On Fri, 04 Sep 2026 17:01:07 +0000 [email protected] wrote: > If a malicious remote writer (such as an untrusted guest VM) modifies the > length fields in shared memory between the initial check and the memcpy(), > can event_size become arbitrarily large? > > Could this bypass the bounds check and cause an out-of-bounds read from > rpage->data and a massive out-of-bounds write to dpage->data?
I don't think Sashiko knows that a remote writer isn't a guest. Well that's not the normal case. But the trusted hypervisor that we control. -- Steve
