The device would be running in "open" mode with the hacked kernel, so the checksum failure is not a problem. The hacked kernel can do anything it wants, including "impersonation" of the locked down kernel to applications. How applications can determine whether or not they are running in the open or locked environment is anyone's guess now that the system is not deployed yet. Basically, I'm thinking of the use case where you have an app that wants to run in closed environment, but can be fooled to think it has such an environment when it in fact doesn't (so it would store drm keys to normal filesystem, etc...).

.

Yep, that's the only "target audience" you need to think of when designing a system like this ;-). We can imagine there will be people with custom hardware trying to hack this thing. Again, hacking doesn't seem to be "required" to use this phone normally (unlike w/ android and iPhoneOS), so I don't care either way.

SBox doesn't run the target kernel, which is the most important part in scheme like this, so attacks from this direction are probably ineffective.