It seems that Apple is gradually uniting the iOS and macOS kernels over time, and with iOS 9 and OS X El Capitan the version numbers are nearer to each other then ever before. This is not surprising, considering that iOS introduced novel features (such as Kernel ASLR, the default freezer, and various security hardening features) which are first incorporated in it, and later made it to macOS. Over time, iOS and macOS have 'moved nearer' together OS X El Capitan's XNU was 3247.1.106~1 and iOS 9.1.2~3. In the beginning iOS had consistently maintained a fairly higher kernel version than the corresponding version of macOS. Task_wakeups_monitor_ustackshots_trigger_pct and isolate string between quotes, sorted uniquely: # perform a full disassembly, isolate decompiled lines (^ ) with PE_parse. The list of boot-args can be extracted from any kernel dump once the address of _PE_parse_boot_argn is determined (which is usually automatically).

Finding references (using IDA) reveals hundreds places in the code wherein arguments are parsed in modules, pertaining to Flash, HDMI, and AMFI.

Kexts use boot-args as well, as can be seen when disassembly by calls to PE_parse_boot_argn (usually exported, _PE_parse_boot_argn 8027A8EC on the iOS 6.1.3 kernel, discovered by Haifisch). The arguments of the kernel are largely the same as those of macOS. Arguments may be directed at the kernel proper, or any one of the many KExts (discussed below). Like its macOS counterpart, iOS's XNU accepts command line arguments (though the actual passing of arguments is done by iBoot, which as of late refuses to do so). IRQ and FIQ handlers will also have their own execution stack which is specified by _irqstack. The bootstrap thread has its own specific static kernel stack, which is specified by _intstack. The kernel maintains thread specific stacks by calling kernel_memory_allocate, this allocates stacks in the specified kalloc zone.

On production and development devices, the kernel is always stored as a statically linked cache stored at /System/Library/Caches//kernelcache that is decompressed and run on startup. This makes exploitation harder as the location of kernel code cannot be known. As of iOS 6, the kernel is subject to ASLR, much akin to Mountain Lion (OS X 10.8).

Mac os 10.12 wiki