From 84dfba3866d66a05f00e4f79ab5e8920692470a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?H3X=C3=90=CE=9B=CE=9EM=D1=B2=D0=98?=
 <42803553+H3XDaemon@users.noreply.github.com>
Date: Wed, 12 Aug 2026 23:05:05 +0800
Subject: [PATCH] Take the previous daemon down on an emulated soft reboot

`ksud soft-reboot` does not reboot the kernel. It runs the
`emulated-soft-reboot` stage, `stop`, post-fs-data, `start`, and then
`on_services()`, which runs every active module's service.sh a second
time. `stop` never reaches the daemon the previous cycle started,
because service.sh detaches it, so from the second soft reboot onwards
two daemons are alive at once. They then claim the same proxy service
name, each latches the other as `originService`, and
`SystemServerService.onTransact` forwards to it unconditionally, so the
binder ping-pong overflows a Java stack: the new daemon dies on
`JNI FatalError ... StackOverflowError`, the survivor times out on the
bridge, and nothing is injected.

That stage is how a module is meant to shut its daemon down, and Zygisk
Next uses it. `-f` is required because app_process sets the nice name in
argv only, so comm stays "main" and `pkill vectord` matches nothing, and
the `^` anchor keeps the pattern off any shell whose own command line
contains the word.

customize.sh sets SKIPUNZIP=1 and installs from a fixed list, so the
script has to be named there as well or it ships in the zip without ever
being installed.
---
 zygisk/module/customize.sh            |  2 +-
 zygisk/module/emulated-soft-reboot.sh | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 zygisk/module/emulated-soft-reboot.sh

diff --git a/zygisk/module/customize.sh b/zygisk/module/customize.sh
index 049ca7b8e..6b5ad34f2 100644
--- a/zygisk/module/customize.sh
+++ b/zygisk/module/customize.sh
@@ -82,7 +82,7 @@ esac
 ui_print "- Device platform: $ARCH ($ABI32 / $ABI64)"
 
 ui_print "- Extracting root module files"
-for file in module.prop action.sh service.sh uninstall.sh sepolicy.rule framework/vector.dex cli daemon.apk daemon manager.apk; do
+for file in module.prop action.sh service.sh emulated-soft-reboot.sh uninstall.sh sepolicy.rule framework/vector.dex cli daemon.apk daemon manager.apk; do
     extract "$ZIPFILE" "$file" "$MODPATH"
 done
 
diff --git a/zygisk/module/emulated-soft-reboot.sh b/zygisk/module/emulated-soft-reboot.sh
new file mode 100644
index 000000000..56dac3c4f
--- /dev/null
+++ b/zygisk/module/emulated-soft-reboot.sh
@@ -0,0 +1,12 @@
+# ksud runs this stage at the start of an emulated soft reboot, before `stop`.
+# The daemon is detached from the service.sh that started it, so `stop` does not
+# reach it while the same cycle runs service.sh again; without this, the second
+# soft reboot leaves two daemons claiming the same proxy service name.
+
+# -f is required: app_process sets the nice name in argv only, so comm stays
+# "main" and `pkill vectord` matches nothing. The ^ anchor keeps the pattern
+# from matching a shell whose own command line contains the word.
+pids=$(pgrep -f '^vectord')
+[ -n "$pids" ] && kill -9 $pids
+
+exit 0