NRDAX-T0400 - Unsigned Integer Underflow Accounting Panic

Fault termination · P2P and gossip · absent invariant · active · first seen 2026-07-15

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

The server's packet-coalescing space-accounting logic performs an unsigned subtraction of remaining datagram space when building its own coalesced Initial response, without checking that the incoming fragmented handshake (split across two CRYPTO frames in two coalesced Initial packets) hasn't already consumed more space than accounted for. An attacker sends a single UDP datagram with two coalesced QUIC Initial packets whose CRYPTO frames reconstruct an oversized (~1222B) ClientHello, triggering an 'attempt to subtract with overflow' at the coalescing arithmetic and crashing the server process pre-handshake. The fix-class is bounds-checked/saturating space accounting in the response-coalescing path, making this the same technique as any other unsigned-underflow-panic in QUIC packet-space bookkeeping triggered by oversized/fragmented handshake input.

live exposure

No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.

instances (2)

chain	primitive	fidelity	origin	reproducer (bundle)	source
conflux	conflux_snapshot_manifest_blame_underflow	lab	reverse-engineered-cve	conflux_snapshot_manifest_blame_underflow	-
quic	quinn_large_client_hello_panic	lab	reverse-engineered-cve	quinn_large_client_hello_panic	-

related (Fault termination)

NRDAX-T0001 - Addr Message Counter Overflow Crash active NRDAX-T0005 - Array Deserialization Memcpy Corruption active NRDAX-T0013 - Bloom Filter Divide-By-Zero Crash active NRDAX-T0024 - Compact Block FillBlock Duplicate Crash active NRDAX-T0056 - Duplicate Input Validation-Bypass Crash active NRDAX-T0101 - Handshake Crypto Validation Bypass Crash active NRDAX-T0120 - Integer-Overflow Panic Control Message active NRDAX-T0122 - Integer Signedness Index OOB Crash active

cite

https://nrdax.com/techniques/NRDAX-T0400

plain

NRDAX Registry. Technique NRDAX-T0400.

bibtex

@misc{nrdax_NRDAX_T0400,
  title = {Unsigned Integer Underflow Accounting Panic (NRDAX-T0400)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0400},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0400",
  "type": "dataset",
  "title": "Unsigned Integer Underflow Accounting Panic (NRDAX-T0400)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0400",
  "publisher": "NRDAX Registry"
}

badge

[![NRDAX-T0400 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0400.svg)](https://nrdax.com/techniques/NRDAX-T0400-unsigned-integer-underflow-accounting-panic)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique

nrdax get NRDAX-T0400

Cite it (BibTeX)

nrdax cite NRDAX-T0400 --format bibtex

CLI guide → GitHub ↗