This repository is a host-side USB protocol simulation. Its main security-relevant boundary is the handling of untrusted USB request fields and payload lengths.
The implementation validates:
- request type
- direction
- recipient
- request lengths
- buffer capacity
- descriptor boundaries
- endpoint parameters
- HID report sizes
- CDC line-coding fields
- device state transitions
Please report security-sensitive issues privately through GitHub's security-advisory mechanism when available.
Do not publish a reproducible vulnerability before a fix and disclosure plan have been agreed.
This project does not claim to validate the security properties of a physical USB controller, PHY, DMA engine, operating-system USB stack, or hardware platform.