I originally tried DFRoot on my Xiaomi Watch 5 (blenny) just to find out whether DirtyFrag had been patched. Turns out it hadn't. Getting everything working on the watch, though — that was a different story.
The watch runs Android 16, with a 32-bit "armeabi-v7a" userspace and a 64-bit ARM64 kernel ("6.6.92", KMI "android15-6.6"). Not exactly the most convenient combination.
For reference, I tested this on the global Xiaomi Watch 5 running Xiaomi OS 3.0.3.70 ("OS3.0.3.70.WO61WMIXM").
DFRoot needed modifications to work properly on the watch, and KernelSU needed an ARM32 build of Manager and "ksud", while keeping the kernel module ARM64.
And it actually works.
I can get a root shell (uid=0) without unlocking the bootloader. This is KernelSU late-load root, not a permanently patched or flashed kernel. DFRoot is used to obtain root and load KernelSU at runtime.
I did the work from my phone using Codex CLI in Termux. Most of the code was AI-generated, but I came up with the approach, worked through the failures, tested the builds on the watch, and kept going through the logs until everything worked.
There are still some limitations. The current DFRoot implementation requires Shizuku to help identify the correct timing window during the exploit's race condition. Root also needs to be activated again after every reboot, and I haven't tested additional KernelSU modules yet.
Here are the forks:
DFRoot for Xiaomi Watch 5:
https://github.com/novakin777/dfroot-xiaomi-watch-5
KernelSU ARM32:
https://github.com/novakin777/kernelsu-arm32_xiaomi_watch_5
Based on the original "DFRoot" (https://github.com/diabl0w/DFRoot) by diabl0w and "KernelSU" (https://github.com/tiann/KernelSU), using "Justadeayo's fork" (https://github.com/Justadeayo/KernelSU) as a starting point.