OnePlus 12 - PJD110 (ColorOS 16, sm8650) — all mountify modes trigger kernel watchdog / binder OOM on boot

[xhcz]

Device Info

Item	Detail
Device	OnePlus PJD110 (OP5929L1)
ROM	ColorOS 16, Android 16 (BP2A.250605.015)
Kernel	sm8650 Oki (OPPO/OPlus/Realme), by @cctv_18 [ak3] [source]
Root	KernelSU (ReSukiSU) [source]
mountify	v201

What I've tested

I've tried every combination accessible via config.sh, and all lead to the same outcome:

Mode	sparse_size	lkm_nuke	mountify_stop_start	Result
ext4 sparse	4096	0	✗	watchdog → SIGABRT
ext4 sparse	4096	1	✗	watchdog → SIGABRT
ext4 sparse	2048	0	✗	watchdog → SIGABRT
ext4 sparse	2048	1	✗	watchdog → SIGABRT
ext4 sparse	2048	0	✓	watchdog → SIGABRT
tmpfs	—	0	✗	watchdog → SIGABRT
tmpfs	—	1	✗	watchdog → SIGABRT
manual mode	—	—	—	watchdog → SIGABRT

In all cases the pattern is identical — modules self-disable via anti-bootloop, RescueBrick picks up the rest.

Modules managed by mountify

The modules in modules.txt during testing:

MFGA              ~549 MB (fonts, etc — many small files)
SurfingTile       ~4 MB
extreme_gt        ~4 KB
material_you      ~1 MB
cn.ninebot.ninebot ~556 MB (one large APK + 268 .so files, lib/arm + lib/arm64)

Total ≈ 1.1 GB across ~3000+ files. Testing with only cn.ninebot.ninebot (~556 MB, 269 files) in modules.txt also reproduced the issue.

Boot crash sequence (from dmesg + logcat)

Every boot follows the same timeline:

~38s  [OPLUS_WD] !@WatchDog
~39s  Kernel dumps loaded modules
~45s  init: processing action (kick-init-watchdog)
~45s  binder_alloc: binder_alloc_buf size 2113536 failed, no address space
      binder: cannot allocate buffer: no space left
~55s  init SIGABRT → soft reboot

Relevant dmesg snippets:

[   38.115942] [OPLUS_WD] oplus_show_utc_time: !@WatchDog
[   39.275887] (kernel module dump)
[   45.750213] init: processing action (kick-init-watchdog) 
[   45.762725] binder_alloc: binder_alloc_buf size 2113536 failed, no address space
[   45.762736] binder: cannot allocate buffer: no space left
[   55.221441] init: Sending signal 6 to init 'SIGABRT'

And from logcat crash buffer:

01-05 15:01:33.428  1183  1183 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE)
01-05 16:08:17.428  1177  1177 F libc    : Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE)

Possibly relevant

ColorOS 16 has OPEX (OPlus Extension) active, which creates ~40 loop devices at boot for system-level overlays (seen in /proc/mounts). By the time mountify creates its own loop + overlay structures, the total is ~54 loop devices + 24 overlay mounts.

The binder_alloc_buf ... no address space error suggests binder's virtual address pool is exhausted during the mount creation phase, which coincides with post-fs-data execution.

This device also has /data and /data/adb on different filesystems (seen via stat returning different device IDs), which prevents hard-link-based approaches.

Question

Is there something specific to OPEX-heavy ColorOS 16 devices (large pre-existing loop count + busy post-fs-data binder traffic) that could cause this? Or any other debugging steps or config tweaks I might have missed?

Happy to provide full dmesg/logcat dumps or run any diagnostic commands you suggest.

[xhcz]