|
|
output
The recurring failure across the previous passes is a callee whose arithmetic is
locally unguarded and whose caller establishes the bound, seen in OPM, in SYS_DRV's
sub_E0D6B4 and in powerplay 0x109a. The fix is to propagate caller-established
invariants, so this builds a call graph from a resynchronising sweep, finds copy sites
whose length is an incoming parameter, and asks every caller what it supplies.
Its negative control passes: it correctly does not report sub_E0D6B4, the
bounded-by-caller case that motivated it.
Its positive control fails, and structurally rather than by a fixable bug. HDCP's
confirmed overflow takes its length from a struct field directly at the copy site with
no wrapper function, so it falls outside the class this tool analyses, and restricting
to parameter-derived lengths is exactly what made caller propagation tractable.
Therefore its output is not reported as a negative. An empty result from a detector
that cannot rediscover the one bug we know about is the unfalsifiable claim this tree's
rule exists to prevent. The tool is committed with the limitation in its docstring so
the next attempt starts from the real state rather than an apparently clean sweep.
Making it sound needs field-level value tracking rather than register tracking, and the
SYS_DRV case proves a shortcut will not do, since the bound sat on a different field
from the one consumed, so any module-wide offset-compared heuristic reintroduces the
false positive it was built to remove.
Summarises all eight passes: no new exercisable memory-corruption primitive, every
detector either controlled or explicitly marked untrustworthy, and two latent findings
gated behind a SYS_DRV service consumer silicon does not implement.
|
