The Object Outlives the Check: Teardown Races, Stale Tokens, and the Trust Boundaries That Slipped

An object gets freed and used. A cookie id gets trusted after validation stopped. A marketplace push outlives the credentials that authorized it. Those are not three stories; they are one bug shape wearing different clothes. The memory bugs on the wire -- gf_sg_proto_del freeing prototype state during XMT teardown and walking it again, MongoDB's primary catch-up UAF reachable by unauthenticated clients, mod_http2 stream state under concurrent pressure -- share the fault line with Dancer's raw session id, Cursor's auto-fetched extension, and gVisor's process handles. Every layer caches authority and defers the use: parse now, free later; authenticate now, fetch later; fix now, disclose never. Hunt the seam between the check and the use, and the CVE label matters less than the primitive.

Start with memory, because the advisory language already undersells it. libdca's bitstream_fill_current() heap walk does tmp = *(state->buffer_start++) in bitstream.c with no end-of-buffer check; it is the second OOB read in the same abandoned decoder this week after scale-factor parsing. VLC 4.0 dropped the library, distros still ship it, and every media front-end linking it inherits the bug -- dead code, alive packages. GPAC/MP4Box through 26.07.0 hits CVE-2026-128240 / gf_sg_proto_del: prototype scene-graph nodes are freed during XMT teardown and then reused; the advisory says crash-only, CVSS 5.5, AV:L/UI:R, fixed in a2e5c62c. Treat 'crash-only' as a statement about the current heap, not a guarantee: build an XMT corpus, nest proto instantiation to control deletion order, place attacker-sized allocations adjacent to the freed proto state, and see whether the stale walk becomes a controlled free. Then race Apache: CVE-2026-119618 in mod_http2 is a stream-handling race disclosed November 11; script concurrent stream creation, cancellation, and window updates, interleave RST and HEADERS, and diff the fix commit for exact lock ordering. Worth a 10-minute diff. MongoDB's CVE-2026-118383 primary catch-up UAF is the worst pairing because Datadog says unauthenticated clients can set up the condition: lab a replica set, force a stepdown mid-write, and try to reallocate the freed object with attacker-influenced BSON before the stale walk. Unauth plus replication internals is the chase.

The trust-boundary bugs run on the same clock. Dancer <1.3400 passes the session cookie's id straight into whatever backend is configured -- YAML, DBI, Redis -- with zero validation (CVE-2015-10149); the id is treated as a trusted key long after the cookie proved nothing. Filter the id or jump past 1.3400, then grep Dancer2, Mojolicious, and Catalyst session plugins for the same raw-cookie-id-to-backend pattern. Cursor is the supply-chain version: stolen Fireworks credentials let attackers push a poisoned extension through the marketplace, so the editor's auto-fetch pipeline became the delivery mechanism. 'Marketplace trust' is load-bearing until you map which marketplaces sign packages versus merely authenticate publishers, and whether a revoked upstream credential actually kills a published extension. Bishop Fox's Cirro v1.4.0 Entra ID walk shows the authorization variant: the most restrictive guest settings still let a guest read application properties by traversing known app IDs. 'Restricted' guest is doing a lot of work in that sentence; replicate the known-app-ID traversal in your own tenant, then check redirect URIs, secret hints, and roles for the real leak. CSP allowlists and header-gated XSS fit here too: a validation decision made at one layer gets trusted at the sink, and JorianWoltjer/responder gives you a clean way to bake arbitrary response headers into a shareable URL and probe that seam.

Negative-day is not just abandoned code; it is any fix or finding that lands without a matching advisory. The gVisor push is the quiet version: proc-umount process-handle work, host-net child netns loopback handling, and file-lock wait registration all landed together, with no loud bulletin. Pull 5f7e73a9, trace which process handles survive umount and how host-net child netns loopback is wired, grep sibling paths that did not get the same treatment, and hammer teardown ordering under the new file-lock wait registration -- a handle that outlives its namespace is a sandbox-escape seed. dawgyg/AppleResearch is the research-side negative-day: a 510-star corpus of unreported macOS findings that fell under bounty thresholds, with the author flagging some as unpatched and portable to iOS/watchOS. Mine the memory-corruption entries against current XNU/dyld behavior before trusting the portability claim. And watch package-version comparators: osv.dev's RPM fix covers TuxCare/CentOS/OracleLinux/RHEL, but epoch/release-suffix edges (el8 vs el8_4, ~pre, ^dist tags) can still sort wrong and silently hide matching advisories. A hidden advisory is a negative-day patch with extra steps.

Radio is the same stale-authority problem at physics scale. A GNSS fix, a holdover clock, or a calibration phase is only as good as the integrity check that last validated it. Ukraine's Lima system layers spoofing on jamming and feeds false position fixes so drones and guided weapons resolve to Peru; Turk Telecom/Calnex holdover data shows a base station has no re-sync grace once GNSS drops -- timing and sync degrade silently. That is the dwell-time budget for any GNSS-denial op against timing-dependent backhaul. On the bench, osqzss/pluto-crpa is the cleanest new primitive: a two-element controlled-reception-pattern-array on a PlutoSDR (AD9363 + Zynq-7010), adaptive weights on the PS, combining in the PL, re-transmitted at GPS L1 into a COTS receiver. Extend it to a four-element null ring, push the weight combination into more PL fabric, and measure null depth against a chirp jammer at 1575.42 MHz before fielding it against a real spoofer. KrakenSDR's C++ suite keeps MUSIC DoA running concurrently with demod; bench it against the old Python stack on a Pi 5 and look for coherent-channel leakage when the Mode selector splits tuner usage. PortaPack Mayhem extended PRALINE TX/RX clock sync to the HackRF Pro's 25 MHz TCXO and killed SD write corruption with single-beat SDIO IDMAC transfers -- check the carrier against a GPSDO-referenced counter, then stress the SD path during rapid modulation switches. ESP32-C5 wardriver puts 2.4/5/6 GHz in a pocket; 6 GHz-only BSSIDs are the fresh dataset, but verify hashed-MAC sanitization survives your export format. And SoapyRemote 0.5.4 bounded stream header bytes/elems in acquireRecv plus mid-payload peer-close handling; throw truncated and oversized stream headers at a hostile client and see whether the bounds cover every RPC message type, not just the patched one.

The countermeasure is not a product category; it is a discipline: pin authority to the object's lifetime, then attack that pin. Pull the exact commit, isolate the changed invariant, and build the minimal primitive before the advisory traffic arrives -- the patch-to-exploit loop Miessler flagged around Dawn Song's team is the right model, and Artex's 'machine speed' recon -> exploitation -> privileged access chain at under three hours is the clock. For memory bugs, fuzz teardown under thread contention and control free order, not just the parse path. For trust bugs, inventory every auto-fetch and every raw id that crosses a backend boundary, and test revocation, not just authentication. For RF, measure holdover decay and null depth before trusting a spoofed fix or a clean carrier. The verdict is blunt: if the object, token, or timing reference can outlive its check, you have a bug -- and usually a chain, not a crash.