Hello,
since you mention hairpinning in the title of your post, you might have already tried this:
same-security-traffic permit intra-interface
I could not see an 'object-group network' for your Iphone pool, you might have to add that.
object-group network IPHONE_POOL
network-object x.x.x.x x.x.x.x
nat (outside,outside) source dynamic IPHONE_POOL interface
--> "this tells the ASA to take the VPN client space in the outside interface,
back out the outside interface, but to dynamically overload it to the outside interface IP.
This is the actual NAT hairpin configuration that allows a VPN client to come
in the outside and then leave back out towards the internet with the NAT overload"
