|
|
The cross-function detector had run with a single accessor and field offset, so it was
generalised to every field offset of the slot accessor and separately to the channel
lookup, in case a different buffer had a different and possibly reachable fill path.
Across forty-one argument passes for the slot accessor there are exactly two hits, both
already characterised and both on the same staging buffer, and the channel object yields
none across twenty-five passes. The family is therefore closed at two, with no other
buffer in the module having this shape.
The detector is persisted with its controls and limitations documented. The objective
remains unmet and the reason has been stable for fifteen passes: the firmware contains
genuine memory-unsafe code while the paths that would carry attacker-sized data into it
consistently carry compile-time constants instead.
|
