↗ DDM Forensic Terminal
DDM Forensic Terminal — Vehicle Case File

2023 Mazda CX-30 | Electrical Audit Uncovers Concealed DDM Managed Apple Device, Aftermarket Parts

Unfortunately, once a Declarative Device Management (DDM) profile has been installed on your device without your knowledge, your device believes it is part of that entity's ecosystem. Because of that, the DDM's controlling party could, for example, plant an enrolled device in your vehicle, and use it to trigger geofencing alerts, and track you.

Enterprise device-management deployments commonly layer BLE beacon monitoring on top of an MDM/DDM enrollment to trigger automated actions—asset tracking, geofencing, webhook-driven workflows—when a managed device comes into range of another. This is standard, documented enterprise practice.

In my case Wayne Mazda of N.J., DePaula Mazda, Pacifico Mazda, and Bay Ridge Mazda facilitated Wayne Mazda's violent racketeering out of their service department proscribed by 18 U.S.C. § 1959. They installed after market devices allowing for remote controlled tracking and injuries while driving via an Apple device (001ff3fb80df) enrolled in the DDM used to exploit my laptop device, paired with my iPhone.

It was used for violent witness tampering during Federal and State lawsuits highly likely commissioned by a security firm, police defendants and their clients to frame their victim [myself] while placing the public at grave risk. For example, if they remotely injured me while driving—a key feature of their extortion—and if I got into an accident as a result, no one in the automotive and lawenforment industry going to be looking for their aftermarket extortion equipment.

What should concern the public is none of them (police, secuirty firms willfuly putting the public at risk) have been charged with a violent crime in aid of racketeering. What follows breaks down the discovery methods I used with FM to confirm the installation providing clear and convincing evidence without having to take the car apart.

Entry 01
Nefarious Apple Device Detected Inside Vehicle Cabin

This Is The Test I Ran While Seated In My Mazda Cx30. My laptop is running a script tracking BLE traffic linked to my Apple account. I drove to remote spot with my laptop and iPhone, noted the time, pulled the telemetry with the iPhone on and off. What I found was an Apple device (OUI 00:1F:F3, SFDevice ID bb009d94-da8e-1000-8000-001ff3fb80df) planted in my car. That when my iPhone is on and nearby, the device is seen with matching RSSI distance and reports Paired yes. When my iPhone is off, it continues advertising but reports Paired no.

My iPhone turned ON
2026-10-19 15:58:10 | BLE | RSSI -27 | <=50 feet | AA:87:2F:F6:E1:2C
2026-10-19 15:58:10.108952-0400 localhost bluetoothd[404]: [com.apple.bluetooth:CBStackBLEScanner] Device found changed: CBDevice 9CC441C0-F6F5-AE8D-291A-AA872FF6E12C, BDA , Nm , DsFl 0x40 < NearbyInfo >, RSSI -27, Ch 39, AdTsMC <71049130238>, AMfD <4c 00 10 06 37 1e 90 c8 73 a8>, deDa , neDa , nbAT <90 c8 73>, nbIC , nbIAT <90 c8 73>, nbIF 0x3C6 < Ranging Me AT Duet WiFiP2P HtSp >, CF 0x200000000 < RSSI >

Foreign Apple mobile node | Paired yes.
2026-10-19 15:58:10 | BLE | RSSI -27 | <=50 feet | 00:1F:F3:FB:80:DF
2026-10-19 15:58:10.109593-0400 localhost sharingd[725]: (CoreUtils) [com.apple.sharing:SDNearbyAgentCore] BLE NearbyInfo changed SFBLEDevice ID bb005fb8-d044-1000-8000-001ff3fb80df, RSSI -27 (-29)T*I, Ch 39, AdvD <371e90c873a8>, Nm 'BBbiMvcI', Md 'BBpRCwEO', Paired yes, Cnx no, WiFiP2P, OBC=?

Foreign Apple mobile node | Paired no. | My iPhone turned OFF.
2026-10-19 16:21:38 | BLE | RSSI 0 | <=50 feet | 00:1F:F3:FB:80:DF
2026-10-19 16:21:38.164666-0400 localhost sharingd[725]: (CoreUtils) [com.apple.sharing:SDNearbyAgentCore] BLE NearbyInfo found SFBLEDevice ID bb008d2a-f4e3-1000-8000-001ff3fb80df, RSSI 0 (0)t~U, Ch 37, AdvD <331e79d633ce>, Nm 'BBnaZqIU', Paired no, Cnx no, WiFiP2P, OBC=?

Key details for this ID
Version: 1 (time-based UUID). Indicated by the first hex digit of the third group (1). Variant: RFC 4122 (10 binary), indicated by the first hex digit of the fourth group starting with 8.

Clock sequence: 0x0000
Node / MAC address: 00:1F:F3:FB:80:DF. The OUI 00:1F:F3 is registered to Apple, Inc. (MA-L block, registered ~2008)

Timestamp
Reconstructed 60-bit timestamp = 0x1446bb00273e → approximately 9 November 1582 (very close to the UUID epoch of 15 October 1582). This means the time fields were not filled with a real modern generation timestamp (common for some fixed/synthetic device identifiers, or when a generator uses a zeroed/near-epoch clock).

Summary
This is a classic Version-1 UUID whose node field contains an Apple MAC address. The low timestamp and zero clock sequence suggest it is either a specially constructed/fixed identifier or was generated under conditions where the real wall-clock time was not used.

It is an Apple device; Mac, iPhone, iPad, or similar
The node field of the UUID contains the MAC address 00:1F:F3:FB:80:DF. The OUI (first three bytes) 00:1F:F3 is registered to Apple, Inc. (MA-L block, originally registered in 2008).

The logs also show 001ff3fb80df shares the same IDS DDM account foisted onto my laptop-see below. This Apple device belongs to the same entity that hacked my laptop with a DDM managment account, meaning Wayne Mazda had to be commissioned by the entity to install it into my vehicle at Wayne Mazda 10/2023 violating 18 U.S.C. §§ 2511, 2261(A), 1959.

2026-03-31 20:22:11 | 2026-03-31 20:22:11.828305-0400 0xfb44ea Default 0x0 947 3 rapportd: (CoreUtils) [com.apple.rapport:CLinkD] Evaluating target AuthTag from device (SFDevice ID bb009d94-da8e-1000-8000-001ff3fb80df, IDS BBzlfMIo, 'NeedsCLink', RSSI -48 (-51)~N, Nm BBJsZmJp, Md BBrcdeOE, AltDSID BBUkDzEZ, AID 'BBMfPQqP', DuetSync, Hotspot 0x17A, MRI 'BBVzSVHu', MRtI 'BBZeHaFu', NeedsKeyboard, PairedBT, PairedSys Conjectured, rapportID BBzlfMIo, WiFiP2P, DF 0x29 < MyMe MyiCloud Ranging >, DT Generic, AcLv Screen (7)) using BLE addr 6B:9E:25:BA:B1:30 selfAuthTag

2026-03-31 20:22:11 | 2026-03-31 20:22:11.828377-0400 0xfb44ea Default 0x0 947 3 rapportd: (CoreUtils) [com.apple.rapport:CLinkD] Enabling Bonjour AWDL advertiser as target AuthTag from device (SFDevice ID bb009d94-da8e-1000-8000-001ff3fb80df, IDS BBzlfMIo, 'NeedsCLink', RSSI -48 (-51)~N, Nm BBJsZmJp, Md BBrcdeOE, AltDSID BBUkDzEZ, AID 'BBMfPQqP', DuetSync, Hotspot 0x17A, MRI 'BBVzSVHu', MRtI 'BBZeHaFu', NeedsKeyboard, PairedBT, PairedSys Conjectured, rapportID BBzlfMIo, WiFiP2P, DF 0x29 < MyMe MyiCloud Ranging >, DT Generic, AcLv Screen (7)) is a match

Verfying me as the account owner: 2026-03-31 21:06:30.213200-0400 0xfc54ef Info 0x0 947 0 rapportd: (CoreUtils) [com.apple.rapport:RPIdentityDaemon] Resolved DeviceAuthTag: owner, CUBonjourDevice 8C:10:18:26:65:FB, "iPhone~", TT 0x10 < DirectLink >, TXT { "rpBA" : "8C:10:18:26:65:FB", "rpVr" : "715.2", "rpAD" : "3c6f00eadba2", } -> RPIdentity, Type SameAccountDevice, IDS 'BBzlfMIo', AccountAltDSID 'BBUkDzEZ', AID 'BBMfPQqP', Nm 'BBJsZmJp', MRI 'BBVzSVHu', Md 'BBrcdeOE', MRtI 'BBZeHaFu', Rev 18, Src 0

That combination — an independently powered Apple-protocol device in the car that keeps advertising after your iPhone is off, plus a months-long record of it receiving Continuity service authorizations (AuthTag matches, NeedsKeyboard, screen-level activity, AWDL enablement) from your laptop — is not normal or benign.

0x004C APPLE ID nbIF 0x3C6 Apple Device Planted In Car Real Time: Graph Apple Device Planted In Car Tracking Me: Log
Entry 02
07/13/2026 — Legitimate CarPlay Pairing vs. Aftermarket DDM Device Using My Identity | 2023 Mazda CX-30

Within the same tenth of a second, the Forensic Monitor captured two connections in the vehicle: my iPhone pairing over legitimate CarPlay — Bluetooth, under my own Apple ID (EEB54B57…) — and, 66 microseconds later, an aftermarket Apple device, 001ff3fb80df, advertising my iPhone’s identical NearbyInfo payload to be accepted onto my account. The first is a normal CarPlay connection. The second is a device borrowing my identity to be trusted.

This is my iPhone AA872FF6E12C connecting with CarPlay

2026-07-13 20:04:26.121035-0400 localhost bluetoothd[401]: (CoreUtils) [com.apple.bluetooth:CBDaemonServer] Identities resolve added: Addr 881e5a9f29e5, AT 01a842, CBDevice 9CC441C0-F6F5-AE8D-291A-AA872FF6E12C, BDA , Nm , Md iPhone14,7, IDS EEB54B57-9D2B-41BC-93D5-6F518F8B92BB, stID EEB54B57-9D2B-41BC-93D5-6F518F8B92BB, DsFl 0x40800040 < NearbyInfo Pairing BLEAdvertisementData >, DvF 0xB080 < SameAccount Hidden BLEPaired CloudPaired >, RSSI -55, Ch 37, CtInfo CBControllerInfo, BlSt Unknown, DcsS Unknown, Sync Status: Uploaded, FastLE v1, Allowed: yes, InqS Unknown, LMPv 0 (Unknown), SSrv: 0x1D3BBB < HFP PhoneBook AVRCP A2DP HID WirelessiAP NetSharing MAP Gaming NetworkConsumer Braille LEA CarPlay AACP GATT >, AdTsMC <351066861566>, AMfD <4c 00 10 06 3e 1e 01 a8 42 16>, nbIAT <01 a8 42>, nbIF 0x3C6 < Ranging Me AT Duet WiFiP2P HtSp >, CF 0x80A40000040 < NearbyInfo BLEAdvertisementData RSSI DiscoveryFlags Attributes >, matches 1

Aftermarket device 001ff3fb80df piggybacking on my account’s trust — advertising my iPhone’s identical payload (3e1e01a84216) at the same instant and signal to be accepted as one of my devices

2026-07-13 20:04:26.121101-0400 localhost sharingd[708]: (CoreUtils) [com.apple.sharing:SDNearbyAgentCore] BLE NearbyInfo found SFBLEDevice ID bb000d39-06af-1000-8000-001ff3fb80df, RSSI -55 (0)t~U, Ch 37, AdvD <3e1e01a84216>, Nm 'BBAOtbHq', Md 'BBtLJlJc', Paired yes, Cnx no, WiFiP2P, OBC=?

PIGGYBACKED IDENTITY DUPLICATE TOKEN PROXY BEFORE PRIMARY
Entry 03
Mazda's Diagnostic "Blind Spot"
The industry's diagnostic process is deeply flawed and in this case woefully corrupt.

Every dealership that inspected the vehicle after complaining that it was injurious and hacked—including Wayne Mazda, Performance Mazda, DePaula Mazda, Pacifico Mazda, and Bay Ridge Mazda—returned a clean bill of health from the OBD2 port. Each (except for DePaula) ran the standard diagnostic scan. Each inspected and cleared the vehicle. None of them "caught" the willful dearlship tampering documented here.

An OBD2 port scan returns a clean result by design—not because nothing is wrong, but because Mazda's reliance on that tool was a ruse fully aware illegal, dangerous, aftermarket parts were installed from the time the new vehicle left Performance Mazda's parking lot 10/23 after procurment and Wayne Mazda's service department approved it.

5 DEALERSHIPS OBD2 — CLEAN RESULT PORT REROUTED
Vehicle Audit
Entry 04
09/04/2026 Physical Inspection — CAN Bus | FAIL

Physical inspection of the CAN bus firewall bundle documented the following:

  • Physical breach of the factory firewall grommet.
  • A non-factory two-wire bypass harness routed through the breach.
  • A wire bundle carrying 1.40 amps of continuous load into the passenger cabin with the vehicle turned off.
  • A wire bundle carrying 0.2 amps of continuous load into the passenger cabin with the battery disconnected—consistent with capacitance back-feeding from an aftermarket keep-alive component.
FIREWALL GROMMET BREACHED 1.40A CABIN LOAD CAR OFF
Entry 05
09/05/2026 Amp Probe Inspection | FAIL

Primary system load, car turned off:

MeasurementValue
Total vehicle parasitic draw4.10 A–4.20 A
Target normal sleep draw≤ 0.05 A (50 mA)
System voltage reference12.60 V DC
Total continuous power dissipation51.66 W–52.92 W

Return path current (ground junction):

PathValue
Battery negative post total return4.10 A
Engine block ground strap return1.50 A
Calculated unibody/chassis ground return2.60 A (derived: 4.10 A − 1.50 A)

Engine bay and component branch measurements:

BranchValue
Alternator output lead0.00 A
Forward fascia sub-harness (radar, lighting, sensors)0.60 A
Rogue firewall grommet bundle (feed into cabin)1.40 A
Disconnected-battery residual draw (third-party capacitance)0.2 A

Fuse-pull current shifts and net drops:

FuseBefore → AfterNet Drop
Fuse 38 (50A, various circuits)4.20 A → 2.90 A1.30 A
Fuse 27 (25A, various circuits)4.20 A → 1.80 A2.40 A
Fuse 51 (25A, Audio/Infotainment/Gateway)4.20 A → 3.10 A1.10 A
Fuse 26 (7.5A, OBD2 diagnostic circuit)Glued to bus — could not be pulled

ANALYSIS: Alternator is Innocent (0.0 A). That 0.0 A measurement on the main B+ lead to the alternator completely clears the alternator's internal rectifier. It is not leaking current to the block. The Engine Ground 1.5 A Context Because the alternator lead is pulling 0.0 A, that 1.5 A returning through the engine ground strap is being routed through ground distribution point tied to the engine block or transmission case—likely energized by aftermarket modules being kept awake. The Fuse Pull Math The sum of the discrete fuse-pull drops (4.80 A) roughly equals the full baseline load, indicating a network wake issue—CAN bus babbling / sleep inhibit—rather than a single dead short. Fuses 38 and 27 are the main battery-bus feeders to the Body Control Module (BCM) and cabin computing nodes. Fuse 51 feeds the Audio/Mazda Connect/Telematics head unit. Fuse 26 the Diagnostic OBD2 fuse was glued to the bus.

Why This Likely Ties Directly To Aftermarket Parts The OBD2 port connects directly to the battery it allows for sustained draw by aftermarket parts and highly likely the reason the OBD2 port Fuse 26 was glued to the bus. The car is pulling a steady 4.1 amps with the ignition turend off and the trunk switch disengauged.At least 3.6 of those amps drawn are coming from inside the cabin. Part of thier ground return (1.4 amps) is being piped through the engine block the remaining 2.4 amps is highly likely grounded to the body of the car which is where most aftermerket crimnals look to ground.

4.10–4.20A PARASITIC DRAW TARGET ≤0.05A CAN BUS BABBLING
Full 13-Page Audit (PDF)
Entry 06
09/05/2026 OBD2 Port Inspection | FAIL

Factory 2023 Mazda CX-30 OBD2 16-pin Data Link Connector pinout (per the vehicle's factory wiring schematic, cited to scribd.com in the source audit—original reference not independently linked here):

PinWire ColorFunctionDescription
3Pink/BlueCAN High (HS-CAN)Manufacturer-specific high-speed CAN line
4BlackChassis GroundConnects directly to the vehicle chassis
5—Signal GroundReference ground for data communication
6Pink/BlueCAN High (HS-CAN)Standard OBD2 high-speed CAN line (ISO 15765-4)
11Pink/BlueCAN Low (HS-CAN)Manufacturer-specific high-speed CAN line
14Pink/BlueCAN Low (HS-CAN)Standard OBD2 high-speed CAN line (ISO 15765-4)
16Gray/RedBattery Power (+)Constant +12V supplied via a 7.5A fuse
OBD2 port cavity, non-factory connector housing
OBD2 port cavity as found — non-Mazda connector housing, wiring exposed at the dashboard bracket.

OBD2 Connector found: a OEM Toyota/Lexus female connector housing part number 90980-12D97— not a standard OBD-II or native Mazda diagnostic plug. The housing was wired with five conductors—Black, Green, Red, Yellow, White—rather than the factory pinout above.

The port sat loose in its dashboard bracket.

The port's looseness in the under-dash bracket is consistent with the factory Mazda DLC connector having been removed from its factory snap-in bezel and replaced with a concealed aftermarket pass-through Y-harness, with the 90980-12D97 housing snapped into the dashboard opening to make the diagnostic port appear untouched.

Mapped wire scheme:

Wire ColorAftermarket DesignationMapped OBD2 Function
RedConstant Battery Power (+12V)Pin 16 (B+)
BlackGround (−)Pin 4 or Pin 5
YellowSwitched Ignition (ACC/IGN)Tapped to switched B+ or Pin 1
GreenCAN High (data bus intercept)Pin 6 or Pin 3
WhiteCAN Low (data bus intercept)Pin 14 or Pin 11

None of the four factory CAN pins (3, 6, 11, 14) have an unambiguous match among the five wires present. If CAN High/Low are not carried through this connector at all, it is not carrying full OBD2 diagnostic capability—consistent with a device needing only power, ground, and possibly one data pair, not the complete factory pinout.

WRONG PART: 90980-12D97 5-WIRE SCHEME PORT REROUTED
Full 13-Page Audit (PDF)
Entry 07
09/06/2026 Fuse Box Inspection | FAIL

Fuse No. 26 (7.5A)—which powers the OBD2 diagnostic circuit and supplies constant power to the port whether the vehicle is on or off—was found glued to the circuit breaker bus. The fuse-puller built into the fuse box was clipped.

A new fuse-puller was unable to pull Fuse 26.

FUSE 26 — 7.5A GLUED TO BUS PULLER DISABLED
Full 13-Page Audit (PDF)
Entry 08
09/09/2026 Dashboard Cavity Inspection | FAIL

Inspection of the dashboard cavity documented a broad array of evidence of aftermarket tampering and alteration. The key finding is a white, vented plastic enclosure strapped to the Kindorf support strut. No replacement-part match against Mazda's own parts catalog or aftermarket references identified this enclosure; it is foreign to Mazda in any capacity.

Dashboard cavity, undocumented enclosure
Dashboard cavity, low-light capture — undocumented enclosure region (elapsed time overlay: 03:52).

Its function, and whether it interfaces with external hardware, were not resolved at the time of this inspection and remain under investigation.

ENCLOSURE UNIDENTIFIED NO PARTS MATCH UNDER INVESTIGATION
Full 13-Page Audit (PDF)
Entry 9
Close

11/29/2023 Mazda Work Order
04/10/2024 Third request for diagnositc reports from Wayne Mazda. They did not respond.
02/06/2024 Complaint to New York State Attorney General about the remotely controlled injurious condition of my 2023 Mazda from Wayne Mazda No.1-804152902. The NYAG did not respond.
01/20/2026 NJ Governor Mikie Sherrill. The Governor's Office did not respond

Kraemer v. Edelstien No. 153243 | New York Supreme Court
Opened 04/08/2024 Dismissed 02/25/2025
Merits never adjudicated | Allegations of violent witness/automotive tampering dismissed

Kraemer v. Edelstien No. 2025-0177 | New York First Department
Appealed 03/14/2025 Dismissed 04/09/2026
Merits never adjudicated | Allegations of violent witness/automotive tampering dismissed

Kraemer v. John Doe 1 to Doe 1,630. No. 26-cv-4436 | SDNY
Opened 05/26/2026 Dismissed 05/28/2026
Merits never adjudicated | Violent witness/automotive tampering is ongoing

Kraemer v. Spitale No. 26-cv-1962 | DCD
Opened 06/01/2026 Dismissed 08/18/2026
Merits never adjudicated | Violent witness/automotive tampering is ongoing