OTA install fails with "helper: keys may not be consistent: KeyMismatch" ~1 min after DNS/HTTPS spoof server arms (reproducible with fresh helper process)

[abelomt]

Environment

• Device: Xteink X4 (USB-locked)
• Unlocker version: 0.2.32 (macOS)
• macOS version: Tahoe 26.6
• Firmware on device: stock XTOS V5.1.3
• Purchased from: third-party reseller (not xteink.com direct)

Summary

The OTA Unlocker consistently fails with helper: keys may not be consistent: KeyMismatch roughly 40–100 seconds after the DNS/HTTPS spoof server successfully arms (DNS server bound, tls cert loaded), and rolls back all network changes. This happens even with a completely fresh helper process (confirmed via a new helper listening timestamp after a full reboot, killing any leftover unlocker-helper process, and removing the crash-recovery state file), so it does not appear to be caused by a stale/leftover helper from a previous session.

Steps to Reproduce

1. Launch Unlocker, select CrossPoint v1.5.0, choose "OTA Flash".
2. Follow the in-app instructions to manually enable Internet Sharing (System Settings → General → Sharing → Internet Sharing, sharing from "Xteink Unlocker", Wi-Fi checked, WPA2/WPA3 Personal, 8-char password).
3. Turn on Internet Sharing, confirm "Start" when macOS prompts.
4. Connect the X4 to the resulting "crosspoint" Wi-Fi network.
5. Click "I've started Internet Sharing" in Unlocker to resume.
6. The helper detects the bridge and arms the DNS/HTTPS spoof server successfully (log: DNS server bound, tls cert loaded).
7. Within roughly 40–100 seconds, the app reports "Install failed" with the error below, and the helper rolls back all network changes.

Expected Behavior

The X4 should reach "Check for updates", download the spoofed CrossPoint manifest/firmware, and install it via OTA.

Actual Behavior

App shows:

SOMETHING WENT WRONG
Install failed
Unlocker has rolled back any network changes on this Mac. Your device may have its own rollback path; see below.
What happened: helper: keys may not be consistent: KeyMismatch

On the X4 side (first attempt, before rollback): Network Fluctuation: -1 Network Error.

Additional Observations

• Reproduced across 3 separate full attempts, including after: pkill -f unlocker-helper, removing /var/db/com.sofriendly.crosspoint.unlocker.helper.state.json, and a full reboot — ruling out stale helper/state as the cause.
• Log timestamps confirm each session used a genuinely fresh helper process (helper listening at a new time each session — 2026-08-08T23:13:48Z vs 2026-08-08T23:46:57Z).
• The DNS spoof host list correctly includes api-prod.xteink.cn (not just .cc), so this does not appear to be the Chinese-domain spoofing issue from #2193.
• Failure timing is consistent: rollback happens ~40s–1min40s after DNS server bound is logged, suggesting a timing/race condition around whatever step re-validates the helper's key after the app's "restart & resume" flow.
• Device was purchased from a third-party reseller (not xteink.com direct), consistent with other reports of USB-locked units from non-direct channels.

Logs

Session 1 (2026-08-08, ~23:13–23:37 UTC)

2026-08-08T23:13:48.369221Z INFO unlocker_helper: helper listening version="0.2.32" endpoint=/var/run/com.sofriendly.crosspoint.unlocker.helper.sock
2026-08-08T23:18:16.337583Z INFO unlocker_helper::ops::macos: stopping existing NetworkSharing
2026-08-08T23:18:17.542946Z WARN unlocker_helper::ops::macos: createnetworkservice failed, may already exist e=networksetup ["-createnetworkservice", "Xteink Unlocker", "lo0"] failed (exit status: 4):
2026-08-08T23:18:17.614112Z INFO unlocker_helper::ops::macos: adhoc upstream service ready on lo0
2026-08-08T23:18:17.678136Z INFO unlocker_helper::ops::macos: disconnecting Wi-Fi from current network wifi=en0
2026-08-08T23:18:20.275969Z INFO unlocker_helper::ops::macos: writing NAT plist with lo0 upstream ssid=crosspoint wifi=en0
2026-08-08T23:18:20.281241Z INFO unlocker_helper::ops::macos: Internet Sharing configured — user must enable in System Settings ssid=crosspoint
2026-08-08T23:25:01.452837Z INFO unlocker_helper::ops::macos: pfctl rules loaded via internet-sharing anchor from_port=53 to_port=10053 bridge=192.168.2.1
2026-08-08T23:25:01.454096Z INFO unlocker_core::dns: DNS server bound addr=192.168.2.1:10053 hosts=["api-prod.xteink.cn", "api.github.com", "unlocker.crosspointreader.com", "franssjz.github.io"]
2026-08-08T23:25:01.458022Z INFO unlocker_core::http: tls cert loaded subject=CN=unlocker.crosspointreader.com sans=["DNSName("unlocker.crosspointreader.com")"] not_before=Aug 4 01:47:52 2026 +00:00 not_after=Nov 2 01:47:51 2026 +00:00
2026-08-08T23:26:50.342470Z INFO unlocker_helper::ops::macos: pfctl rules flushed
2026-08-08T23:26:50.433734Z INFO unlocker_helper::ops::macos: purged orphaned Xteink Unlocker entries from preferences.plist count=1
2026-08-08T23:26:50.447951Z INFO unlocker_helper::ops::macos: removed adhoc upstream service
2026-08-08T23:26:50.448880Z INFO unlocker_helper::ops::macos: Internet Sharing disabled
2026-08-08T23:27:01.091227Z INFO unlocker_helper::ops::macos: stopping existing NetworkSharing
2026-08-08T23:27:02.465515Z INFO unlocker_helper::ops::macos: adhoc upstream service ready on lo0
2026-08-08T23:27:02.560767Z INFO unlocker_helper::ops::macos: disconnecting Wi-Fi from current network wifi=en0
2026-08-08T23:27:04.985694Z INFO unlocker_helper::ops::macos: writing NAT plist with lo0 upstream ssid=crosspoint wifi=en0
2026-08-08T23:27:04.988787Z INFO unlocker_helper::ops::macos: Internet Sharing configured — user must enable in System Settings ssid=crosspoint
2026-08-08T23:27:11.872181Z INFO unlocker_helper::ops::macos: stopping existing NetworkSharing
2026-08-08T23:27:13.027641Z WARN unlocker_helper::ops::macos: createnetworkservice failed, may already exist e=networksetup ["-createnetworkservice", "Xteink Unlocker", "lo0"] failed (exit status: 4):
2026-08-08T23:27:13.109054Z INFO unlocker_helper::ops::macos: adhoc upstream service ready on lo0
2026-08-08T23:27:13.180174Z INFO unlocker_helper::ops::macos: disconnecting Wi-Fi from current network wifi=en0
2026-08-08T23:27:15.849177Z INFO unlocker_helper::ops::macos: writing NAT plist with lo0 upstream ssid=crosspoint wifi=en0
2026-08-08T23:27:15.853023Z INFO unlocker_helper::ops::macos: Internet Sharing configured — user must enable in System Settings ssid=crosspoint
2026-08-08T23:37:38.428221Z INFO unlocker_helper::ops::macos: stopping existing NetworkSharing
2026-08-08T23:37:39.594371Z WARN unlocker_helper::ops::macos: createnetworkservice failed, may already exist e=networksetup ["-createnetworkservice", "Xteink Unlocker", "lo0"] failed (exit status: 4):
2026-08-08T23:37:39.635152Z INFO unlocker_helper::ops::macos: adhoc upstream service ready on lo0
2026-08-08T23:37:39.698897Z INFO unlocker_helper::ops::macos: disconnecting Wi-Fi from current network wifi=en0
2026-08-08T23:37:42.268301Z INFO unlocker_helper::ops::macos: writing NAT plist with lo0 upstream ssid=crosspoint wifi=en0
2026-08-08T23:37:42.272090Z INFO unlocker_helper::ops::macos: Internet Sharing configured — user must enable in System Settings ssid=crosspoint

Session 2 (2026-08-08, ~23:46–23:49 UTC, fresh helper after reboot + pkill + state file removal)

2026-08-08T23:46:57.802307Z INFO unlocker_helper: helper listening version="0.2.32" endpoint=/var/run/com.sofriendly.crosspoint.unlocker.helper.sock
2026-08-08T23:47:33.291813Z INFO unlocker_helper::ops::macos: stopping existing NetworkSharing
2026-08-08T23:47:34.464836Z WARN unlocker_helper::ops::macos: createnetworkservice failed, may already exist e=networksetup ["-createnetworkservice", "Xteink Unlocker", "lo0"] failed (exit status: 4):
2026-08-08T23:47:34.520339Z INFO unlocker_helper::ops::macos: adhoc upstream service ready on lo0
2026-08-08T23:47:34.586291Z INFO unlocker_helper::ops::macos: disconnecting Wi-Fi from current network wifi=en0
2026-08-08T23:47:37.203845Z INFO unlocker_helper::ops::macos: writing NAT plist with lo0 upstream ssid=crosspoint wifi=en0
2026-08-08T23:47:37.207083Z INFO unlocker_helper::ops::macos: Internet Sharing configured — user must enable in System Settings ssid=crosspoint
2026-08-08T23:48:20.385334Z INFO unlocker_helper::ops::macos: pfctl rules loaded via internet-sharing anchor from_port=53 to_port=10053 bridge=192.168.2.1
2026-08-08T23:48:20.386506Z INFO unlocker_core::dns: DNS server bound addr=192.168.2.1:10053 hosts=["api-prod.xteink.cn", "api.github.com", "unlocker.crosspointreader.com", "franssjz.github.io"]
2026-08-08T23:48:20.393289Z INFO unlocker_core::http: tls cert loaded subject=CN=unlocker.crosspointreader.com sans=["DNSName("unlocker.crosspointreader.com")"] not_before=Aug 4 01:47:52 2026 +00:00 not_after=Nov 2 01:47:51 2026 +00:00
2026-08-08T23:49:19.095375Z INFO unlocker_helper::ops::macos: pfctl rules flushed
2026-08-08T23:49:19.174620Z INFO unlocker_helper::ops::macos: purged orphaned Xteink Unlocker entries from preferences.plist count=1
2026-08-08T23:49:19.187831Z INFO unlocker_helper::ops::macos: removed adhoc upstream service
2026-08-08T23:49:19.188864Z INFO unlocker_helper::ops::macos: Internet Sharing disabled
2026-08-08T23:49:26.377395Z INFO unlocker_helper::ops::macos: stopping existing NetworkSharing
2026-08-08T23:49:27.800797Z INFO unlocker_helper::ops::macos: adhoc upstream service ready on lo0
2026-08-08T23:49:27.882211Z INFO unlocker_helper::ops::macos: disconnecting Wi-Fi from current network wifi=en0
2026-08-08T23:49:30.301077Z INFO unlocker_helper::ops::macos: writing NAT plist with lo0 upstream ssid=crosspoint wifi=en0
2026-08-08T23:49:30.304255Z INFO unlocker_helper::ops::macos: Internet Sharing configured — user must enable in System Settings ssid=crosspoint

[itsthisjustin]

You should be able to just sd flash the escape hatch and skip all this for one thing. However, I will fix this shortly. I released the updated key for windows but failed to on mac