Analyzes 239 iOS appboot CBOR captures across four sections:
1. Static header: bytes 0-127 confirmed identical across all 165 standard-
prefix 352B samples; CBOR tag 55799 + map(7) + 2.5 key-value pairs.
2. Per-request tail: 64-byte region contains a 7-byte random nonce encoded
3× with constant XOR (f41b...) between copies; not a counter/timestamp.
3. 144B variant: map(6) vs map(7), static header 0-88 only, no session
region, scattered throughout capture (not session-boundary-clustered).
4. Full hex dump and CBOR structure walkthrough for representative samples.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
