|
|
The last surface that was sampled rather than swept. Payload fuzzing had mutated only the
first part of the window or filled broad regions uniformly, so a command reading a
parameter deeper in the sixteen-kilobyte window would be missed by both, and the earlier
ring fix makes a per-dword sweep of the whole window affordable for the first time.
For every dword offset in the window the sweep sets it to all-ones, invokes, and compares
status and output against the unmutated baseline while watching for stalls and writes past
the window. Across three applications that is over twelve thousand single-dword mutations
with no stall, no write beyond the window and no status change. The entries where output
differs are the application echoing input into its output area, since the status is
unchanged and the differing bytes are the mutated value itself, so they are not hits.
Every host-supplied byte, the whole shared buffer, both ring command structures and the
image, has now been mutated at dword resolution on real hardware, and nothing produces a
write outside a host-designated buffer. The objective is not met.
|
