AxeTwoDriver-DAW is a library that audio programs load into their own process. It exchanges raw pointers with the host through unsafe code and has a registration entry point that writes to the machine's registry. Treat everything a host passes as potentially wrong.

Experimental. Only the latest release and the main branch receive fixes.

Please report privately, and give the maintainers a reasonable opportunity to investigate and release a fix before publishing details.

Use GitHub's private reporting: on the repository page open Security › Report a vulnerability (direct link). Do not open a public issue containing a working exploit.

You can expect an acknowledgement within seven days. This is a volunteer project; there is no bug bounty.

• The host boundary (src/driver.rs): a host passing null, short or stale pointers must not make the library read or write out of bounds.
• Buffers and the streaming thread (src/engine.rs): lifetime of the buffers handed to the host, and the callbacks made into it.
• Registration (src/registry.rs): it must only ever write this library's own keys.

Problems in the USB layer belong to AxeTwoDriver.