iPad mini 4 engineering unit iPad5,2 - 12H60160o - iOS 8.3 (Development)

A pre-production diagnostics build that, as far as public records show, has not been dumped before.

This page documents a single physical unit and the factory OS image recovered from it. Values in monospace are copied verbatim from the device, the PurpleSNIFF report, uname -a, and nvram -p. Anything not directly proven by the dump is marked unconfirmed.

Device identity

Model (ID): iPad5,2
Hardware model: J97AP
Marketing name: iPad mini 4 (cellular)
Model number: 993-05535
Serial: F4KPC09NGJK9
MLB serial: C7L51030079G9T1A1
ECID: 0x000668C010D82826
Region code: LL/A
NAND: 128 GB

The build

OS version: 8.3
Build: 12H60160o not in public firmware trees
Production mode: Development
Kernel: xnu-2784.20.8~15/DEVELOPMENT_ARM64
Kernel built: Sun Jan 18 2015
Baseband: 2.15.02_DEBUG
Device mode: Lockdown OS Mode
Activation: Unactivated

uname -a

Darwin iPad 14.0.0 Darwin Kernel Version 14.0.0: Sun Jan 18
21:10:27 PST 2015; root:xnu-2784.20.8~15/DEVELOPMENT_ARM64_T7000 iPad5,2

nvram -p (boot configuration)

boot-args      debug=0x14e serial=3 osd=strict
auto-boot      true
bootdelay      0
debug-uarts    3
backlight-level 1615

Security state

CPFM: 01
Demotion: SEP demoted
Security mode: Secure
SoC: T7000 (Apple A8)

CPFM 01 means the application processor is development-fused and demotion-capable, which is why the device accepts internal and development-signed images. SEP demoted reports the Secure Enclave in the matching demoted state relevant because the Touch ID calibration tooling (below) depends on a coherent AP/SEP pairing.

SwitchBoard diagnostics

● MesaCal.app

Touch ID (“Mesa”) sensor calibration station.

● Sightglass.app

Display / optical calibration.

● Pyro.app

Codename. Subsystem not yet identified. unidentified

● Ninten.app

Codename (EarthBound cluster). unidentified

GrapeCal.app

Touch controller (“Grape”) calibration.

dtxCaliente.app

Display stress testing.

Ness.app

Factory Burn-In tests.

LcdUTest.app

LCD tests.

LCDMura.app

Display tests.

Operator.app

Component diagnostics.

ZReliability.app

Reliability cycling.

YThermalDOE.app

Thermal DOE.

USBHost.app

USB host interface test.

WiPASmini.app

Wi-Fi / radio test.

SkankBarcodeDisplay.app

On-screen barcode station.

first appearance (Touch ID / A8) carried over from earlier factory images

Diags trees

/AppleInternal/Diags/ directories. The Mesa tree (Touch ID) and the codenamed Earthbound / Oscar trees are the ones absent from the older corpus.

AudioTests   Baseband   Battery    Bluetooth   Debug
Earthbound   FactoryInfo  Fonts    Grape       ISP
Inferno      LCMPatterns  Logs     Mesa        Oscar
RAMDisk      Scripts      Tests    WiFiFirmware  bin

What's actually new here. The Touch ID (“Mesa”) calibration station and the A8-era codenamed diagnostics are the first-documented part of this image. Everything else establishes continuity with the known factory-OS lineage.

Provenance & method

Device reached over SSH into the live NonUI OS (Dropbear).
Root filesystem archived with on-device bsdtar, streamed to host, verified with tar tzf
Identity values read from PurpleSNIFF, uname -a and nvram -p.

The train codename (e.g. a “Donner / Tianshan”-style reconstruction) is not asserted here because the dump hasn't yet been checked for it. These will be updated once the artifact itself confirms them.

Download the dump

Full root filesystem archive of the recovered build. Verify against the SHA-256 before trusting a copy.

↓ Download root dump Check it out on X

file ipad5_2_full.tar.gz · format gzip-compressed tar (live rootfs)
sha256 2c5628c3d8ac1369c55c293a7a6e2cc5f76121c77aa785fbb7dc0d256f948568