[Bug] iOS 18.6.2 guest: VirtualAudio patches fail to find their site ("no retab after the throw"), ringtone preview is silent

Summary

On an iOS 18.6.2 guest, cfw install tries the four VirtualAudio patches and they all fail, so VirtualAudio stays stock. The virtio sound driver and the graph_configurations patches apply fine. In the guest, the boot chime plays but the ringtone preview in Settings is silent.

Environment

• Launchpad / vphone-cli version: 2.9.5
• Host: MacBook Pro, macOS 15.8.1 (24H32)
• Guest: iPhone 16 (iPhone17,3 restore → iPhone99,11), iOS 18.6.2 (22G100), cloudOS 26.1 (23B85)
• Preset: standard, Slim System off

Install log

  [+] /System/Library/Audio/Plug-Ins/HAL/VPhoneVirtIOSound.driver
Error: Patch site not found: virtualaudio: no `retab` after the throw at 0x312d84
  [!] system-virtualaudio-cfw-speaker_route_throws, system-virtualaudio-cfw-mute_set_throw, system-virtualaudio-cfw-speaker_protection_gate, system-virtualaudio-cfw-volume_mode_precondition: patch step failed, left in its prior state: vphone-cli failed (1): Error: Patch site not found: virtualaudio: no `retab` after the throw at 0x312d84
  [+] graph_configurations.plist: speaker_alarm chainType 'clhs' -> 'dflt'
  ...
[!] 4 guest patch(es) failed and were left in their prior state: system-virtualaudio-cfw-mute_set_throw, system-virtualaudio-cfw-speaker_protection_gate, system-virtualaudio-cfw-speaker_route_throws, system-virtualaudio-cfw-volume_mode_precondition

Behaviour in the guest

• Boot chime: plays through the Mac's speakers.
• Settings ▸ Sounds & Haptics ▸ Ringtone, tapping a tone: silent.
• audiomxd crash reports in Analytics Data: <none / N reports>

audiomxd doesn't crash; the route just stays silent. So this looks less like the "No default VAD present" throw and more like the RingtonePreview ('crnp') route being declined in RoutingHandler_Playback_GenericConfig1. That's what the speaker-protection gate and volume-mode precondition patches handle, and they aren't applied here.

What I could see in the code (at 23095c8)

• speaker_route_throws finds "No default VAD present" and its constructor. Then locateEpilogue scans forward for a retab inside the walker and finds none. The 18.6.2 walker seems to lay out its epilogue differently from the iPadOS 26.6.2 / iOS 27.0 builds the patch was verified against.
• All four sub-patches run on one staged copy of VirtualAudio. The first one failing drops the other three too, even if their sites exist on 18.6.2.
• Unlike many other guest patches, these four have no applicability, so they are attempted on iOS 18 and fail on every install.

Questions

• Is guest audio meant to work on iOS 18?
  • If yes, the patches need anchors for the 18.x layout. I'm happy to test a fix on this guest.
  • If not, maybe declare them iOS 26+ so they are skipped instead of failing, and document that guest audio needs iOS 26 or later.
• Could a sub-patch that can't find its site be skipped, instead of dropping the whole group?