[LG G Pad X 8.0 Guides, News, & Discussion] dwkindig:
I can't reboot into recovery after the step "adb logcat -s recowvery" completes. If I type "adb reboot recovery", it reboots into the system. If I do "adb reboot bootloader" then use the menu there to reboot into recovery, it boots into system. After that, of course, SELinux only reports "Enforcing" mode, not "Permissive". And, if it matters, I can boot into recovery at any other time via "adb reboot recovery", though once I do I don't have adb access other than sideload. I'm on software version V52120f (build number NRD90U, if that's relevant) which I loaded via UPPERCUT & LGUp using the KDZ in the OP.

Near as I can tell, everything up to that moment is working fine. Output of entire process up to that point is below; does anything here give any indication why "reboot recovery" just does a normal reboot??

J:\Drivers\LG G Pad X 8.0 (V521)>adb push dirtycow /data/local/tmp && adb push recowvery-applypatch /data/local/tmp && adb push recowvery-app_process32 /data/local/tmp && adb push recowvery-run-as /data/local/tmp && adb push TWRP-3.1.1-0_v521-recovery.img /sdcard/twrp.img
[100%] /data/local/tmp/dirtycow
[100%] /data/local/tmp/recowvery-applypatch
[100%] /data/local/tmp/recowvery-app_process32
[100%] /data/local/tmp/recowvery-run-as
[100%] /sdcard/twrp.img

J:\Drivers\LG G Pad X 8.0 (V521)>adb shell
b3:/ $ cd /data/local/tmp
b3:/data/local/tmp $ chmod 0777 *
b3:/data/local/tmp $ ./dirtycow /system/bin/applypatch recowvery-applypatch
warning: new file size (22144) and file old size (152196) differ

size 152196

[*] mmap 0xb1430000
[*] exploit (patch)
[*] currently 0xb1430000=464c457f
[*] madvise = 0xb1430000 152196
[*] madvise = 0 1048576
[*] /proc/self/mem 675282944 1048576
[*] exploited 0xb1430000=464c457f
b3:/data/local/tmp $ ./dirtycow /system/bin/app_process32 recowvery-app_process32
warning: new file size (17992) and file old size (22040) differ

size 22040

[*] mmap 0xabc2c000
[*] exploit (patch)
[*] currently 0xabc2c000=464c457f
[*] madvise = 0xabc2c000 22040
[*] madvise = 0 1048576
[*] /proc/self/mem 1635778560 1048576
[*] exploited 0xabc2c000=464c457f
b3:/data/local/tmp $ exit
J:\Drivers\LG G Pad X 8.0 (V521)>adb logcat -s recowvery
--------- beginning of system
--------- beginning of main
--------- beginning of crash
12-17 19:35:40.110 7410 7410 I recowvery: Welcome to recowvery! (app_process32)
12-17 19:35:40.110 7410 7410 I recowvery: ------------
12-17 19:35:40.110 7410 7410 I recowvery: Current selinux context: u:r:zygote:s0
12-17 19:35:40.110 7410 7410 I recowvery: Set context to 'u:r:system_server:s0'
12-17 19:35:40.111 7410 7410 I recowvery: Current security context: u:r:system_server:s0
12-17 19:35:40.111 7410 7410 I recowvery: Setting property 'ctl.start' to 'flash_recovery'
12-17 19:35:40.114 7410 7410 I recowvery: ------------
12-17 19:35:40.114 7410 7410 I recowvery: Recovery flash script should have started!
12-17 19:35:40.114 7410 7410 I recowvery: Run on your PC or device to see progress: adb logcat -s recowvery
12-17 19:35:40.114 7410 7410 I recowvery: Waiting 3 minutes to try again (in case it didn't start or you forgot to dirtycow applypatch first)...
12-17 19:35:40.189 7420 7420 I recowvery: Welcome to recowvery! (applypatch)
12-17 19:35:40.190 7420 7420 I recowvery: ------------
12-17 19:35:40.190 7420 7420 I recowvery: Loading boot image from block device '/dev/block/bootdevice/by-name/boot'...
12-17 19:35:40.518 7420 7420 I recowvery: Loaded boot image!
12-17 19:35:40.518 7420 7420 I recowvery: ------------
12-17 19:35:40.518 7420 7420 I recowvery: Saving old ramdisk to file
12-17 19:35:40.537 7420 7420 I recowvery: Decompressing ramdisk (gzip -d)
12-17 19:35:40.832 7420 7420 I recowvery: Checking '/cache/ramdisk.cpio' for validity (size >= 4194304 bytes)
12-17 19:35:40.832 7420 7420 I recowvery: '/cache/ramdisk.cpio': 8382976 bytes
12-17 19:35:40.832 7420 7420 I recowvery: File OK
12-17 19:35:40.832 7420 7420 I recowvery: Decompression of ramdisk successful
12-17 19:35:40.832 7420 7420 I recowvery: Deleting '/cache/ramdisk.gz' (no longer needed)
12-17 19:35:40.835 7420 7420 I recowvery: ------------
12-17 19:35:40.835 7420 7420 I recowvery: Opened cpio archive '/cache/ramdisk.cpio' (8382976 bytes)
12-17 19:35:40.836 7420 7420 I recowvery: Wrote new file (308 bytes) to cpio archive,
12-17 19:35:40.836 7420 7420 I recowvery: Final size: 8383204 bytes
12-17 19:35:40.836 7420 7420 I recowvery: ------------
12-17 19:35:40.836 7420 7420 I recowvery: Compressing cpio to ramdisk (gzip -9 -c)
12-17 19:35:44.374 7420 7420 I recowvery: Checking '/cache/ramdisk.gz' for validity (size >= 2097152 bytes)
12-17 19:35:44.374 7420 7420 I recowvery: '/cache/ramdisk.gz': 4412199 bytes
12-17 19:35:44.374 7420 7420 I recowvery: File OK
12-17 19:35:44.374 7420 7420 I recowvery: Compression of ramdisk successful
12-17 19:35:44.374 7420 7420 I recowvery: Deleting '/cache/ramdisk.cpio' (no longer needed)
12-17 19:35:44.380 7420 7420 I recowvery: Loading new ramdisk into boot image
12-17 19:35:44.392 7420 7420 I recowvery: ------------
12-17 19:35:44.393 7420 7420 I recowvery: cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=30 msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlyprintk androidboot.hardware=b3 vmalloc=300m"
12-17 19:35:44.393 7420 7420 I recowvery: Setting permissive arguments on cmdline
12-17 19:35:44.393 7420 7420 I recowvery: cmdline: "console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 user_debug=30 msm_rtb.filter=0x237 ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci lpm_levels.sleep_disabled=1 earlyprintk androidboot.hardware=b3 vmalloc=300m androidboot.selinux=permissive enforcing=0"
12-17 19:35:44.393 7420 7420 I recowvery: ------------
12-17 19:35:44.393 7420 7420 I recowvery: Updating boot image hash
12-17 19:35:44.815 7420 7420 I recowvery: Writing modified boot image to block device '/dev/block/bootdevice/by-name/recovery'...
12-17 19:35:45.160 7420 7420 I recowvery: Done!
12-17 19:35:45.160 7420 7420 I recowvery: ------------
12-17 19:35:45.160 7420 7420 I recowvery: Permissive boot has been has been flashed to /dev/block/bootdevice/by-name/recovery successfully!
12-17 19:35:45.160 7420 7420 I recowvery: You may use 'reboot recovery' now to enter a permissive system.
12-17 19:35:45.160 7420 7420 I recowvery: ------------
12-17 19:35:45.160 7420 7420 I recowvery: Warning: If you don't reboot now, this will continue to run every 3 minutes!
12-17 19:35:45.160 7420 7420 I recowvery: ***********************************************
12-17 19:35:45.160 7420 7420 I recowvery: * give jcadduono a hug, will ya? *
12-17 19:35:45.160 7420 7420 I recowvery: ***********************************************

J:\Drivers\LG G Pad X 8.0 (V521)>adb reboot recovery

<<Here's where it reboots into system instead>>