[Bug] Modules never load into system_server on Android 15: framework bootstraps fully, then silence — same module loads fine in regular apps

Steps to reproduce

Environment: Xiaomi Mi 6 (sagit), LineageOS 22.2 nightly 20261030 (Android 15, SDK 35), Magisk v31.1 (31100) with built-in Zygisk disabled; Zygisk API provided by NeoZygisk v2.4. Correction (see my comment below): the boot that produced the original logs actually ran 289-08080ef due to a silently failed upgrade; the symptom has since been re-verified identically on a clean 299-666140e install (magisk --install-module + reboot, versionCode=299 confirmed active). SELinux enforcing.
Install an Xposed module that targets the system framework: GPS Setter 20-0.2.0 (io.github.varma322.gpssetter, libxposed API 102). Scope: android (System Framework) plus the module's own app.
Reboot.
Watch /data/adb/lspd/log/verbose_*.log and modules_*.log (debug build, verbose logging enabled).

Expected behaviour

The module loads into system_server the same way it loads into a regular scoped app: Loading module io.github.varma322.gpssetter → Loaded module … successfully for the system process (uid 1000).

Actual behaviour

The framework bootstraps completely inside system_server — injection, PreloadedDex mapping, full LSPlant init, all framework hooks, daemon channel — and then module loading for the system package never starts. No error, no exception, no skip entry; the process simply goes silent after bootstrap:

21:15:22.343 I/VectorNative: System server process detected. Marking for injection.
21:15:22.614 I/VectorNative: Got system server binder via serial on attempt 1.
21:15:22.618 D/VectorNative: Mapping PreloadedDex: fd=77, size=4150928
21:15:22.786 D/LSPlant:         ArtMethod size: 32 … (full init: offsets, runtime instance,
                                 debug_state, class_linker — all successful)
21:15:22.861 D/VectorFrameworkService: Process channel attached for system (pid=2099)   ← daemon side
21:15:22.913 V/Vector:          Loading Vector/Xposed for system (UID: 1000)
21:15:22.916–.960 V/LSPlant:    framework hooks install fine (Thread.dispatchUncaughtException,
                                 ZygoteInit.handleSystemServerProcess, LoadedApk constructors,
                                 ActivityThread.attach, SystemServer.startBootstrapServices,
                                 ActivityTaskSupervisor.resolveActivity, …)
21:15:22.932 I/VectorNative:    Injected Vector framework into system_server.
21:15:22.960 D/Vector:          Successfully hooked Activity Supervisor for Manager redirection.
                               …after this, pid 2099 never logs anything module-related again…

The modules journal of the same boot contains only the regular-app entry (module's own app, opened manually at 21:17):

21:17:06.967  10189:4922 D/VectorModuleManager: Loading module io.github.varma322.gpssetter
21:17:06.990  10189:4922 D/VectorModuleManager: Loaded module io.github.varma322.gpssetter successfully.

Further observations from the same boot:

Daemon logs System services are ready. Mapping modules and scopes. about 5 seconds after the system bootstrap line (21:15:27.5 vs 21:15:22.9), followed by Manager is not installed (the manager app is not installed on this device; everything is configured through the Vector CLI).
There is no Skipped system/1000 line, and the system process stays attached (Process channel attached for system), so this does not look like scope filtering.
Other system processes are skipped normally (Skipped com.android.systemui/10148, Skipped com.android.phone/1001, etc.).
Zero errors/exceptions from pid 2099 in the whole verbose log.

Things tried, with the identical result every time:

Restarting the daemon with --late-inject (daemon logs Started after system_server. Forcing boot completed event. — system_server does not react).
setprop ctl.restart zygote while the late-mode daemon was already running: a fresh system_server bootstraps on the restart and stops at exactly the same place.
Additional sepolicy rules (system_server execmem, properties_serial, …) — no change, and there are no AVC denials around the relevant timestamps.
Identical behavior on the 3116-Release and 3116-Debug artifacts of the same commit.

This does not look like #971: LSPlant initializes successfully here (no mmap dual mapping failure — the complete init trace is in the attached logs).

Xposed Module List

io.github.varma322.gpssetter   (GPS Setter 20-0.2.0, libxposed API 102)

Root implementation

Magisk v31.1 (31100); built-in Zygisk disabled — Zygisk injection provided by NeoZygisk v2.4 (original trace: 289-08080ef due to failed upgrade; re-verified on 299-666140e — see comment). SELinux enforcing.

System Module List

zygisksu                 (NeoZygisk v2.4-299)
zygisk_vector            (v2.2-3116-d1d43f3c-Debug — the build in this report)
playintegrityfix         (v19)
tricky_store             (v3.1.0)
trickystore_autofetch    (v1.4.1)
hma_oss_zygisk           (oss-173)

Vector version

v2.2 (3116-d1d43f3c-Debug), GitHub Actions master artifact of 2026-11-05 (reproduced identically on the 3116-Release artifact of the same commit).

Android version

Android 15 (SDK 35), LineageOS 22.2 nightly 20261030, Xiaomi Mi 6 (sagit), arm64-v8a.

Version requirement

I am using the latest debug build from GitHub Actions (master, 2026-11-05).

Logs

Original trace excerpts are quoted inline above (full verbose / modules / kmsg / props + magisk.log of that boot available on request). Fresh logs of the re-verification boot on genuine 299 are quoted in my correction comment below, full set also available on request.

One question that would help me debug further: what exactly is supposed to trigger module loading for the android package after Loading Vector/Xposed for system (UID: 1000)? With that pointer I can add targeted instrumentation — happy to test any build on this device.

Correction to the environment + re-verification on a clean 299 build

Correction first: the environment described in the report was wrong. The logs referenced there were produced on a boot where my NeoZygisk upgrade had silently failed — the active build was actually 289-08080ef, not 299 (the wrong zip got flashed during the module-file swap; discovered later by reading module.prop of the active module tree). Apologies for that — the report body has been corrected accordingly.

I have now re-verified the symptom on a genuine 299-666140e installation:

staged properly via magisk --install-module + full reboot;
/data/adb/modules/zygisksu/module.prop = versionCode=299, and the running monitor binary (/proc/$(pidof zygisk-ptrace64)/exe) is the newly swapped file;
the symptom reproduces identically. Excerpts from that boot (2026-11-05 22:04):

system_server (pid 2094, uid 1000) — full bootstrap, then module loading never starts:

22:04:39.250  0:2094 I/VectorNative: System server process detected. Marking for injection.
22:04:39.479 1000:2094 D/VectorNative: Attempting injection into system_server.
22:04:39.482 1000:2094 I/VectorNative: Got system server binder via serial on attempt 1.
22:04:39.487 1000:2094 V/VectorNative: Fetched framework DEX: fd=77, size=4150928
22:04:39.487 1000:2094 D/VectorNative: Mapping PreloadedDex: fd=77, size=4150928
22:04:39.525 1000:2094 V/VectorNative: Framework ClassLoader created successfully.
22:04:39.653 1000:2094 D/LSPlant: ArtMethod size: 32 … (full init: offsets, runtime
                               instance, debug_state, class_linker — all successful)
22:04:39.792 1000:2094 V/Vector: Loading Vector/Xposed for system (UID: 1000)
22:04:39.795–39.854     V/LSPlant: framework hooks install fine (Thread.dispatchUncaught-
                               Exception, ZygoteInit.handleSystemServerProcess, LoadedApk
                               constructors, ActivityThread.attach, SystemServer.
                               startBootstrapServices, ActivityTaskSupervisor.resolveActivity, …)
22:04:39.853 1000:2094 D/Vector: Successfully hooked Activity Supervisor for Manager redirection.
22:04:41.477 1000:2094 I/SELinux: (system_server loading file_contexts — normal boot chatter)
…after this, pid 2094 never logs anything module-related again — no error, no
exception, no skip entry…

The modules journal of the same boot contains only regular-app entries — the module's own app opened manually four minutes later loads it fine:

22:08:42.937 10189:5183 D/VectorModuleManager: Loading module io.github.varma322.gpssetter
22:08:42.961 10189:5183 D/VectorModuleManager: Loaded module io.github.varma322.gpssetter successfully.

Scope verified after the reboot via cli scope ls io.github.varma322.gpssetter → android, com.google.android.gms, io.github.varma322.gpssetter — the system framework was in scope, yet module loading for the android package never started.

Full logs of this 299 boot (verbose / modules / dmesg / getprop / magisk.log + an environment README) are packed and ready — since GitHub does not accept issue attachments through the API, tell me if you want them and I will paste any part inline.

The question from the report stands: what exactly is supposed to trigger module loading for the android package after Loading Vector/Xposed for system (UID: 1000)? Happy to add targeted instrumentation on this device.

Please READ #123, and upload /data/adb/lsp/log as logs.

It is annoying to see arrogant AI agents posting non-sense analysis while not providing original logs.

Installed the debug CI build and pulled the raw logs.

Vector: v2.2 3116-2a8b39c3 (debug artifact — master state, PR #964 head before the squash into 093ea59), via magisk --install-module + reboot
NeoZygisk 299-666140e; manager installed as a user app (org.matrix.vector.manager, shows "Vector Active")
Same behavior on this boot (log/verbose, 11:12): system_server (pid 2163) bootstraps fully — last Vector line from pid 2163 is New hook took 1487us at 11:12:44.142 — then nothing module-related, no error, no skip entry. The same module loads fine into a regular scoped app minutes later (log/modules).

Vector-logs-master-2a8b39c3-20261106.zip attached: raw log/ (boot 11:12, the 2a8b39c build) + log.old/ (boot 10:39, the earlier d1d43f3 build, same symptom). Files unmodified except the device serial scrubbed.

Vector-logs-master-2a8b39c3-20261106.zip

Which is the Xposed module you want to inject into system_server ? Did you configure the module scope via the manager UI ?

android doesn't mean system_server since a long time ago. For cli usage, use the name system (still a history legacy we have to bear for a while), for UI usages, choose system_server.

Navigation Menu

Repository navigation

[Bug] Modules never load into system_server on Android 15: framework bootstraps fully, then silence — same module loads fine in regular apps #1061

Steps to reproduce

Expected behaviour

Actual behaviour

Xposed Module List

Root implementation

System Module List

Vector version

Android version

Version requirement

Logs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

[Bug] Modules never load into system_server on Android 15: framework bootstraps fully, then silence — same module loads fine in regular apps #1061

Description

Steps to reproduce

Expected behaviour

Actual behaviour

Xposed Module List

Root implementation

System Module List

Vector version

Android version

Version requirement

Logs

Activity

veZuk commented on Nov 5, 2026

JingMatrix commented on Nov 6, 2026

veZuk commented on Nov 6, 2026

JingMatrix commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions