A kqueueexcr_ref leak feeding a triple-free
race. Only needed above 12.00. Budget roughly an hour: the reference count
has to wrap before the race can start and the page looks idle for most of it on
purpose. Leave the console on until the payload menu appears.
Type any address and go. On an offline host every mirrored site answers
by name, so p2jb is enough.
Which one is for my console? A devkit needs the devkit site
— it sets target ID 0x81 and the debugger auth ID. Retail and testkit
both take the ordinary site (target ID 0x82). Picking the wrong one just
fails to jailbreak; it does not harm the console.
Pick the thumbnail icon and the XMB logo separately —
they do not have to match. Both are baked into the payload when you press
Load Jailbreak in the bar at the bottom of the screen.