Five days after ASI-2026-0013, we had tAI 4.2 go back over tOS with the same instruction: don't write, review. It found that the underlying architectural gap flagged back in ASI-2026-0001 (no real separation between user and kernel memory) was still open in the syscall layer itself, and this time the exploit path was direct.
What it found
syscall_handler() in syscall.c ignored the page tables' PTE_USER bit entirely once execution reached ring0. Nothing in the paging setup stopped the kernel from dereferencing any address a ring3 .t program handed it as a syscall argument. Three syscalls took a pointer straight from ring3 without checking it actually belonged to the calling program's own memory: SYS_INFLATE, SYS_GFX_BLIT, and SYS_AUDIO_SUBMIT.
SYS_INFLATE's args->out is the raw-DEFLATE decompression target. With no validation, a ring3 program could point it at arbitrary kernel memory (page tables, function pointers, the syscall dispatch table itself) and supply crafted compressed input it fully controls: an arbitrary kernel-memory write of fully attacker-chosen content from a single syscall, a direct path to local privilege escalation.
SYS_GFX_BLIT's args->pixels and SYS_AUDIO_SUBMIT's source buffer are the read-side equivalent: point either at kernel memory and its contents become observable via the screen or audio output. All three syscalls are reachable by any unprivileged ring3 .t executable, no special permissions required.
Attack scenario
- Write an ordinary ring3
.tprogram that requires no special permissions. - Call
SYS_INFLATEwithargs->outpointed at an arbitrary kernel address, such as the syscall dispatch table. - Supply crafted, fully attacker-controlled compressed input as the decompression source.
- One syscall later, attacker-chosen content is written directly into kernel memory: local privilege escalation from unprivileged userspace.
The fix
A new user_range_ok(ptr, len) check in syscall.c rejects zero-length and integer-overflowing ranges, and requires the full [ptr, ptr+len) span to fall inside the calling program's own code/data region or its own stack. All three affected syscalls now run every pointer argument, including ones embedded in argument structs, through this check before ever dereferencing it.
References
- github.com/Artfical/tOS/commit/90bdc6a
- github.com/Artfical/tOS/blob/main/kernel/fs/syscall.c
- db.artfical.com/research/ASI-2026-0014
Two findings in a week, both in code nobody asked tAI 4.2 to touch. That's the pattern we care about most: a model that reads existing systems closely enough to catch what their own authors missed.