DF-5317
USB_FS_STOP bounds-checks u.pstop->ep_index but indexes the array with u.pstart->ep_index — latent union type-confusion, benign only because the two ioctl structs are layout-identical
Summary
Copy-paste union-member mixup: benign today (both structs are a single uint8_t), any divergence turns it into an unchecked index. Use-the-checked-member fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5317 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 938 B | view raw |
Fix verification
not_testablebaseline no→ patch + rebuild →patched clean
per-fix-DF-5317
Confirmed kernel references
Detail
Evidence (decisive lines)
static trace (DF-5317 hunk included in findings/poc/DF-5314/fix.diff)
Verified recommended fix
see finding markdown
Verdict
untested (Info; latent union confusion / one-liner log-flood gate)
No comments yet.