RedMagic 8S Pro (NX729J) — LineageOS Porting Research

Status: Abandoned. Two attempts (LOS23 → LOS21) did not reach a successful LineageOS boot. Device was returned to stock 9.5.3.

Reverse engineering and porting attempts for LineageOS on the Nubia RedMagic 8S Pro (NX729J, Snapdragon 8 Gen 2).

Timeline

1. Phase 1 — LineageOS 23 (Android 16, Baklava) — failed. Kernel-userspace mismatch: stock SM8550 blobs are Android 14 native and incompatible with Android 16 userspace/HALs. Also hit Soong fsgen validation errors and EROFS/kernel mount failures.
2. Phase 2 — Pivot to LineageOS 21 (Android 14) — abandoned before successful boot. Device tree configured, vendor tree built, but not flashed to a working state.
3. Current baseline — stable ADB-rootable rooted stock 9.5.3. All build scripts, dumps, and device tree preserved here.

Key Findings

Read these before attempting this yourself — they cost weeks to discover.

• AVB / Bootloader: Nubia ABL rejects boot images with non-null os_version. Must inject --os_version 0.0.0 --os_patch_level 2000-01 into mkbootimg args.
• EROFS does not work: Nubia kernel 5.15.167 (stock) cannot mount EROFS images built by AOSP 13+. Use EXT4 for all logical partitions.
• Hardware watchdog: The kernel watchdog (zte_set_timer) triggers a hard reset if haptic_ram.bin or fan_led_on.bin are missing at early mount. These must be present in the vendor ramdisk.
• Red Core 2 co-processor: 15.3 MB kernel module (kiwi_v2.ko), tightly coupled with cnss2 (Wi-Fi driver). Cannot be skipped.
• Fan hardware: custom Nubia driver (compatible = "soc,fan"), PWM via PMIC GPIO 9, tachometer on TLMM GPIO 174. Not a discrete MAX31760 controller — ignore claims stating otherwise.
• Blob count: 7,077 proprietary files required. Trees using ~300 blobs will fail ZTE security services systematically.
• Android version parity matters: Stock 9.5.3 blobs are Android 14 native. Targeting Android 16 causes kernel-userspace impedance mismatch. Target LineageOS 21, not 23.
• Soong fsgen (Android 16): validates logical partition structure strictly. All-in blob copying fails with Path is outside directory — must prune cross-partition symlinks and redundant DLKM metadata.

Repository Contents

Path	Description
TECHNICAL_REPORT.md	Full technical report — findings, methodology, timeline
DEEP_ANALYSIS.md	Background research document. See disclaimer at top — contains unverified/inaccurate claims
device_tree_pure/nubia/NX729J/	LineageOS 21 device tree (EXT4, EXT4 vbmeta)
device/nubia/NX729J/kernel-headers/	Kernel headers
scripts/01_initial_recon.sh	ADB-based device recon
scripts/02_redcore_fan.sh	Red Core 2 and fan-control sysfs scan
scripts/03_extract_payload.py	OTA payload.bin extractor
scripts/04_analyze_boot.sh	vendor_boot / init_boot analysis
scripts/los23_flash.sh	Phase 1 flash script (LOS23 — historical, abandoned)
scripts/los23_build_thermal.sh	Phase 1 build script with thermal watchdog (LOS23 — historical)
scripts/setup_vendor_los21.sh	Phase 2 vendor tree setup for LOS21
adb_dumps/	Live device info dumps (kernel, partitions, build ID)
stock_live_fdt.dts	Decompiled live Device Tree Blob from stock 9.5.3

Device Specs

Codename	NX729J
SoC	Snapdragon 8 Gen 2 (SM8550) @ 3.36 GHz
Kernel	5.15.167 (Nubia stock)
Stock firmware	RedMagicOS 10.x / Android 14 (build 9.5.3)
Boot slots	A/B
Stock FS	EROFS (incompatible with AOSP 13+ EROFS)

If You Pick This Up

• Target LineageOS 21 (Android 14), not 23+. Blob parity is non-negotiable on this device.
• Use EXT4 everywhere in your device tree.
• Keep haptic_ram.bin and fan_led_on.bin in the vendor ramdisk or the watchdog will reset the device.
• Start from the device tree in device_tree_pure/ — it already encodes the above decisions.
• See TECHNICAL_REPORT.md for the full methodology.