sk_v4_idle replaces the drive-slot array without copying it #178

New Issue

2026-11-11T21:33:47Z

rajames commented

2026-11-11 21:33:47 +00:00

Found

kernel/src/v4/sk_v4_identity.c:509: when g_usb[xc].count < xdev->max_slots + 1 a fresh array is allocated and the old one dropped, not copied or freed. g_offered, g_spare, g_pending_real, g_real_drive and g_zuse_dev (&d->part inside the old array) would then point into the abandoned array. Latent: max_slots does not change after the first allocation today.

Done when

The array is allocated once per controller (and the condition removed), or grown by copying with the pointers kept valid

🤖 Filed with Claude Code -- the code review of 2026-11-11, at 4d42d25c (Captain Bob, 2026-11-11: "File the review findings as issues"). Read, not run: each is to be confirmed by a test written first and seen to fail.

### Found `kernel/src/v4/sk_v4_identity.c:509`: when `g_usb[xc].count < xdev->max_slots + 1` a fresh array is allocated and the old one dropped, not copied or freed. `g_offered`, `g_spare`, `g_pending_real`, `g_real_drive` and `g_zuse_dev` (`&d->part` inside the old array) would then point into the abandoned array. Latent: `max_slots` does not change after the first allocation today. ### Done when - [ ] The array is allocated once per controller (and the condition removed), or grown by copying with the pointers kept valid 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- the code review of 2026-11-11, at `4d42d25c` (Captain Bob, 2026-11-11: "File the review findings as issues"). Read, not run: each is to be confirmed by a test written first and seen to fail.

rajames added the

labels 2026-11-11 21:33:48 +00:00

Sign in to join this conversation.