system_server: LSPlant init fails (mmap dual mapping EACCES) — module handleLoadPackage never runs there

Environment

• Device: moto g54 5G (MTK Dimensity 6020), Android 15, stock-ish ROM
• Root: Magisk 30.7 + Zygisk, SELinux Enforcing
• Vector v2.2 (3110-c4a701aa)

Symptom
The framework injects into system_server and logs Loading Vector/Xposed for system (UID: 1000), but immediately after:

E/LSPlant: mmap dual mapping failed with 13: Permission denied
I/VectorNative: Injected Vector framework into system_server.

After this, module handleLoadPackage is never invoked for the system_server process (zero module logs from the system_server pid), while injection into regular apps works perfectly on the same device and boot.

Diagnosis attempts

• Kernel audit is functional (other unrelated avc denials from system_server are logged at boot), but no avc denial corresponds to the LSPlant mmap failure — so this appears to be something other than a SELinux policy denial (memfd/seccomp/kernel restriction on system_server?).
• Applying allow system_server system_server process execmem via magiskpolicy (live + module sepolicy.rule) and rebooting has no effect — same error.
• dmesg -n 8 + reboot also produced no avc line for this operation.

Expected
Either system_server module loading works (module entry point invoked), or the failure mode is documented with the required kernel/SELinux prerequisites.

Question
Is system_server module loading supported on this combination, and if so what kernel/SELinux prerequisites does the LSPlant dual mapping need there? Happy to test canary builds or provide more logs.

Start with the system_server injection path and the LSPlant dual-mapping failure reported as EACCES. Reproduce on the stated Android 15 and Magisk/Zygisk setup, then compare system_server behavior with regular app injection while collecting relevant logs. Done means either module loading works in system_server or the required kernel and SELinux prerequisites are documented.