fix: IOKit service lifetime during KIS retries

KIS discovery reused one retained reference across multiple open attempts.
A retry could therefore release an invalid Mach port and cause macOS
to terminate the process with EXC_GUARD.

Retain the service separately for each open attempt while preserving
the callback's iterator-owned reference.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/libirecovery.c b/src/libirecovery.c
index ca96181..681b641 100644
--- a/src/libirecovery.c
+++ b/src/libirecovery.c
@@ -2705,9 +2705,9 @@ static void* _irecv_handle_device_add(void *userdata)
 	}
 
 	if (product_id == KIS_PRODUCT_ID) {
-		IOObjectRetain(device);
 		int i = 0;
 		for (i = 0; i < 10; i++) {
+			IOObjectRetain(device);
 			error = iokit_usb_open_service(&client, device);
 			if (error == IRECV_E_SUCCESS) {
 				break;