Android model paired with a mobile GPU family that model never shipped
br.android_model_gpu_incoherent · convicts
What it catches
MODEL <-> GPU-family coherence — the source-fork rung beyond br.mobile_gpu_not_mobile. Pixels have a DETERMINISTIC SoC per generation (Google fixes it): Pixel 1-5 = Qualcomm Snapdragon => Adreno; Pixel 6+ = Google Tensor => ARM Mali/Immortalis. A pinned Pixel model (the model is already held across the 3-surface CH-UA-Model ratchet: header ch_ua_mobile_no_model + main-JS mobile_no_js_model + worker uadata_model_worker_divergence) whose WebGL renderer names a mobile GPU of the WRONG family for that generation is a SOURCE-LEVEL FORK that spoofed a COHERENT mobile GPU string — evading br.mobile_gpu_not_mobile (the string IS a mobile GPU family) — but the wrong one for the device it claims to be. Since the model itself is realm-ratcheted (a forge on any one surface is caught), a coherent model + a GPU that model never shipped is a contradiction only a fork produces. FP-SAFE: scoped to Pixels (deterministic SoC), fires ONLY when the renderer is a mobile GPU (adreno/mali/immortalis/xclipse/powervr) of a family the claimed Pixel never used (Adreno under a Tensor Pixel, or Mali/Immortalis under a Snapdragon Pixel). EXPERIMENTAL (w0.6; the Pixel->SoC map needs extension as new Pixels ship). GROUNDED LIVE: SPOOF_UA=<Pixel 5 UA> + KS_FORGE_JS_MODEL='Pixel 5' (pins the model) + KS_RENDERER='Mali-G78' (Pixel 5 is Adreno, not Mali) FIRES android_model_gpu_incoherent while mobile_gpu_not_mobile stays SILENT (Mali IS a mobile GPU); the same with KS_RENDERER='Adreno (TM) 620' (correct for Pixel 5) does NOT fire it. Reopened-axis frontier: unspoofable-substrate/realm-fact vs coherent-string-fork.
Signals it reads
browser.android_model_gpu_incoherent
How it fires
present
Bypassed by 10
Frontier evaders that reach the detector uncaught (scored only suspicious, defeating every convicting tell) — this check is not one that stops them. The red-team frontier this detection still has to convict.