# Length field inconsistency memory corruption

Lengths narrowed, rewritten, or mismatched with actual bytes before a copy or read

_Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-10-15. Updated 2026-11-01._

## How it works
A length or size value is trusted in one form and consumed in another. It may be narrowed (computed wide, stored narrow), rewritten after parsing (a deferred write mutates a header field a later stage re-reads), or simply not match the bytes actually present. The consumer then copies, indexes, or reads using the wrong number. The broken assumption: the length seen at parse time equals the length at use time, in the same width and the same base offset.

## Where it shows up
- A size computed in a wide type assigned to a narrower variable, especially where the value feeds a mask like `n-1` [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md)
- Deferred-write metadata (checksum start/offset, GSO/offload hints) whose target offset is frame-relative but consumed network-header-relative [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-pwnescape.md)
- Length checks ordered *after* a read of the buffer body [E3](https://bugbountylibrary.com/r/h1%3A3709605.md)
- Alternate allocation paths (copy/serialization) that size buffers to exactly the message length, unmasking reads that normal backing storage hides [E3](https://bugbountylibrary.com/r/h1%3A3709605.md)

## How to review
For every length, ask: what width is it stored in, what width was it computed in, and can the two differ? For every copy or index, confirm the length was validated in the same units and coordinate space the copy uses. The invariant: the length used at the sink must be derived from, and bounded by, the bytes actually present, at the same width and same base offset. Check ordering: no read of `body[0]` before the zero-length check [E3](https://bugbountylibrary.com/r/h1%3A3709605.md). Check that a mask built from a size cannot collapse to all-ones [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md). Check that deferred writes land only in memory the parser has not already validated [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-pwnescape.md).

## How finders spotted it
- Hypothesized that untrusted state gets promoted to trusted and re-trusted later; noticed frame-relative vs header-relative offsets diverge after decapsulation [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-pwnescape.md)
- Traced a shift loop, saw the computed value reach 0x10000, then confirmed the 16-bit truncation to 0 in a debugger [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md)
- Read code: saw a length check placed after a body read, then found the exact-size allocation path that unmasks it [E3](https://bugbountylibrary.com/r/h1%3A3709605.md)

## Variants seen
- Integer truncation collapsing a hash-size mask to all-ones [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md)
- Deferred checksum write mutating an already-parsed header field [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-pwnescape.md)
- Zero-length message read past an exact-size allocation (OOB read only, no corruption) [E3](https://bugbountylibrary.com/r/h1%3A3709605.md)

## Impact and severity
Ranged from an OOB read [E3](https://bugbountylibrary.com/r/h1%3A3709605.md) to a write primitive [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md) and guest-to-host escape [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-pwnescape.md). Impact rose when the primitive was chained: a repeatable read used to resolve host memory state, then combined with allocator grooming for targeted kernel writes and a bounded host-root chain [E1](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-pwnescape.md). The SSH1 truncation gave a write primitive that could overwrite auth state, root password, or RSA exponent, constrained by a length cap and a persistent n=0 state [E2](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-pwnescape.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2025-02-27-exploitable-sshd-html.md
- E3: https://bugbountylibrary.com/r/h1%3A3709605.md