Turns out I need to mark patches as required...

checkra1n/kpf/bindfs.c

@@ -143,13 +143,57 @@ static void kpf_fsctl_dev_by_role_patch(xnu_pf_patchset_t *xnu_text_exec_patchse
 
 static bool kpf_shared_region_root_dir_callback(struct xnu_pf_patch *patch, uint32_t *opcode_stream)
 {
+    uint32_t *ldr = opcode_stream + 2;
+    uint32_t op = *ldr;
+    uint32_t reg, mask;
+    // Check if we have another load from stack
+    if((op & 0xffc003e0) == 0xf94003e0) // ldr xN, [sp, 0x...]
+    {
+        reg = op & 0x1f;
+        mask = 0x1f;
+        op = *++ldr;
+    }
+    else
+    {
+        reg = 0x10; // 16-31
+        mask = 0x10;
+    }
+    // Make sure we have another load from +0xd8
+    if((op & (0xfffffc1f | (mask << 5))) != (0xf9406c09 | (reg << 5))) // ldr x9, [xN, 0xd8]
+    {
+        return false;
+    }
+
+    // And our cmp x8, x9
+    uint32_t *cmp = ldr + 1;
+    op = *cmp;
+    if((op & 0xffffffff) != 0xeb09011f) // cmp x8, x9
+    {
+        return false;
+    }
+
+    // Then it's possible there's a load to a high reg from the stack
+    uint32_t *bcond = cmp + 1;
+    op = *bcond;
+    if((op & 0xffc003f0) == 0xf94003f0) // ldr x{16-31}, [sp, 0x...]
+    {
+        op = *++bcond;
+    }
+
+    // And finally our branch
+    if((op & 0xff00001e) != 0x54000000) // b.{eq|ne} 0x...
+    {
+        return false;
+    }
+
+    // Now that we're sure this is the right match, enforce uniqueness.
     static bool found_shared_region_root_dir = false;
     if(found_shared_region_root_dir)
     {
         panic("kpf_shared_region_root_dir: Found twice");
     }
 
-    opcode_stream[4] = 0xeb00001f; // cmp x0, x0
+    *cmp = 0xeb00001f; // cmp x0, x0
     found_shared_region_root_dir = true;
 
     puts("KPF: Found shared region root dir");
@@ -161,33 +205,44 @@ static void kpf_shared_region_root_dir_patch(xnu_pf_patchset_t *xnu_text_exec_pa
     // Doing bind mounts means the shared cache is not on the volume mounted at /.
     // XNU has a check to require that though, so we patch that out.
     //
+    // Variants we need to match against:
+    //
+    // 0xfffffff00764c998      801240f9       ldr x0, [x20, 0x20]
+    // 0xfffffff00764c99c      086c40f9       ldr x8, [x0, 0xd8]
+    // 0xfffffff00764c9a0      696f40f9       ldr x9, [x27, 0xd8]
+    // 0xfffffff00764c9a4      1f0109eb       cmp x8, x9
+    // 0xfffffff00764c9a8      a1f3ff54       b.ne 0xfffffff00764c81c
+    //
+    // 0xfffffff0080320f4      601340f9       ldr x0, [x27, 0x20]
+    // 0xfffffff0080320f8      086c40f9       ldr x8, [x0, 0xd8]
+    // 0xfffffff0080320fc      e92340f9       ldr x9, [sp, 0x40]
+    // 0xfffffff008032100      296d40f9       ldr x9, [x9, 0xd8]
+    // 0xfffffff008032104      1f0109eb       cmp x8, x9
+    // 0xfffffff008032108      f41b40f9       ldr x20, [sp, 0x30]
+    // 0xfffffff00803210c      410f0054       b.ne 0xfffffff0080322f4
+    //
     // 0xfffffff007dcabc8      001140f9       ldr x0, [x8, 0x20]
     // 0xfffffff007dcabcc      086c40f9       ldr x8, [x0, 0xd8]
     // 0xfffffff007dcabd0      e91b40f9       ldr x9, [sp, 0x30]
     // 0xfffffff007dcabd4      296d40f9       ldr x9, [x9, 0xd8]
     // 0xfffffff007dcabd8      1f0109eb       cmp x8, x9
     // 0xfffffff007dcabdc      210f0054       b.ne 0xfffffff007dcadc0
     //
-    // /x 001040f9086c40f9e90340f9296d40f91f0109eb00000054:1ffcffffffffffffff03c0ffffffffffffffffff1e0000ff
+    // Due to the possible variants, we just match against the
+    // first two instructions and check the rest in the callback.
+    //
+    // /x 001040f9086c40f9:1ffcffffffffffff
     uint64_t matches[] =
     {
         0xf9401000, // ldr x0, [x*, 0x20]
         0xf9406c08, // ldr x8, [x0, 0xd8]
-        0xf94003e9, // ldr x9, [sp, 0x...]
-        0xf9406d29, // ldr x9, [x9, 0xd8]
-        0xeb09011f, // cmp x8, x9
-        0x54000000, // b.{eq|ne} 0x...
     };
     uint64_t masks[] =
     {
         0xfffffc1f,
         0xffffffff,
-        0xffc003ff,
-        0xffffffff,
-        0xffffffff,
-        0xff00001e,
     };
-    xnu_pf_maskmatch(xnu_text_exec_patchset, "shared_region_root_dir", matches, masks, sizeof(matches)/sizeof(uint64_t), false, (void*)kpf_shared_region_root_dir_callback);
+    xnu_pf_maskmatch(xnu_text_exec_patchset, "shared_region_root_dir", matches, masks, sizeof(matches)/sizeof(uint64_t), true, (void*)kpf_shared_region_root_dir_callback);
 }
 
 static void kpf_bindfs_patches(xnu_pf_patchset_t *xnu_text_exec_patchset)