Calif says it built a data-only macOS 26.4.1 kernel local privilege escalation on bare-metal M5 with MIE enabled, starting from an unprivileged user and ending at a root shell. The actual 55-page report is withheld until Apple ships fixes, so the post is useful as a boundary marker for AI-assisted exploit work, not as independent proof of the chain.