# Unchecked native return dereferenced

Decode or lookup return stored then dereferenced without a null check on the failure path

_Area: Memory corruption and native code. Seen in 8 disclosed reports; 2 confirmed bounties: $500 and $8,000; latest 2026-10-15. Updated 2026-10-23._

## How it works
A native helper (decoder, lookup, dispatch search) signals failure by returning NULL. The caller stores that return and then uses it — calls a method, invokes a virtual function, or wraps it in a typed value — without testing for NULL. The failure path is reachable from attacker-controlled input (malformed encoding, unregistered ID, removed fallback), so the assumption "this helper always returns a valid pointer" breaks and the process dereferences address zero.

## Where it shows up
- Decode/parse helpers (base64, deserializers) whose NULL/false return is assigned straight into a struct or typed value [E3](https://bugbountylibrary.com/r/h1%3A161216.md)
- Lookup tables keyed by attacker-supplied IDs, where a miss returns NULL and the caller dispatches on it [E2](https://bugbountylibrary.com/r/h1%3A1540907.md)
- Language-runtime dispatch sites (send, super, method_missing fallbacks) that search for a handler and skip the fallback when the search fails [E1](https://bugbountylibrary.com/r/h1%3A181695.md)
- Virtual calls on the result of a getter that can return NULL
- Any `x = helper(...); use(x)` with no `if (x == NULL)` between

## How to review
For each call to a helper that can fail, confirm the invariant: every use of the return value is dominated by a NULL check on every path, including error and fallback paths. Check that all dispatch sites share the same fallback logic — one site missing it is enough [E1](https://bugbountylibrary.com/r/h1%3A181695.md). Enumerate IDs/inputs outside the registered or valid set and trace whether the miss reaches a dereference [E2](https://bugbountylibrary.com/r/h1%3A1540907.md). For deserializers, confirm malformed-encoding input cannot reach a store-then-use of a NULL result [E3](https://bugbountylibrary.com/r/h1%3A161216.md).

## Variants seen
- Missing fallback in one of several dispatch paths in a VM [E1](https://bugbountylibrary.com/r/h1%3A181695.md)
- Unregistered protocol ID yielding NULL, then a virtual call [E2](https://bugbountylibrary.com/r/h1%3A1540907.md)
- Invalid encoding yielding NULL stored as a string value [E3](https://bugbountylibrary.com/r/h1%3A161216.md)

## Impact and severity
All three caused crashes (segfault/DoS); E2 crashed other players' consoles remotely in online games, raising severity. Severity rises when the NULL is later used for virtual dispatch or memory writes, and when the trigger is a single malformed packet or value from a remote peer.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A181695.md
- E2: https://bugbountylibrary.com/r/h1%3A1540907.md
- E3: https://bugbountylibrary.com/r/h1%3A161216.md