# [WiiU/Switch] nullptr dereference in the ENL framework

Unregistered content transporter ID in ENL packets causes nullptr virtual call in TransportManager, crashing any player's console in multiple Nintendo online games.

- Payout: hidden
- Severity: high
- Program: Nintendo
- Found by: crazy_man123
- Disclosed: 2023-08-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1540907
- Library page: https://bugbountylibrary.com/r/h1%3A1540907
- Tags: area:devices domain:network impact:dos kind:bounty platform:hackerone sev:high tech:payment technique:reverse-engineering technique:source-review vuln:dos

**Target:** ENL networking library (PIA/NEX) in Switch/WiiU games
**Root cause:** getContentTransporter returns nullptr for unregistered content transporter IDs, and updateReceiveBuffer_ calls a virtual method on it without a null check.
**Steps:**
1. Craft a PIA unreliable packet containing an ENL message with a content transporter ID not registered by the target game
2. Set uint16 data length and payload bytes, terminate with end marker (ID 255, length 0)
3. Send packet to a victim peer during online matchmaking/session
4. TransportManager::updateReceiveBuffer_ resolves transporter to nullptr and invokes readyReceiveStream virtual call, crashing the game
**How found:** Reverse-engineered the ENL library's TransportManager and packet format, observed getContentTransporter returns nullptr for unknown IDs and the virtual call lacks a null check.
**Exploitation:** A modified/fake client sends a malformed ENL message with an unregistered content transporter ID to other players in an online session, causing a null virtual call and crashing their consoles.
**Escalation:** Mass DoS across multiple online titles sharing the ENL library.
**Insight:** In proprietary peer-to-peer networking libraries, enumerate the message/transporter dispatch table and test IDs outside the registered set; virtual dispatch on lookup results is a common unchecked-null sink reachable from any peer.