From efadb91914a7ba7b4e9fda8809c0c5e006963b8f Mon Sep 17 00:00:00 2001
From: Codex <codex@openai.com>
Date: Wed, 16 Sep 2026 13:09:42 +0530
Subject: [PATCH] Fix evdev capability query buffer size

EVIOCGBIT_REL requests eight output bytes. Reserve all eight so the kernel cannot overwrite adjacent stack memory during mouse discovery.
---
 src/input/mouse/linux.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/input/mouse/linux.rs b/src/input/mouse/linux.rs
index fa90a5d..580dbc6 100644
--- a/src/input/mouse/linux.rs
+++ b/src/input/mouse/linux.rs
@@ -87,8 +87,9 @@ impl RawMouseInput {
             if let Ok(file) = File::open(&path) {
                 let fd = file.as_raw_fd();
 
-                // Query REL capabilities (need at least 2 bytes for REL_WHEEL which is bit 8)
-                let mut rel_bits = [0u8; 2];
+                // EVIOCGBIT_REL encodes an 8-byte output buffer. Allocating only
+                // two bytes lets the kernel overwrite adjacent stack memory.
+                let mut rel_bits = [0u8; 8];
                 let ret = unsafe { libc::ioctl(fd, EVIOCGBIT_REL, rel_bits.as_mut_ptr()) };
 
                 if ret >= 0 {