[Sony Xperia XZ2 ROMs, Kernels, Recoveries, & Other] Mike7143:
Ok so a few hiccups, but in the end it all seems to be working! Removed previous tama-root from /data/local/temp then followed your instructions. I had an issue when I tried the new exploit and ran ./tama-mroot though. My H8314 XZ2C suddenly rebooted for some reason and my adb shell closed, see below

C:\Users\Mike\Desktop\a\y\x>adb shell
H8314:/ $ cd /data/local/tmp
H8314:/data/local/tmp $ ls
tama-root
H8314:/data/local/tmp $ rm tama-root
H8314:/data/local/tmp $ ls
H8314:/data/local/tmp $ exit

C:\Users\Mike\Desktop\a\y\x>adb push tama-mroot.zip Magisk-v20.4.zip /data/local/tmp
tama-mroot.zip: 1 file pushed, 0 skipped. 1.5 MB/s (21355 bytes in 0.014s)
Magisk-v20.4.zip: 1 file pushed, 0 skipped. 52.0 MB/s (5942417 bytes in 0.109s)
2 files pushed, 0 skipped. 19.3 MB/s (5963772 bytes in 0.295s)
C:\Users\Mike\Desktop\a\y\x>adb shell
H8314:/ $ cd /data/local/tmp
H8314:/data/local/tmp $ ls
Magisk-v20.4.zip tama-mroot.zip
H8314:/data/local/tmp $ unzip tama-mroot.zip
Archive: tama-mroot.zip
inflating: magisk-start.sh
inflating: magisk-setup.sh
inflating: tama-mroot
H8314:/data/local/tmp $ ls
Magisk-v20.4.zip magisk-setup.sh magisk-start.sh tama-mroot tama-mroot.zip
H8314:/data/local/tmp $ chmod 755 tama-mroot magisk-setup.sh magisk-start.sh
H8314:/data/local/tmp $ ./magisk-setup.sh
+ '[' '' '=' --cleanup ']'
+ ZIPFILE=Magisk-v20.4.zip
+ '[' ! -d magisk ']'
+ mkdir -p magisk
+ cd magisk
+ unzip ../Magisk-v20.4.zip
Archive: ../Magisk-v20.4.zip
inflating: META-INF/MANIFEST.MF
inflating: META-INF/CERT.RSA
inflating: META-INF/CERT.SF
inflating: arm/magiskinit
inflating: META-INF/com/google/android/updater-script
inflating: arm/magiskinit64
inflating: META-INF/com/google/android/update-binary
inflating: chromeos/kernel.keyblock
inflating: chromeos/kernel_data_key.vbprivk
inflating: x86/magiskinit
inflating: common/util_functions.sh
inflating: arm/magiskboot
inflating: x86/magiskinit64
inflating: common/addon.d.sh
inflating: common/magisk.apk
inflating: chromeos/futility
inflating: common/boot_patch.sh
inflating: x86/magiskboot
+ mv META-INF/com/google/android/update-binary arm/magiskboot arm/magiskinit64 common/addon.d.sh common/boot_patch.sh common/util_functions.sh .
+ sh ./update-binary -x
2034+0 records in
2034+0 records out
2082816 bytes (1.9 M) copied, 0.013539 s, 147 M/s
1410+1 records in
1410+1 records out
1443916 bytes (1.3 M) copied, 0.009363 s, 147 M/s
+ pm install -r common/magisk.apk
Success
+ rm -rf update-binary META-INF arm chromeos common x86
+ cd ..
+ ln -s magisk/magiskinit64 magiskpolicy
H8314:/data/local/tmp $ ./tama-mroot
[+] Detected H8314-52.1.A.0.618 target
[+] Mapped 200000
[+] selinux_enforcing before exploit: 1
[+] pipe file: 0xffffffd1e1b58d00
[+] file epitem at ffffffd2225d6b80
[+] Reallocating content of 'write8_inode' with controlled data...........[DONE]
[+] Overwriting 0xffffffd1e1b58d20 with 0xffffffd2225d6bd0...[DONE]
[+] Write done, should have arbitrary read now.
[+] file operations: ffffff9ac2e1ebf8
[+] kernel base: ffffff9ac1c80000
[+] Reallocating content of 'write8_selinux' with controlled data..
C:\Users\Mike\Desktop\a\y\x>

So that was odd, but phone rebooted, no issues. Adb shell back into phone, retried the new exploit, it ran no issue this time! Finished following instructions for magisk, no issues. Tried a few apps for root access, magisk prompted, all good!

Went back and tried to backup up TA partition again, that worked this time! Copied the image file over, its exactly 2MB in size, does that seem correct?

Regarding Magisk, I have a lot to read up on as I've never used it and don't know how it works and the modules and stuff.

---------- Post added at 03:31 PM ---------- Previous post was at 02:49 PM ----------

[MENTION=4418980]j4nn[/MENTION] the new tama-mroot exploit seems to work less than the original tama-root exploit when I try and use it via a terminal emulator.

:/ $ cd /data/local/tmp
:/data/local/tmp $ ./tama-mroot
/system/bin/sh: ./tama-mroot: can't execute: Permission denied
126|:/data/local/tmp $

Assuming it's not possible to exploit via terminal emulator, I wonder if I could cobble together something with Tasker and ADB wifi so that after a reboot I can regain root/magisk without a PC. I'll have to look into that unless you perform more magic! edit: turns out there's no way to enable adb over wifi WITHOUT plugging the phone into something.

Also, is there anything valuable in my TA partition backup that'd help with further development on the H8314 or would you really need another locked stock device that's still got an exploit exposed?