# Type confusion via unchecked struct cast

Casts or union reads that trust an attacker-chosen name, tag, or type instead of the object's real type

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-07-27. Updated 2026-11-08._

## How it works
Code holds a pointer to an object and picks a struct layout from a value the attacker controls — a context name echoed back by a server, a `.constructor` property, or a port type userspace can flip. C/C++ casts do no runtime type check, so fields get read at the wrong offsets. The broken assumption is "the type I asked for is the type I got back." In split designs (kernel vs userspace helper, client vs remote server) the untrusted side supplies the answer.

## Where it shows up
- Parsers that `switch` on a name/tag/ID taken from the wire, then cast a buffer to the matching struct [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge.md)
- Typed-array construction that reads `source.buffer` and casts it to a fixed type without checking [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-09-09-fuzzilli-jerryscript-html.md)
- Unions where userspace can change the active member (port type, kobject) while other code still reads the old member [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-27932.md)
- Kernel code that trusts the type/length it *requested* rather than what the helper *returned* [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge.md)
- Asserts that would catch the mismatch but are compiled out of production builds [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-09-09-fuzzilli-jerryscript-html.md)

## How to review
For every cast or union field read, ask: can an attacker change the real type between allocation and use, and is there a check on the *actual* type (not a caller-supplied tag)? The invariant: the struct layout used must be derived from the object's true runtime type, verified at the point of use. Check every reader of a mutable union member for whether the member can flip underneath it [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-27932.md).

## How finders spotted it
- Read open-source Apple SMBClient/webdavfs source and noticed the parser switched on the server-controlled context name rather than request state [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge.md)
- Used Fuzzilli's IR mutators to reassign `.constructor` mid-execution so a later engine path saw an unexpected type; then minimized the PoC by hand [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-09-09-fuzzilli-jerryscript-html.md)
- Variant analysis of earlier `ipc_port` kdata-union confusions, then manual review of newly added turnstile code touching `sync_inheritor_port` [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-27932.md)

## Variants seen
- Server-echoed context name selects struct layout in a kernel filesystem parser [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge.md)
- Property reassignment (`.constructor`) makes the engine cast a typed array as ArrayBuffer [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-09-09-fuzzilli-jerryscript-html.md)
- Userspace-flippable port type makes a union member read as the wrong struct [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-27932.md)

## Impact and severity
Reached kernel read/write and root [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge.md), memory corruption in a JS engine [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-09-09-fuzzilli-jerryscript-html.md), and kernel privesc in a real iOS chain [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-27932.md). Severity rises when chained: an infoleak defeats ASLR/MIE before the confusion gives a controlled dereference [E1](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge.md), and a renderer bug plus sandbox escape plus kernel LPE yields SYSTEM [E3](https://bugbountylibrary.com/r/p0%3ACVE-2020-27932.md). Reach scales with how many untrusted inputs hit the cast.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Apple XNU** (smbfs and webdav_fs kexts) fixed in macOS 26.6: Apple MIE exploitation challenge (CVE-2026-64704, CVE-2026-64699). Report: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge.md
- **Apple iOS** (XNU kernel turnstile / special reply port handling) iOS 14.1 and previous, fixed in iOS 14.2: CVE-2020-27932: iOS Kernel privesc with turnstiles (CVE-2020-27932). Report: https://bugbountylibrary.com/r/p0%3ACVE-2020-27932.md
- **JerryScript** (ecma_typedarray_create_object_with_typedarray) (version not stated): Fuzzing JavaScript Engines with Fuzzilli. Report: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-09-09-fuzzilli-jerryscript-html.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-apple-mie-exploitation-challenge.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-09-09-fuzzilli-jerryscript-html.md
- E3: https://bugbountylibrary.com/r/p0%3ACVE-2020-27932.md