To report an Android bug, a developer had to disassemble libc

A developer going by francisdb found a bug in bionic, Android's C library. In September 2026 builds of Android 17 (CP3A.260905.009), the functions wcscspn() and wcspbrk(), which scan a string for a given set of characters, misbehave: any character with a code point of U+0100 or higher is reported as a match whenever the search set has two or more members and all of them are below 0x100.

In practice this breaks any code that scans wide strings for ASCII delimiters — newlines, say, or wildcard characters — the moment the text contains an emoji, a CJK glyph, Cyrillic, Greek or Latin Extended. A sweep across all code points showed the bug affecting 1,111,808 characters, everything from U+0100 to U+10FFFF.

Reading the machine code

The most telling part of the story is not the bug itself but how it had to be investigated. The public android17-release sources (the June 2026 build) contain a correct version of the functions, taken from external/llvm-libc. But the devices run different code, introduced somewhere between the June and September releases — and that code simply isn't in the open sources. So the author had to disassemble libc.so straight off the device and reconstruct, from the assembly, exactly where the scanning loop wrongly stops on a character ≥ 0x100.

A Google engineer confirmed the problem and admitted the awkwardness: he was about to suggest "you know you can just look at the source," only to find the open branch too old to contain the relevant changes. On top of that, the existing test for wcscspn() turned out to be wrong itself, expecting an incorrect result.

Real-world fallout and the bigger question

Among other things, the regression stopped the Android port of Visual Pinball from loading tables: its VBScript engine used wcspbrk() to find the end of a comment line, hit an emoji instead, and reported an "invalid character." The fix downstream was to replace the calls with plain loops.

The discussion quickly spilled beyond one function. Participants noted that since Google decided to close AOSP development, a pile of issues has accumulated with no fixes and no transparency. One question was put bluntly: where is the source for Android 17 QPR1 — the version that has been running stably on Pixel for over a month? Beyond a link to the official page on AOSP changes, no clear answer has come.

Source: Hacker News