[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
back again to the RAMpage exploit - tested again the open sourced component drammer:

had to do few fixes in order to compile it with ndk-build for oreo:

diff --git a/helper.h b/helper.h
index cbc3881..480a85e 100644
--- a/helper.h
+++ b/helper.h
@@ -44,6 +44,10 @@
#define BILLION 1000000000L
#define MILLION 1000000L

+#ifndef PAGESIZE
+#define PAGESIZE 4096
+#endif
+
extern FILE *global_of;

static inline uint64_t get_ns(void) {
diff --git a/jni/Android.mk b/jni/Android.mk
new file mode 100644
index 0000000..a5c5eee
--- /dev/null
+++ b/jni/Android.mk
@@ -0,0 +1,7 @@
+LOCAL_PATH := $(call my-dir)
+
+include $(CLEAR_VARS)
+LOCAL_MODULE := rh-test
+LOCAL_SRC_FILES := ../rh-test.cc ../ion.cc ../rowsize.cc ../templating.cc ../massage.cc
+LOCAL_EXPORT_C_INCLUDES := $(LOCAL_PATH)
+include $(BUILD_EXECUTABLE)
diff --git a/jni/Application.mk b/jni/Application.mk
new file mode 100644
index 0000000..ef3b448
--- /dev/null
+++ b/jni/Application.mk
@@ -0,0 +1,5 @@
+APP_PLATFORM := android-26
+APP_OPTIM := debug
+APP_ABI := arm64-v8a
+APP_STL := gnustl_static
+APP_CPPFLAGS += -std=c++11
diff --git a/massage.cc b/massage.cc
index 903e1d8..8a15a41 100644
--- a/massage.cc
+++ b/massage.cc
@@ -18,6 +18,7 @@
#include <fstream>
#include <iostream>
#include <set>
+#include <stdio.h>

#include <assert.h>
#include <fcntl.h>
diff --git a/templating.cc b/templating.cc
index c868d6a..6df160a 100644
--- a/templating.cc
+++ b/templating.cc
@@ -17,6 +17,7 @@

#include <assert.h>
#include <stdlib.h>
+#include <unistd.h>

#include "ion.h"
#include "rowsize.h"

that results with a fail on XZ1c due to not working ION allocations probably:

G8441:/data/local/tmp $ ./rh-test
______ ______ _______ _______ _______ _______ ______
| \ |_____/ |_____| | | | | | | |______ |_____/
|_____/ | \_ | | | | | | | | |______ | \_

[MAIN] ION init
Detected chipset: Qualcomm
[MAIN] No or weird row size provided, trying auto detect
[RS] Trying getprop
[RS] ro.product.model: G8441
[RS] ro.product.name: G8441
[RS] ro.product.board: msm8998
[RS] ro.board.platform: msm8998
[RS] Allocating 256 ion chunk
Could not allocate 256K chunk for row size detection: No such device
1|G8441:/data/local/tmp $

but there is an option -i to "Run ion heap type detector", which results with this

1|G8441:/data/local/tmp $ ./rh-test -i
______ ______ _______ _______ _______ _______ ______
| \ |_____/ |_____| | | | | | | |______ |_____/
|_____/ | \_ | | | | | | | | |______ | \_

[MAIN] ION init
Detected chipset: Qualcomm
Trying to allocate 4KB with heap id: 0 | mask: 1 -> nope (No such device)
Trying to allocate 4KB with heap id: 1 | mask: 2 -> nope (No such device)
Trying to allocate 4KB with heap id: 2 | mask: 4 -> nope (No such device)
Trying to allocate 4KB with heap id: 3 | mask: 8 -> nope (No such device)
Trying to allocate 4KB with heap id: 4 | mask: 10 -> nope (No such device)
Trying to allocate 4KB with heap id: 5 | mask: 20 -> nope (No such device)
Trying to allocate 4KB with heap id: 6 | mask: 40 -> nope (No such device)
Trying to allocate 4KB with heap id: 7 | mask: 80 -> nope (No such device)
Trying to allocate 4KB with heap id: 8 | mask: 100 -> nope (No such device)
Trying to allocate 4KB with heap id: 9 | mask: 200 -> ok!
...... to allocate 4MB with heap id: 9 | mask: 200 -> ok!
...... to allocate 16MB with heap id: 9 | mask: 200 -> ok!
Trying to allocate 4KB with heap id: 10 | mask: 400 -> nope (Invalid argument)
Trying to allocate 4KB with heap id: 11 | mask: 800 -> nope (No such device)
Trying to allocate 4KB with heap id: 12 | mask: 1000 -> nope (No such device)
Trying to allocate 4KB with heap id: 13 | mask: 2000 -> ok!
...... to allocate 4MB with heap id: 13 | mask: 2000 -> ok!
...... to allocate 16MB with heap id: 13 | mask: 2000 -> nope (Operation not permitted)
Trying to allocate 4KB with heap id: 14 | mask: 4000 -> nope (No such device)
Trying to allocate 4KB with heap id: 15 | mask: 8000 -> nope (No such device)
Trying to allocate 4KB with heap id: 16 | mask: 10000 -> nope (No such device)
Trying to allocate 4KB with heap id: 17 | mask: 20000 -> nope (No such device)
Trying to allocate 4KB with heap id: 18 | mask: 40000 -> nope (No such device)
Trying to allocate 4KB with heap id: 19 | mask: 80000 -> nope (No such device)
Trying to allocate 4KB with heap id: 20 | mask: 100000 -> nope (No such device)
Trying to allocate 4KB with heap id: 21 | mask: 200000 -> nope (No such device)
Trying to allocate 4KB with heap id: 22 | mask: 400000 -> ok!
...... to allocate 4MB with heap id: 22 | mask: 400000 -> ok!
...... to allocate 16MB with heap id: 22 | mask: 400000 -> nope (Operation not permitted)
Trying to allocate 4KB with heap id: 23 | mask: 800000 -> nope (No such device)
Trying to allocate 4KB with heap id: 24 | mask: 1000000 -> nope (No such device)
Trying to allocate 4KB with heap id: 25 | mask: 2000000 -> ok!
...... to allocate 4MB with heap id: 25 | mask: 2000000 -> ok!
...... to allocate 16MB with heap id: 25 | mask: 2000000 -> ok!
Trying to allocate 4KB with heap id: 26 | mask: 4000000 -> nope (No such device)
Trying to allocate 4KB with heap id: 27 | mask: 8000000 -> ok!
...... to allocate 4MB with heap id: 27 | mask: 8000000 -> ok!
...... to allocate 16MB with heap id: 27 | mask: 8000000 -> ok!
Trying to allocate 4KB with heap id: 28 | mask: 10000000 -> nope (No such device)
Trying to allocate 4KB with heap id: 29 | mask: 20000000 -> nope (No such device)
Trying to allocate 4KB with heap id: 30 | mask: 40000000 -> nope (No such device)
Trying to allocate 4KB with heap id: 31 | mask: 80000000 -> nope (No such device)
G8441:/data/local/tmp $

the ION_alloc() is using detected chipset's heap id, which is defined to 21 in case of "Qualcomm" in ion.cc:

#define CHIPSET_MSM 21

Just tried to changed it to 25 (which was better promising as can be seen from the "heap type detector" output), i.e. following patch in addition:

diff --git a/ion.cc b/ion.cc
index 5dab653..db982f2 100644
--- a/ion.cc
+++ b/ion.cc
@@ -38,7 +38,7 @@
#include "ion.h"

int chipset;
-#define CHIPSET_MSM 21
+#define CHIPSET_MSM 25
#define CHIPSET_MEDIATEK 1
#define CHIPSET_EXYNOS 4
#define CHIPSET_MAKO 25

and that resulted with following:

G8441:/data/local/tmp $ ./rh-test
______ ______ _______ _______ _______ _______ ______
| \ |_____/ |_____| | | | | | | |______ |_____/
|_____/ | \_ | | | | | | | | |______ | \_

[MAIN] ION init
Detected chipset: Qualcomm
[MAIN] No or weird row size provided, trying auto detect
[RS] Trying getprop
[RS] ro.product.model: G8441
[RS] ro.product.name: G8441
[RS] ro.product.board: msm8998
[RS] ro.board.platform: msm8998
[RS] Allocating 256 ion chunk
[RS] Reading from page 0 and page x (x = 0..64)
616 1011 977 942 900 1034 1004 1045 1008 969 331 383 868 1020 983 1174 1175 1044 1021 1048 1037 1041 972 1055 917 933 1053 1054 1060 1058 1060 1053 1048 1035 1047 1026 876 1058 1040 969 1023 1025 1006 1032 546 286 461 561 713 938 863 916 1043 900 633 1056 964 904 901 1063 1043 956 944 1053
[RS] Median: 1011
[RS] MAD: 45
[RS] IQR: 131
[RS] Corrected IQR: 136
count: 64
[RS] Sequences: 1 9 2 32 4 6 1
[RS] Detected row size: 45056
[RS] WARNING! Weird row size detected, assuming 65536
[MAIN] Row size: 65536
[MAIN] Exhaust ION chunks for templating

The phone REBOOTED after something like 5 minutes without any more output. But at least adb shell reacted on enter during that time with one line scroll, so I kept it running, until I was surprised with a reboot!

I am on the 47.1.A.2.281 firmware version.

Quite strange, might have been due to exhausted memory or was the vulnerability triggered?

Is not the test app supposed to be safe to use, not actually doing any exploiting?

-- edit --

Tried to run it second time:

time adb shell "cd /data/local/tmp; ./rh-test"
______ ______ _______ _______ _______ _______ ______
| \ |_____/ |_____| | | | | | | |______ |_____/
|_____/ | \_ | | | | | | | | |______ | \_

[MAIN] ION init
Detected chipset: Qualcomm
[MAIN] No or weird row size provided, trying auto detect
[RS] Trying getprop
[RS] ro.product.model: G8441
[RS] ro.product.name: G8441
[RS] ro.product.board: msm8998
[RS] ro.board.platform: msm8998
[RS] Allocating 256 ion chunk
[RS] Reading from page 0 and page x (x = 0..64)
445 465 466 497 495 457 467 467 461 453 451 465 467 462 451 451 458 465 465 494 494 459 465 500 494 451 457 500 500 451 451 496 465 465 495 494 456 465 465 455 452 453 467 467 459 451 494 500 465 459 494 494 465 465 497 493 451 464 500 497 453 453 466 466
[RS] Median: 465
[RS] MAD: 12
[RS] IQR: 37
[RS] Corrected IQR: 42
count: 64
[RS] Sequences:
[RS] Detected row size: 0
[RS] WARNING! Weird row size detected, assuming 65536
[MAIN] Row size: 65536
[MAIN] Exhaust ION chunks for templating

real 8m24.525s
user 0m0.000s
sys 0m0.000s

The output is a bit different.

And it took 8 and half minutes to reboot. It was not possible to start another adb shell.

I set the screen not to switch off during charging before the test, so during the run, it was on. When I tried to touch the screen to see if there is any reaction, it did not react. Even the side button to switch the screen on/off did not react. After some time, screen partly updated.

So I guess the rh-test utility overloads the cpu so much that the phone restarts after some time with watchdog or something.

Quite strange that it is possible to overload the cpu so much by an unprivileged app.

-- edit --

Tried it one more time, this time added -O3 compile option, which is present in the original Makefile (used "APP_CPPFLAGS += -std=c++11 -O3" and "APP_OPTIM := release" in Application.mk) - run "adb logcat" and another "adb shell" with "top" in parallel to the test:

time adb shell "cd /data/local/tmp; ./rh-test"
______ ______ _______ _______ _______ _______ ______
| \ |_____/ |_____| | | | | | | |______ |_____/
|_____/ | \_ | | | | | | | | |______ | \_

[MAIN] ION init
Detected chipset: Qualcomm
[MAIN] No or weird row size provided, trying auto detect
[RS] Trying getprop
[RS] ro.product.model: G8441
[RS] ro.product.name: G8441
[RS] ro.product.board: msm8998
[RS] ro.board.platform: msm8998
[RS] Allocating 256 ion chunk
[RS] Reading from page 0 and page x (x = 0..64)
89 60 78 78 78 78 78 78 78 77 77 77 77 77 77 127 128 77 77 77 77 77 77 78 78 62 77 78 78 78 134 134 78 78 78 76 78 77 76 77 77 77 77 77 77 77 127 127 77 77 77 78 78 78 78 78 79 79 78 78 78 134 134 78
[RS] Median: 78
[RS] MAD: 1
[RS] IQR: 1
[RS] Corrected IQR: 6
count: 64
[RS] Sequences: 2 13 2 8 1 4 2 14 2 13 2
[RS] Detected row size: 61440
[RS] WARNING! Weird row size detected, assuming 65536
[MAIN] Row size: 65536
[MAIN] Exhaust ION chunks for templating

real 15m9.253s
user 0m0.000s
sys 0m0.000s

adb logcat (it showed new log entries sporadically in batches):

View attachment adb-logcat-from-rh-test-start.txt

last top from adb shell (please note, it refreshed only sporadically):

Tasks: 712 total, 6 running, 688 sleeping, 0 stopped, 0 zombie
Mem: 3758728k total, 3588816k used, 169912k free, 152k buffers
Swap: 524284k total, 288336k used, 235948k free, 91288k cached
800%cpu 0%user 0%nice 279%sys 1880%idle 2386%iow 7%irq 7%sirq 0%host
PID USER PR NI VIRT RES SHR S[%CPU] %MEM TIME+ ARGS
7062 root 20 0 0 0 0 S 85.8 0.0 0:05.22 [kworker/u16:23]
6965 root 20 0 0 0 0 R 48.3 0.0 0:03.83 [kworker/u16:9]
6976 root 20 0 0 0 0 D 17.1 0.0 0:05.26 [kworker/u16:19]
7061 root 20 0 0 0 0 D 15.5 0.0 0:03.28 [kworker/u16:22]
2466 root RT 0 0 0 0 S 14.4 0.0 0:00.79 [cfinteractive]
7064 root 20 0 0 0 0 D 8.8 0.0 0:04.23 [kworker/u16:25]
6972 root 20 0 0 0 0 D 7.5 0.0 0:01.63 [kworker/u16:16]
7216 root 20 0 0 0 0 D 5.2 0.0 0:01.95 [kworker/u16:26]
6961 root 20 0 0 0 0 S 5.0 0.0 0:04.43 [kworker/u16:4]
6562 root 20 0 0 0 0 D 1.9 0.0 0:05.60 [kworker/u16:20]
6967 root 20 0 0 0 0 S 1.2 0.0 0:03.12 [kworker/u16:10]
148 root 20 0 0 0 0 R 0.7 0.0 0:03.48 [kswapd0]
6975 root 20 0 0 0 0 S 0.6 0.0 0:03.05 [kworker/u16:18]
377 root 20 0 0 0 0 R 0.4 0.0 0:20.36 [kworker/u16:6]
8257 shell 20 0 12M 1.3M 368K R 0.4 0.0 0:02.88 top
1599 system 18 -2 2.4G 167M 166M S 0.4 4.5 3:48.32 system_server
8268 shell 20 0 2.8G 336K 260K D 0.3 0.0 0:16.60 rh-test
6962 root 20 0 0 0 0 S 0.3 0.0 0:01.48 [kworker/u16:8]
89 root 20 0 0 0 0 S 0.2 0.0 0:12.65 [smem_native_rpm]
1235 nobody 20 0 10M 480K 316K S 0.2 0.0 0:10.85 msm_irqbalance -f /system/vendor/etc/msm_irqbalance.conf
7063 root 20 0 0 0 0 D 0.2 0.0 0:03.84 [kworker/u16:24]
1103 root 0 -20 108M 420K 420K S 0.2 0.0 0:04.70 thermal-engine
7 root -2 0 0 0 0 S 0.1 0.0 0:23.91 [rcu_preempt]
7256 root 20 0 0 0 0 S 0.1 0.0 0:00.02 [kworker/4:1]
6925 root 20 0 0 0 0 S 0.1 0.0 0:01.24 [kworker/2:0]
2 root 20 0 0 0 0 D 0.1 0.0 0:00.08 [kthreadd]
7003 root 20 0 0 0 0 S 0.0 0.0 0:00.49 [kworker/3:2]
7552 root 20 0 0 0 0 S 0.0 0.0 0:00.37 [kworker/3:5]
7543 root 20 0 0 0 0 S 0.0 0.0 0:00.20 [kworker/2:2]
7196 root 20 0 0 0 0 S 0.0 0.0 0:01.97 [kworker/1:4]
6252 root 20 0 0 0 0 S 0.0 0.0 0:00.78 [kworker/1:2]
8287 root 20 0 0 0 0 D 0.0 0.0 0:00.00 [kworker/0:2]
8213 shell 20 0 17M 816K 780K S 0.0 0.0 0:00.65 adbd --root_seclabel=u:r:su:s0
2083 radio 20 0 2.2G 14M 14M S 0.0 0.3 0:09.97 com.android.phone
964 nobody 20 0 24M 284K 284K S 0.0 0.0 0:01.78 sensors.qcom

The rh-test console log is again quite different to the other two runs - looks like not very deterministic, the memory row size is not properly detected in any of the tests, instead 65536 is just assumed by default.

The adb log indicates low memory condition, killing lots of android system processes. The top indicates 800% cpu load (i.e. 100% for 8 cpu cores). The rh-test is visible in the last top update before the reboot. The reboot occurred after 15 minutes this time. The adb log cat entry at the end is joking at us:

E OMXNodeInstance: !!! Observer died. Quickly, do something, ... anything...

;)

-- edit --

It looks like it's needed to change MAX_ORDER define in helper.h from 10 to 8 in order to make the rh-test start do something (except exhausting memory & cpu leading to reboot):

adb shell "cd /data/local/tmp; ./rh-test"
______ ______ _______ _______ _______ _______ ______
| \ |_____/ |_____| | | | | | | |______ |_____/
|_____/ | \_ | | | | | | | | |______ | \_

[MAIN] ION init
Detected chipset: Qualcomm
[MAIN] No or weird row size provided, trying auto detect
[RS] Trying getprop
[RS] ro.product.model: G8441
[RS] ro.product.name: G8441
[RS] ro.product.board: msm8998
[RS] ro.board.platform: msm8998
[RS] Allocating 256 ion chunk
[RS] Reading from page 0 and page x (x = 0..64)
1047 1059 1058 1051 1058 1059 1058 1058 1058 1059 1055 1157 1058 1059 991 1037 997 1037 973 1049 1048 1049 1049 1039 1051 1049 1154 1147 1049 1059 1049 1038 1049 1038 1050 1049 1017 933 678 1101 1054 922 1052 1045 1053 1053 1063 1053 1042 1047 1053 1052 1043 1053 1042 1052 1052 1053 1052 1050 930 1052 1042 1159
[RS] Median: 1051
[RS] MAD: 7
[RS] IQR: 15
[RS] Corrected IQR: 20
count: 64
[RS] Sequences: 11 1 2 1 1 1 1 1 7 2 9 3 1 1 18 1 2
[RS] Detected row size: 12288
[RS] WARNING! Weird row size detected, assuming 65536
[MAIN] Row size: 65536
[MAIN] Exhaust ION chunks for templating
Could not share: Too many open files
[EXHAUST] - order 8 (1024 KB) - got 1019 chunks
Could not share: Too many open files
[EXHAUST] - order 7 ( 512 KB) - got 0 chunks
Could not share: Too many open files
[EXHAUST] - order 6 ( 256 KB) - got 0 chunks
[EXHAUST] allocated 1043456 KB (1019 MB)
[MAIN] Initializing patterns
[MAIN] Start templating
[TMPL] - Bytes allocated: 1068498944 (1019 MB)
[TMPL] - Time: 1530849540
[TMPL] - Start templating
[TMPL - status] flips: 0 | expl: 0 | hammered: 0 | runtime: 0 | median: 0 | kb_per_flip: 0.00 | perc_expl: 0.00 | special: 0 | 0-to-1: 0 | 1-to-0: 0
[TMPL - hammer] virtual row 7702777: 0x7588f9d000 | physical row 0: 0x0
[TMPL - deltas] virtual row 7702777: |497|535| |528|528| |529|529| |536|536| |528|528| |515|523| |534|528| |527|526| |577|577| |525|535| |535|525| |525|525| |531|535| |531|525| |526|525| |535|535|
[TMPL - status] flips: 0 | expl: 0 | hammered: 65536 | runtime: 38 | median: 528 | kb_per_flip: 0.00 | perc_expl: 0.00 | special: 0 | 0-to-1: 0 | 1-to-0: 0
[TMPL - hammer] virtual row 7702778: 0x7588fad000 | physical row 0: 0x0
[TMPL - deltas] virtual row 7702778: |526|526| |525|525| |535|535| |525|525| |525|525| |470|504| |427|535| |529|527| |523|526| |579|575| |537|523| |528|527| |528|527| |536|536| |527|528| |527|528|
...

It seems the released source is not complete comparing to released apk. It's possible to extract rh-test64 binary from the released apk to test it in adb shell for better console feedback.

I had it run for like half a day until it caused the phone to reboot, still the log did not show any flips:

$ grep 'Memory\|TEMPL\|Chunk\|Hammering\|c_last' rh-test64.log
VmallocChunk: 0 kB
[TEMPL] delta: 1048576
[TEMPL] delta: 786432
[Chunk 1] 4096KB @ 0xf2700000 (phys: 0x0) | pairs: 2960
[Memory] 2960 aggressor pairs
[Memory] Starting round 1/1
[+ 0] Hammering chunk 1/1 round 1/1 virt 0xf2700000 phys 0x0 len 4194304
[+7455] Hammering chunk 1/1 round 1/1 virt 0xf2700000 phys 0x0 len 4194304 took 7455s
[+7455] [c_last p:5920 f:0 u:0] [c_all p:5920 f:0 u:0] [r_cur p:5920 f:0 u:0] [r_all p:5920 f:0 u:0]
[Memory] Round 1 (1 chunks) took 7455s
[Memory] - total seconds passed: 7455
[Memory] - pairs hammered: + 5920 = 5920
[Memory] - flips: + 0 = 0
[Memory] - unique flips: + 0 = 0
[Memory] - pairs per flip: 0.00 (average)
[Memory] - DRAM accesses: 11840M
[TEMPL] delta: 524288
[TEMPL] delta: 2097152
[Chunk 1] 4096KB @ 0xf2300000 (phys: 0x0) | pairs: 2960
[Memory] 2960 aggressor pairs
[Memory] Starting round 1/1
[+ 0] Hammering chunk 1/2 round 1/1 virt 0xf2300000 phys 0x0 len 4194304
[+7473] Hammering chunk 1/2 round 1/1 virt 0xf2300000 phys 0x0 len 4194304 took 7473s
[+7473] [c_last p:5920 f:0 u:0] [c_all p:5920 f:0 u:0] [r_cur p:5920 f:0 u:0] [r_all p:5920 f:0 u:0]
[Memory] Round 1 (2 chunks) took 7473s
[Memory] - total seconds passed: 7473
[Memory] - pairs hammered: + 5920 = 5920
[Memory] - flips: + 0 = 0
[Memory] - unique flips: + 0 = 0
[Memory] - pairs per flip: 0.00 (average)
[Memory] - DRAM accesses: 23680M
[TEMPL] delta: 1572864
[TEMPL] delta: 524288
[Chunk 1] 4096KB @ 0xf1f00000 (phys: 0x0) | pairs: 2960
[Memory] 2960 aggressor pairs
[Memory] Starting round 1/1
[+ 0] Hammering chunk 1/3 round 1/1 virt 0xf1f00000 phys 0x0 len 4194304
[+6866] Hammering chunk 1/3 round 1/1 virt 0xf1f00000 phys 0x0 len 4194304 took 6866s
[+6866] [c_last p:5920 f:0 u:0] [c_all p:5920 f:0 u:0] [r_cur p:5920 f:0 u:0] [r_all p:5920 f:0 u:0]
[Memory] Round 1 (3 chunks) took 6866s
[Memory] - total seconds passed: 6866
[Memory] - pairs hammered: + 5920 = 5920
[Memory] - flips: + 0 = 0
[Memory] - unique flips: + 0 = 0
[Memory] - pairs per flip: 0.00 (average)
[Memory] - DRAM accesses: 35520M
[TEMPL] delta: 262144
[TEMPL] delta: 524288
[Chunk 1] 4096KB @ 0xf1b00000 (phys: 0x0) | pairs: 2960
[Memory] 2960 aggressor pairs
[Memory] Starting round 1/1
[+ 0] Hammering chunk 1/4 round 1/1 virt 0xf1b00000 phys 0x0 len 4194304
[+6776] Hammering chunk 1/4 round 1/1 virt 0xf1b00000 phys 0x0 len 4194304 took 6776s
[+6776] [c_last p:5920 f:0 u:0] [c_all p:5920 f:0 u:0] [r_cur p:5920 f:0 u:0] [r_all p:5920 f:0 u:0]
[Memory] Round 1 (4 chunks) took 6776s
[Memory] - total seconds passed: 6776
[Memory] - pairs hammered: + 5920 = 5920
[Memory] - flips: + 0 = 0
[Memory] - unique flips: + 0 = 0
[Memory] - pairs per flip: 0.00 (average)
[Memory] - DRAM accesses: 47360M
[TEMPL] delta: 1048576
[TEMPL] delta: 524288
[Chunk 1] 4096KB @ 0xf1600000 (phys: 0x0) | pairs: 2960
[Memory] 2960 aggressor pairs
[Memory] Starting round 1/1
[+ 0] Hammering chunk 1/5 round 1/1 virt 0xf1600000 phys 0x0 len 4194304

So I guess XZ1c is not vulnerable to this bug.