Location: src/safety/e2e.cpp (Receiver::unwrap, ~lines 116-125)
Finding: When the E2E receiver detects a sequence gap, it updates its stored last-seen-sequence value to the newly-arrived (unexpected) sequence number before raising the sequence-gap error. The next frame received is then compared against this already-advanced value, so if the shifted counter continues consistently from that point (whether from a persistent fault or a deliberately-crafted stream), the gap is only reported once and every subsequent frame is silently accepted as if it were in order. Typical end-to-end protection state machines keep a separate error/monitoring window rather than immediately resynchronizing to whatever sequence number just triggered the fault, precisely so a sustained anomaly keeps being flagged rather than being accepted after one report.
Recommendation: Consider not advancing the stored last-sequence value on a rejected frame (or track consecutive-error state) so that a persistent out-of-sequence stream keeps being flagged rather than resyncing after a single report. Document whichever E2E profile semantics is chosen.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.
Location:
src/safety/e2e.cpp(Receiver::unwrap, ~lines 116-125)Finding: When the E2E receiver detects a sequence gap, it updates its stored last-seen-sequence value to the newly-arrived (unexpected) sequence number before raising the sequence-gap error. The next frame received is then compared against this already-advanced value, so if the shifted counter continues consistently from that point (whether from a persistent fault or a deliberately-crafted stream), the gap is only reported once and every subsequent frame is silently accepted as if it were in order. Typical end-to-end protection state machines keep a separate error/monitoring window rather than immediately resynchronizing to whatever sequence number just triggered the fault, precisely so a sustained anomaly keeps being flagged rather than being accepted after one report.
Recommendation: Consider not advancing the stored last-sequence value on a rejected frame (or track consecutive-error state) so that a persistent out-of-sequence stream keeps being flagged rather than resyncing after a single report. Document whichever E2E profile semantics is chosen.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.