| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
structure
The previous pass showed a wholesale-filled invoke structure is rejected, meaning something
in those bytes is validated, and a validated field is a used field. A full-resolution sweep
of all one hundred and ninety-six dwords, at word stride rather than the earlier coarse
stride, isolates exactly one field.
Characterising its accepted range shows only zero is accepted, small values give one error
code and large values another, with no stall and nothing written beyond the declared window
at any value, so the field is strictly validated.
The invoke ring structure is therefore fully characterised, with almost every dword ignored,
the single field that is read range-checked, and no value producing corruption. The objective
is not met.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The previous pass left this surface partially covered because the fill test clobbered the
session identifier and therefore measured the session check rather than the payload. Fixed
by filling the raw bytes first and setting the two real fields through the accessors
afterwards so they survive.
With that correction, filling the whole remainder returns a clean error with its own
status code, distinct from the invalid-session code, so the processor is validating the
region rather than the session check firing. Individual dwords across the full range are
all ignored with success status. No stalls and no writes outside the declared window in
any case.
The invoke ring structure is therefore fully covered: stray individual fields are ignored
and a wholesale-garbage structure is rejected with its own code, so the previous pass's
caveat is resolved rather than left standing. The objective is not met.
|
|
|
The invoke ring command is several hundred bytes but every invoke in this audit set only
two fields and left the rest zero, and that data is parsed directly from the ring, a
different input path from the shared buffer, never previously fuzzed.
Individual dwords across the first part of the unused space, set to all-ones, are ignored
with success status, no stall and no write beyond the declared window. The cases that
filled the whole remainder all returned the same error, but those rows prove nothing and
are not counted, since filling from that offset overwrites the session identifier itself
and the error is exactly the invalid-session code the lifecycle probe produced for stale
and forged handles, so it is the session check firing rather than a reaction to the
payload.
The pass establishes that the first part of the unused ring-command space is ignored
safely, while the remainder is only covered by the uninformative fill case, so this
surface is partially covered and is stated as such rather than claimed complete.
|
