A type confusion between the ASN.1 BOOLEAN and INTEGER values in the DER entitlement processing functions amfid uses allows macOS applications to claim boolean entitlements, such as com.apple.security.app-sandbox, using the <integer>1</integer> …

A sandboxed iOS application with only the com.apple.developer.game-center entitlement can escape the app sandbox to write files with controlled content and filenames to any location writable by the mobile user. Tested on iOS 26.4.