Patch iBoot for iOS 15.5

[Lynnette177]

I'm new to iOS jailbreak so I'm still learning. I want to try to run patched iboot and patched kernelcache on iOS15.5, with dopamine(without using kfd or dma fail, only for jb environment initialize) in userspace, to achieve jailbreak.
I decrypted iBEC from IPSW. However, the patcher didn't find any CTRR lockdown instructions. As I checked, there are indeed no MSR instruction related to CTRR. So I'm wondering that if CTRR is not enabled on iOS 15.5.
In my opinion, I can patch iBec(which is another version of iBoot I think), to turn off CTRR etc then load patched kernelcache from USB to provide kernel RW to userspace? Then I do not need KFD or PPL bypass anymore to R/W memory.
Please point out if I'm wrong. I really appreciate your help.

(base) >python iboot_patcher.py iBEC.d79.RELEASE.raw iBECout.raw --mode ibec
=== iBoot Patcher (mode=ibec, base=0x870000000) ===
Input size: 2133688 bytes
Version: iBoot for d79, Copyright 2007-2022, Apple Inc.

[*] Patching image4_validate_property_callback...
  0x004764 (VA 0x870004764): NOP b.ne (image4 canary → stack_chk_fail)
  0x004768 (VA 0x870004768): MOV X0, #0 (force image4 callback success)

[*] Patching boot-args...
  0x0B0C40 (VA 0x8700B0C40): Write boot-args string at 0xB0C40
  [!] No ADRP+ADD refs to '%s' found

[*] Patching CTRR lockdown...
  [!] No CTRR lock/ctl MSR instructions found

[*] Looking for signature verification anchors...
  Found 'ticket.der' @ 0xEE0FE
  Found 'image4_callbacks' @ 0xEF748