For the kernel driver it's literally just: run the hypervisor, wait for the kick, save the UAT state, replay the whole thing, make sure the output pages change, then just follow the pointer to initdata until you've built the whole tree from scratch. LLM handles the rest.
Thanks for the post and answering here, but for someone to follow in your steps there really need to be more information: how did you handle physical hardware? Did it got stuck / frozen / whatever? How did you managed reset / etc? What is your actual step-by-step process other then just telling codex / claude code "do X"? What else had to be solved along the way?
I just think one good part of Marcan's work is that they streamed a lot of their workflow with all kind of problems occured along the way and you could see how to solve them.
And please so not let anti-llm crowd discourage you. People like me who want to use good hardware and already choose to pay for Apple one just need drivers that work good and feature complete - code purity and "quality" is secondary.