- Affected binary:
tcpip.sys10.0.19041.7291 → 10.0.19041.7417 - CVE: CVE-2026-42904
- Patch date: 2026-06-09
- CVSS: 9.6
- Class: Buffer overflow
- Patch KB: KB5094127
TL;DR
tcpip.sys reassembles length-prefixed FSE messages arriving on a kernel (WSK) receive path into a fixed 0x400-byte scratch buffer that lives inside a per-connection context. FseProcessIncomingMessages decides, on each incoming chunk, how many bytes to memmove into that buffer while it waits for a partial message to complete. In the pre-patch code the only sanity checks on the copy length were a lower bound (0x21) and a comparison against the declared message length — nothing ever verified that the number of bytes buffered stayed within the 0x400-byte buffer. An adjacent-network attacker who fragments a message so that the incoming payload is smaller than its declared length causes the whole incoming chunk to be copied in unbounded, producing a controlled heap overflow. The patch introduces RtlUIntAdd-checked accumulation and hard 0x400 caps on both the declared length and the copy size, and gates the new behavior behind Feature_98821435.
Background
The Fse* family of routines in tcpip.sys implements a framed message layer on top of a kernel-mode socket. FseWskReceiveIrpCompletionRoutine fires when a WSK receive IRP completes, and hands the freshly received buffer to FseProcessIncomingMessages. Data on the wire is a stream of self-describing messages: the first uint of each message (*_Src) is its total length, and valid messages are constrained to the range [0x21, 0x400] — at least 0x21 (33) bytes of header, at most 0x400 (1024) bytes total.
Because TCP is a byte stream, a single receive can contain several whole messages, a whole message plus a fragment, or just a fragment of one message. To handle fragments straddling receive boundaries, each connection carries a reassembly context (reached via *(param_1 + 0x20) + 0xa8, aliased lVar1). Two fields matter:
lVar1 + 0x88— a fixed 0x400-byte buffer holding the bytes of a partially-received message.lVar1 + 0x488— auintcount of how many bytes are currently held in that buffer.
The routine’s job on each call is to drain complete messages (dispatching each to FseProcessIncomingMessage) and to stash any trailing partial message into +0x88, updating the +0x488 count, so the next receive can continue where this one left off. When fewer than 4 bytes are buffered the length prefix itself is split across receives, so the code reconstructs a 0x20-byte header in a stack scratch buffer (local_68/local_60) to recover the declared length before deciding how much to copy.
Root Cause
The defect is the complete absence of an upper bound tying the amount copied into +0x88 to the buffer’s actual 0x400-byte size. Consider the “nothing buffered yet” path (*(lVar1 + 0x488) == 0, label LAB_0) in the pre-patch decompilation:
uVar5 = (uint)_Size;
while (uVar5 != 0) {
uVar5 = (uint)_Size;
if ((uVar5 < 0x21) || (uVar5 < *_Src)) {
memmove((void *)(lVar1 + 0x88), _Src, _Size); // <-- unbounded
*(uint *)(lVar1 + 0x488) = uVar5;
return 1;
}
FseProcessIncomingMessage(lVar1, _Src);
uVar4 = *_Src;
_Src = (uint *)((longlong)_Src + (ulonglong)uVar4);
uVar5 = uVar5 - uVar4;
_Size = (size_t)uVar5;
}
_Size/uVar5 here is the number of bytes remaining in the current receive. The loop dispatches complete messages, but the moment the remaining data is smaller than the declared message length (uVar5 < *_Src), it treats the remainder as a partial message and buffers all of it with memmove((void *)(lVar1 + 0x88), _Src, _Size). The guard is (uVar5 < 0x21) || (uVar5 < *_Src) — a lower bound and a “does this complete a message?” test. Neither caps _Size at 0x400.
An attacker controls both operands. *_Src is the first four bytes of the attacker’s data, so setting it to a large value (say 0xFFFFFFFF) forces the uVar5 < *_Src branch for any realistic receive. _Size is the size of the payload the attacker sent. Send a single chunk larger than 0x400 with an oversized length prefix and memmove writes _Size bytes into the 1024-byte buffer at +0x88, running straight off the end into whatever the heap allocation places after the reassembly context.
The same structural flaw exists in the “bytes already buffered” branches. When 4 or more bytes are buffered the declared length is read straight from the buffer (iVar6 = *(int *)(lVar1 + 0x88)) and validated only against the range [0x21, 0x400] via 0x3df < iVar6 - 0x21U. When the incoming chunk does not complete the message, the code again does:
memmove(pvVar2, _Src, _Size); // pvVar2 = lVar1 + 0x88 + uVar4
*(int *)(lVar1 + 0x488) = *(int *)(lVar1 + 0x488) + uVar5;
The destination is +0x88 + count, and the length is the full incoming _Size, with the count then advanced by uVar5. There is no check that count + _Size <= 0x400. The only near-bound in the whole function was uVar5 < 0x20 - uVar4 in the count < 4 sub-case — and note that constant is 0x20, the header reconstruction size, not 0x400, so it never protected the message body copy. Both the declared length validation and the running count are int/uint and are added without overflow checking, so even the range check on the declared length can be bypassed by arranging the accumulation to wrap.
The Patch
The post-patch FseProcessIncomingMessages grows from 765 to 1158 bytes and pulls in two new callees: RtlUIntAdd for overflow-checked addition and Feature_98821435__private_IsEnabledDeviceUsage as the gate for the new logic. Every copy path now enforces the 0x400 ceiling.
The count == 0 drain loop (LAB_1). The unbounded buffer-the-remainder case is replaced with an explicit cap:
uVar8 = (uint)_Size_00;
if (uVar8 < 0x21) {
Feature_98821435__private_IsEnabledDeviceUsage();
}
else {
if (*_Src <= uVar8) { // message fully present -> dispatch
FseProcessIncomingMessage(lVar1, _Src);
uVar6 = *_Src;
_Src = (uint *)((longlong)_Src + (ulonglong)uVar6);
uVar8 = uVar8 - uVar6;
_Size_00 = (size_t)uVar8;
if (uVar8 == 0) goto LAB_2;
goto LAB_1;
}
iVar3 = Feature_98821435__private_IsEnabledDeviceUsage();
if (iVar3 == 0) goto LAB_3; // feature off: legacy copy
uVar6 = *_Src;
if ((0x400 < uVar6) || (0x400 < uVar8)) { // NEW: hard caps
/* WPP trace 0x30, then */ goto LAB_4; // LAB_4 -> return 0
}
}
LAB_3:
memmove((void *)(lVar1 + 0x88), _Src, _Size_00);
*(uint *)(lVar1 + 0x488) = uVar8;
When the feature is enabled and a partial message is about to be buffered, the code now rejects the input (return 0, after emitting a WPP trace with id 0x30) if either the declared length *_Src or the remaining size uVar8 exceeds 0x400. Since neither the buffer offset (0) plus a ≤0x400 copy can exceed the 0x400 buffer, the overflow is closed.
The count < 4 append path. Here the declared length isn’t yet known in full, so the running total is what must be bounded. The patch inserts an overflow-checked add before the copy:
if (uVar8 < uVar6) { // uVar6 = 0x20 - count
iVar3 = Feature_98821435__private_IsEnabledDeviceUsage();
uVar4 = (ulonglong)*(uint *)(lVar1 + 0x488);
if (iVar3 != 0) {
local_68[0] = 0;
iVar3 = RtlUIntAdd(uVar4, _Size_00, local_68); // count + incoming
if ((iVar3 < 0) || (0x400 < local_68[0])) { // overflow OR > 0x400
/* WPP trace 0x29 / 0x2d, then */ goto LAB_4; // return 0
}
}
memmove((void *)(lVar1 + 0x88 + uVar4), _Src, _Size_00);
*(int *)(lVar1 + 0x488) = *(int *)(lVar1 + 0x488) + uVar8;
...
}
RtlUIntAdd(count, incoming, &sum) returns a negative NTSTATUS on 32-bit wraparound, and the code additionally rejects sum > 0x400. Only if count + incoming both fits in a uint and stays inside the buffer does the memmove at +0x88 + count proceed. The same guarded pattern is duplicated in the reconstructed-header branch (after the two memmoves into the local_60 scratch header that recover local_60[0], the declared length) and in the count >= 4 branch, where the declared length is re-read from the buffer and again validated against [0x21, 0x400] (iVar3 - 0x21U < 0x3e0) before the completing copy at LAB_11/LAB_10.
Feature gating. Every new check is wrapped in Feature_98821435__private_IsEnabledDeviceUsage(). When it returns zero the function falls through to the legacy code paths (goto LAB_3, goto LAB_8, goto LAB_11) that retain only the old range check; when it returns non-zero the RtlUIntAdd / 0x400 logic runs. The co-patched gate helper itself is trivial:
ulonglong Feature_98821435__private_IsEnabledDeviceUsage(void)
{
if ((Feature_98821435__private_featureState & 0x10) == 0)
return Feature_98821435__private_IsEnabledFallback(
Feature_98821435__private_featureState, 3);
return (ulonglong)(Feature_98821435__private_featureState & 1);
}
This is the standard Velocity/CFR staged-rollout pattern: bit 0x10 of the cached feature state selects between a locally-cached decision (bit 0) and the IsEnabledFallback slow path. It is the switch that arms the entire overflow fix, which is why it is included in the same patch even though it contains no security logic of its own. Note that once fully rolled out (feature forced on) the iVar == 0 legacy branches become dead code.
Exploitability
The primitive is a classic linear heap buffer overflow. The overflowed object is the per-connection reassembly context; the write starts at +0x88 (or +0x88 + count) and runs past the buffer’s 0x400 boundary. Both the length and the contents of the overflow are attacker-controlled: the length is the size of the fragment the attacker chooses to send (bounded only by MTU/receive sizing pre-patch), and the contents are the raw bytes on the wire. That combination — controlled overflow length plus controlled overflow data adjacent to a kernel pool allocation — is a strong foundation for corrupting an adjacent object’s header or a neighboring pointer, the usual route from pool overflow to arbitrary write and ultimately kernel code execution.
Triggering is straightforward and requires no authentication: the attacker sends a fragment whose 4-byte length prefix advertises a message larger than the data actually delivered in that receive (uVar5 < *_Src), and whose payload exceeds 0x400 bytes. The count == 0 path takes the bait on the very first fragment — there is no race and no need to win a timing window, because the vulnerable memmove executes synchronously in the WSK receive completion. The count-nonzero paths give a second, incremental variant where the attacker dribbles bytes across several segments to push the running +0x488 count past 0x400, which is useful for shaping exactly where the write lands.
The CVSS 9.6 / “adjacent network” scoping reflects that the FSE message layer is reachable over the link-local network rather than the full Internet, and the “low complexity” despite the elaborate branching is accurate: the attacker never has to reason about the reassembly state machine’s happy path. They only need one mismatched length prefix and an oversized payload, both of which are unauthenticated bytes on the wire. The patch’s 0x400 caps and RtlUIntAdd guards neutralize every path that previously let the copy size or the accumulated count escape the buffer bound.
Pre patch functions
Full decompilation of FseProcessIncomingMessages before the patch:
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
undefined8 FseProcessIncomingMessages(longlong param_1,longlong param_2)
{
longlong lVar1;
void *pvVar2;
undefined8 uVar3;
uint uVar4;
uint *_Src;
uint uVar5;
size_t _Size;
int iVar6;
ulonglong _Size_00;
undefined1 auStack_a8 [32];
uint local_88;
undefined8 local_68;
undefined8 uStack_60;
ulonglong local_48;
local_48 = __security_cookie ^ (ulonglong)auStack_a8;
_Src = *(uint **)(param_1 + 0x30);
uVar5 = *(uint *)(param_2 + 0x38);
_Size = (size_t)uVar5;
lVar1 = *(longlong *)(*(longlong *)(param_1 + 0x20) + 0xa8);
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(4 < (byte)WPP_GLOBAL_Control[0x29])) {
local_88 = uVar5;
WPP_SF__guid_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x24,
&WPP_ac8b62d4254a334b4d08bba9079ab535_Traceguids,lVar1 + 0x18);
}
uVar4 = *(uint *)(lVar1 + 0x488);
if (uVar4 == 0) {
LAB_0:
uVar5 = (uint)_Size;
while (uVar5 != 0) {
uVar5 = (uint)_Size;
if ((uVar5 < 0x21) || (uVar5 < *_Src)) {
memmove((void *)(lVar1 + 0x88),_Src,_Size);
*(uint *)(lVar1 + 0x488) = uVar5;
return 1;
}
FseProcessIncomingMessage(lVar1,_Src);
uVar4 = *_Src;
_Src = (uint *)((longlong)_Src + (ulonglong)uVar4);
uVar5 = uVar5 - uVar4;
_Size = (size_t)uVar5;
}
}
else {
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(4 < (byte)WPP_GLOBAL_Control[0x29])) {
WPP_SF__guid_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25,
&WPP_ac8b62d4254a334b4d08bba9079ab535_Traceguids,lVar1 + 0x18);
uVar4 = *(uint *)(lVar1 + 0x488);
}
if (uVar4 < 4) {
_Size_00 = (ulonglong)uVar4;
if (uVar5 < 0x20 - uVar4) {
memmove((void *)(lVar1 + 0x88 + _Size_00),_Src,_Size);
*(int *)(lVar1 + 0x488) = *(int *)(lVar1 + 0x488) + uVar5;
if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return 1;
}
if ((byte)WPP_GLOBAL_Control[0x29] < 5) {
return 1;
}
uVar3 = 0x28;
}
else {
local_68 = 0;
uStack_60 = 0;
memmove(&local_68,(void *)(lVar1 + 0x88),_Size_00);
memmove((void *)((longlong)&local_68 + _Size_00),_Src,(ulonglong)(0x20 - uVar4));
iVar6 = (int)local_68;
if (0x3df < (int)local_68 - 0x21U) {
if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return 0;
}
if ((byte)WPP_GLOBAL_Control[0x29] < 2) {
return 0;
}
uVar3 = 0x29;
local_88 = (int)local_68;
goto LAB_1;
}
pvVar2 = (void *)(lVar1 + 0x88 + _Size_00);
if ((int)local_68 - uVar4 <= uVar5) {
memmove(pvVar2,_Src,(ulonglong)((int)local_68 - uVar4));
goto LAB_2;
}
memmove(pvVar2,_Src,_Size);
*(int *)(lVar1 + 0x488) = *(int *)(lVar1 + 0x488) + uVar5;
if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return 1;
}
if ((byte)WPP_GLOBAL_Control[0x29] < 5) {
return 1;
}
uVar3 = 0x2a;
}
}
else {
iVar6 = *(int *)(lVar1 + 0x88);
if (0x3df < iVar6 - 0x21U) {
if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return 0;
}
if ((byte)WPP_GLOBAL_Control[0x29] < 2) {
return 0;
}
uVar3 = 0x26;
local_88 = iVar6;
LAB_1:
WPP_SF__guid_DDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar3);
return 0;
}
pvVar2 = (void *)(lVar1 + 0x88 + (ulonglong)uVar4);
if (iVar6 - uVar4 <= uVar5) {
memmove(pvVar2,_Src,(ulonglong)(iVar6 - uVar4));
LAB_2:
_Src = (uint *)((longlong)_Src + (ulonglong)(uint)(iVar6 - *(int *)(lVar1 + 0x488)));
_Size = (size_t)(uVar5 + (*(int *)(lVar1 + 0x488) - iVar6));
FseProcessIncomingMessage(lVar1,lVar1 + 0x88,iVar6);
*(undefined4 *)(lVar1 + 0x488) = 0;
goto LAB_0;
}
memmove(pvVar2,_Src,_Size);
*(int *)(lVar1 + 0x488) = *(int *)(lVar1 + 0x488) + uVar5;
if ((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) {
return 1;
}
if ((byte)WPP_GLOBAL_Control[0x29] < 5) {
return 1;
}
uVar3 = 0x27;
}
WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar3,
&WPP_ac8b62d4254a334b4d08bba9079ab535_Traceguids);
}
return 1;
}
Post patch functions
Full decompilation of FseProcessIncomingMessages after the patch:
/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
undefined8 FseProcessIncomingMessages(longlong param_1,longlong param_2)
{
longlong lVar1;
int iVar2;
int iVar3;
size_t _Size;
void *_Dst;
ulonglong uVar4;
undefined8 uVar5;
uint uVar6;
undefined8 uVar7;
uint uVar8;
size_t _Size_00;
undefined *puVar9;
uint *_Src;
undefined1 auStack_a8 [32];
uint local_88;
uint local_68 [2];
int local_60 [8];
ulonglong local_40;
local_40 = __security_cookie ^ (ulonglong)auStack_a8;
_Src = *(uint **)(param_1 + 0x30);
uVar8 = *(uint *)(param_2 + 0x38);
_Size_00 = (size_t)uVar8;
lVar1 = *(longlong *)(*(longlong *)(param_1 + 0x20) + 0xa8);
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(4 < (byte)WPP_GLOBAL_Control[0x29])) {
local_88 = uVar8;
WPP_SF__guid_d(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x24,
&WPP_bc8d3dbf0274335cb22dd3f8ccf775cf_Traceguids,lVar1 + 0x18);
}
_Size = (size_t)*(uint *)(lVar1 + 0x488);
if (*(uint *)(lVar1 + 0x488) == 0) {
LAB_0:
if ((int)_Size_00 != 0) {
LAB_1:
uVar8 = (uint)_Size_00;
if (uVar8 < 0x21) {
Feature_98821435__private_IsEnabledDeviceUsage();
}
else {
if (*_Src <= uVar8) {
FseProcessIncomingMessage(lVar1,_Src);
uVar6 = *_Src;
_Src = (uint *)((longlong)_Src + (ulonglong)uVar6);
uVar8 = uVar8 - uVar6;
_Size_00 = (size_t)uVar8;
if (uVar8 == 0) goto LAB_2;
goto LAB_1;
}
iVar3 = Feature_98821435__private_IsEnabledDeviceUsage();
if (iVar3 == 0) goto LAB_3;
uVar6 = *_Src;
if ((0x400 < uVar6) || (0x400 < uVar8)) {
if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_4;
uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18);
uVar7 = 0x30;
puVar9 = (undefined *)(ulonglong)uVar6;
local_88 = uVar6;
goto LAB_5;
}
}
LAB_3:
memmove((void *)(lVar1 + 0x88),_Src,_Size_00);
*(uint *)(lVar1 + 0x488) = uVar8;
}
LAB_2:
uVar7 = 1;
}
else {
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(4 < (byte)WPP_GLOBAL_Control[0x29])) {
WPP_SF__guid_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),0x25,
&WPP_bc8d3dbf0274335cb22dd3f8ccf775cf_Traceguids,lVar1 + 0x18);
_Size = (size_t)*(uint *)(lVar1 + 0x488);
}
if ((uint)_Size < 4) {
uVar6 = 0x20 - (uint)_Size;
if (uVar8 < uVar6) {
iVar3 = Feature_98821435__private_IsEnabledDeviceUsage();
uVar4 = (ulonglong)*(uint *)(lVar1 + 0x488);
if (iVar3 != 0) {
local_68[0] = 0;
iVar3 = RtlUIntAdd(uVar4,_Size_00,local_68);
if ((iVar3 < 0) || (0x400 < local_68[0])) {
if (((undefined **)WPP_GLOBAL_Control == &WPP_GLOBAL_Control) ||
((byte)WPP_GLOBAL_Control[0x29] < 2)) goto LAB_4;
uVar7 = 0x29;
LAB_6:
local_88 = (int)uVar4 + uVar8;
uVar5 = *(undefined8 *)(WPP_GLOBAL_Control + 0x18);
puVar9 = WPP_GLOBAL_Control;
LAB_5:
WPP_SF__guid_DD(uVar5,uVar7,puVar9,lVar1 + 0x18);
goto LAB_4;
}
}
memmove((void *)(lVar1 + 0x88 + uVar4),_Src,_Size_00);
*(int *)(lVar1 + 0x488) = *(int *)(lVar1 + 0x488) + uVar8;
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(4 < (byte)WPP_GLOBAL_Control[0x29])) {
uVar7 = 0x2a;
LAB_7:
WPP_SF_(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar7,
&WPP_bc8d3dbf0274335cb22dd3f8ccf775cf_Traceguids);
}
goto LAB_2;
}
local_60[0] = 0;
local_60[1] = 0;
local_60[2] = 0;
local_60[3] = 0;
memmove(local_60,(void *)(lVar1 + 0x88),_Size);
memmove((void *)((longlong)local_60 + _Size),_Src,(ulonglong)uVar6);
iVar2 = Feature_98821435__private_IsEnabledDeviceUsage();
iVar3 = local_60[0];
if (iVar2 == 0) {
if (local_60[0] - 0x21U < 0x3e0) goto LAB_8;
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(1 < (byte)WPP_GLOBAL_Control[0x29])) {
uVar7 = 0x2c;
local_88 = local_60[0];
goto LAB_9;
}
}
else {
if (local_60[0] - 0x21U < 0x3e0) {
LAB_8:
uVar6 = local_60[0] - *(uint *)(lVar1 + 0x488);
if (uVar8 < uVar6) {
iVar3 = Feature_98821435__private_IsEnabledDeviceUsage();
uVar4 = (ulonglong)*(uint *)(lVar1 + 0x488);
if (iVar3 != 0) {
local_68[0] = 0;
iVar3 = RtlUIntAdd(uVar4,_Size_00,local_68);
if ((iVar3 < 0) || (0x400 < local_68[0])) {
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(1 < (byte)WPP_GLOBAL_Control[0x29])) {
uVar7 = 0x2d;
goto LAB_6;
}
goto LAB_4;
}
}
memmove((void *)(lVar1 + 0x88 + uVar4),_Src,_Size_00);
*(int *)(lVar1 + 0x488) = *(int *)(lVar1 + 0x488) + uVar8;
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(4 < (byte)WPP_GLOBAL_Control[0x29])) {
uVar7 = 0x2e;
goto LAB_7;
}
goto LAB_2;
}
memmove((void *)(lVar1 + 0x88 + (ulonglong)*(uint *)(lVar1 + 0x488)),_Src,(ulonglong)uVar6
);
goto LAB_10;
}
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(1 < (byte)WPP_GLOBAL_Control[0x29])) {
uVar7 = 0x2b;
local_88 = local_60[0];
goto LAB_9;
}
}
}
else {
iVar3 = *(int *)(lVar1 + 0x88);
iVar2 = Feature_98821435__private_IsEnabledDeviceUsage();
if (iVar2 == 0) {
if (iVar3 - 0x21U < 0x3e0) goto LAB_11;
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(1 < (byte)WPP_GLOBAL_Control[0x29])) {
uVar7 = 0x27;
local_88 = iVar3;
goto LAB_9;
}
}
else {
if (iVar3 - 0x21U < 0x3e0) {
LAB_11:
_Dst = (void *)(lVar1 + 0x88 + (ulonglong)*(uint *)(lVar1 + 0x488));
uVar6 = iVar3 - *(uint *)(lVar1 + 0x488);
if (uVar6 <= uVar8) {
memmove(_Dst,_Src,(ulonglong)uVar6);
LAB_10:
_Src = (uint *)((longlong)_Src + (ulonglong)(uint)(iVar3 - *(int *)(lVar1 + 0x488)));
_Size_00 = (size_t)(uVar8 + (*(int *)(lVar1 + 0x488) - iVar3));
FseProcessIncomingMessage(lVar1,lVar1 + 0x88,iVar3);
*(undefined4 *)(lVar1 + 0x488) = 0;
goto LAB_0;
}
memmove(_Dst,_Src,_Size_00);
*(int *)(lVar1 + 0x488) = *(int *)(lVar1 + 0x488) + uVar8;
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(4 < (byte)WPP_GLOBAL_Control[0x29])) {
uVar7 = 0x28;
goto LAB_7;
}
goto LAB_2;
}
if (((undefined **)WPP_GLOBAL_Control != &WPP_GLOBAL_Control) &&
(1 < (byte)WPP_GLOBAL_Control[0x29])) {
uVar7 = 0x26;
local_88 = iVar3;
LAB_9:
WPP_SF__guid_DDD(*(undefined8 *)(WPP_GLOBAL_Control + 0x18),uVar7);
}
}
}
LAB_4:
uVar7 = 0;
}
return uVar7;
}
Full decompilation of Feature_98821435__private_IsEnabledDeviceUsage after the patch:
ulonglong Feature_98821435__private_IsEnabledDeviceUsage(void)
{
ulonglong uVar1;
if ((Feature_98821435__private_featureState & 0x10) == 0) {
uVar1 = Feature_98821435__private_IsEnabledFallback(Feature_98821435__private_featureState,3);
}
else {
uVar1 = (ulonglong)(Feature_98821435__private_featureState & 1);
}
return uVar1;
}