PoC - modelaudit TFLite scanner Circle (.circle) file-identifier routing gap (BL-0115)
Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.
- Scanner: modelaudit==0.2.49 [tflite extra] (tflite_scanner.py + utils/file/detection.py). Format: Circle (.circle) / TFLite.
modelaudit scan bypass_custom.circle -> Clean / exit 0: Circle is a fork of the TFLite schema; the only structural diff is the 4-byte file_identifier at bytes 4-7 (CIR0 vs TFL3). modelaudit's scanner routing AND its magic-byte format detector gate only on TFL3, so a CIR0 file carrying a custom operator is classified 'unknown' and silently skipped -> Clean. The byte-identical TFL3 file pc_custom.tflite fires CRITICAL S302 (custom operator) - positive control. boundary_tfl3.circle / boundary_cir0.tflite prove magic (not extension) gates routing.- Root cause: tflite_scanner.py:50/76-80/100-117 (can_handle TFL3 only); detection.py:277/5106-5109 (_looks_like_tflite_header = TFL3 only); core.py:7005-7008 (unknown -> Clean). Distinct from BL-0104 (a field-diff inside a scanned TFL3 file; this is routing/coverage of a sibling format).
- Benign: custom_code='evil_marker_op', no kernel shipped. Detection-evasion, not standalone RCE.
Files: bypass_custom.circle (bypass), pc_custom.tflite (fires), benign_add.tflite + boundary_*. Full report in huntr submission.
