_fail's
+  backdoor mode
+- Detection rules: auditd on splice() calls + pipe write patterns,
+  filesystem audit on `/etc/passwd` modification by non-root
+
+## Not started yet
+
+Pick this up after Phase 1 (module-interface refactor of the
+copy_fail family) so this module can use the standard
+`iamroot_module` shape from the start.

modules/_stubs/entrybleed_cve_2023_0458/MODULE.md

@@ -0,0 +1,56 @@
+# EntryBleed — CVE-2023-0458
+
+> ⚪ **PLANNED** stub module. See [`../../ROADMAP.md`](../../ROADMAP.md)
+> Phase 3.
+
+## Summary
+
+KPTI's user-space-mapped entry trampoline is detectable via
+`prefetchnta` timing, leaking the kernel base address (defeats
+KASLR). Universal across modern x86_64 kernels with KPTI; only
+partial mitigations have shipped upstream.
+
+## Why this is here
+
+EntryBleed is **not a standalone LPE**. It's a **stage-1 leak
+primitive** that future LPE modules can call when they need a kbase.
+Bundling it as a module:
+
+1. Lets other modules `#include "core/entrybleed.h"` and call
+   `entrybleed_leak_kbase()` when they need KASLR defeat
+2. Ships defensive detection rules for prefetchnta-timing-attack
+   patterns (useful for hardened environments)
+3. Documents the technique with a clear writeup so users
+   understand what "stage-1" means in the broader chain
+
+## Empirical status on recent kernels
+
+Verified 2026-05-16: works 5/5 on lts-6.12.88 (no anti-EntryBleed
+mitigation configured). See
+`security-research/findings/audit_io_uring_2026-05-16_poc_attempt.md`
+and the EntryBleed test code at
+`SKYFALL/bugs/leak_write_modprobe_2026-05-16/exploit.c` lines ~73-150.
+
+## Upstream patches
+
+There is no single canonical patch. Partial mitigations include:
+- `CONFIG_RANDOMIZE_KSTACK_OFFSET` (per-syscall kernel stack jitter)
+- Some KPTI hardening discussions on lkml, no merged fix as of
+  lts-6.12.88
+- The community position remains that "KASLR is best-effort,
+  not a security boundary"
+
+## Implementation plan
+
+- Lift the proven EntryBleed code from
+  `SKYFALL/bugs/leak_write_modprobe_2026-05-16/exploit.c` into
+  `module.c` here
+- Expose as both a CLI mode (`iamroot --leak-kbase`) and as a
+  library helper (`uint64_t entrybleed_leak_kbase(void)`)
+- Detection rules: timing-attack pattern flags, perf-counter
+  anomaly detection (informational — these are hard to make precise
+  without false positives)
+
+## Not started yet
+
+Phase 3.

modules/_stubs/fragnesia_TBD/MODULE.md

@@ -0,0 +1,27 @@
+# Fragnesia — CVE pending
+
+> ⚪ **PLANNED** stub. See [`../../ROADMAP.md`](../../ROADMAP.md)
+> Phase 7+.
+
+## Summary
+
+ESP shared-frag in-place encrypt path can be coerced into writing
+into the page cache of an unrelated file. Same primitive shape as
+Dirty Frag, different reach.
+
+## Status
+
+Audit-stage. See
+`security-research/findings/audit_leak_write_modprobe_backups_2026-05-16.md`
+section on backup primitives. Notably: trigger appears to require
+CAP_NET_ADMIN inside a userns netns. On kCTF (shared net_ns) that's
+cap-dead, but on host systems where user_ns clone is enabled it's
+reachable.
+
+## Decision needed before implementing
+
+Is the unprivileged-userns-netns scenario in scope for IAMROOT? If
+yes, this module ships. If we restrict to "default Linux user
+account, no namespace tricks," this module is out of scope.
+
+## Not started.