Poking into iOS 9 is fun. A little annoyed at some new things. But very surprised at how similar it is to iOS 8 internally.
Worth noting, iOS 9+ arm64 iDevices now enforce a checksum on __TEXT/DATA.const regions of the kernel through the use of TrustZone. Modifying said sections will cause the device to panic (either at kernel or EL3 will force a reboot if the kernel refused to gracefully panic). Essentially, it's KPP (Kernel Patch Protection). You can race it though if you want to play with things. Just be quick! ;P
Also, there should technically now be two additional partitions (baseband_data [s1s3] and logs [s1s4]) but didn't really bother with those as they weren't critical.
Shouts to @coolstarorg for getting Anemone working on iOS 9 for this. Shouts to @saurik for the Cydia tarball + vmcheck. Shouts to /r/jailbreak for being cool.