security-review 2026-08-15 findings 1, 2, 13. The Moonlight-compat plane bound
its UDP video/audio endpoints to the first datagram from anyone and let any ENet
peer keep a connection (pinning per-peer reassembly memory) — the peer_ip the
RTSP/launch planes already enforce was never threaded to the media/control
sockets.
- stream.rs/audio.rs: the video/audio endpoint learn now discards datagrams whose
source IP is not the launch owner's until the 10s budget is spent, so an
off-path LAN peer can no longer win the endpoint race and be handed the
(plaintext) video stream.
- control.rs: an OwnerFilteredSocket drops non-owner datagrams before ENet
allocates any per-peer state (closes the ~32 MiB x peer_limit pin and the
source-spoof injection variant), and the Event::Receive arm now honors only the
tracked session peer's input as defense-in-depth.
GameStream is runtime opt-in and off in the shipped unit, so this is deferrable
but the code's own comments claimed a peer bind already protected these paths.
enricobuehler
6b3e793b39