NRDAX-T0400 - Unsigned Integer Underflow Accounting Panic

mechanism

The server's packet-coalescing space-accounting logic performs an unsigned subtraction of remaining datagram space when building its own coalesced Initial response, without checking that the incoming fragmented handshake (split across two CRYPTO frames in two coalesced Initial packets) hasn't already consumed more space than accounted for. An attacker sends a single UDP datagram with two coalesced QUIC Initial packets whose CRYPTO frames reconstruct an oversized (~1222B) ClientHello, triggering an 'attempt to subtract with overflow' at the coalescing arithmetic and crashing the server process pre-handshake. The fix-class is bounds-checked/saturating space accounting in the response-coalescing path, making this the same technique as any other unsigned-underflow-panic in QUIC packet-space bookkeeping triggered by oversized/fragmented handshake input.

instances (2)

related (compute_amp)

cite

https://nrdax.com/techniques/NRDAX-T0400

@misc{nrdax_NRDAX_T0400,
  title = {Unsigned Integer Underflow Accounting Panic (NRDAX-T0400)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0400},
}

{
  "id": "nrdax-NRDAX-T0400",
  "type": "dataset",
  "title": "Unsigned Integer Underflow Accounting Panic (NRDAX-T0400)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0400",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0400 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0400.svg)](https://nrdax.com/techniques/NRDAX-T0400-unsigned-integer-underflow-accounting-panic)