Firmware-Update Observability in a Single-Earbud AirPods 4 ANC Configuration: A macOS UARP Case Study of Asset Discovery, Update Initiation, Device-State Verification, and Bounded Direct-Transport Diagnostics
Year: 2026
Type: preprint
Abstract: Observational single-device case study of an AirPods 4 ANC left A3056 earbud (Bluetooth product ID 0x201B) that continued to report firmware 8B21 while Apple published 9A348 for its model family and macOS held the matching UARP asset in its local accessory-updater cache. The right earbud was lost. The study separates firmware-update evidence stages (published release, cached asset, updater endpoint registration, posted scan request, transfer/activation, connected verification) with a three-state observation vector, documents a bounded scan trial whose connected verification still showed 8B21, and reports 60 ANC host-state samples under three intervention conditions. A follow-on series of bounded direct-transport experiments (F-05 through F-13) verified device identity over GATT, confirmed the UARP service, and probed the L2CAP AAP control channel from discriminating host states. Most sessions were information-only. Three explicitly authorized sessions (F-08T/U/V) each transmitted one firmware asset-available offer referencing the cached 9A348 candidate; in each, the accessory reported running firmware 8.1.21.0 with a staged-version readback of 0.0.0.0 at query time, acknowledged the offer, and then produced client-decoded terminal processing notifications before any image-data request. In F-08U/V the raw flags 0x0003 admit more than one status interpretation in published sibling-hardware reverse-engineering notes. No firmware image bytes were served, and no staging or Apply command was sent. The status classification for F-08U/V, the cause of the terminal processing outcome, and any associated eligibility decision remain unresolved. The original direct-offer sessions were not repeated with a documented case reset, so stale-session state remains a competing explanation. The embedded firmware-image signature was not independently cryptographically verified. The missing companion earbud remains a testable dependency hypothesis; third-party analysis of a sibling product (Calvados, LibrePods issue #612) indicates case-mediated update completion requires both buds while host-driven staging does not, with an explicit hardware-boundary caveat. Package contains the preprint PDF, LaTeX source, de-identified public data (transport-trial outcomes, F-02 evidence with time-precision labels, ANC samples, sanitized UARP events), read-only reproducibility scripts, and checksums. No raw logs, serial numbers, Bluetooth addresses, or Apple firmware assets are included. The cover cutaway is AI-generated conceptual artwork, not an anatomical scan or a measurement of A3056 internals.
Author: Thor, Thor
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225591676