Unprivileged to root on macOS 26.5, no entitlements, Developer Mode off, through one unbounded loop in the dyld shared-cache slide walker. Fixed in macOS 26.5.2.