--- title: AOSP Source Releases Are So Late Developers Disassemble... description: A regression in Android 17's bionic libc (builds from September 2026, e.g. CP3A.260905.009) causes wcscspn() and wcspbrk() to incorrectly treat any wide... canonical: https://daily.dev/posts/aosp-source-releases-are-so-late-developers-disassemble-libraries-to-report-bugs-okecue09p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs | daily.dev og:description: A regression in Android 17's bionic libc (builds from September 2026, e.g. CP3A.260905.009) causes wcscspn() and wcspbrk() to incorrectly treat any wide... og:url: https://daily.dev/posts/aosp-source-releases-are-so-late-developers-disassemble-libraries-to-report-bugs-okecue09p og:image: https://api.daily.dev/og/posts/OKEcue09P.png og:image:alt: AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs **[Hacker News](https://daily.dev/sources/hn)** · 4 min read · 0 upvotes · 0 comments ## Summary A regression in Android 17's bionic libc (builds from September 2026, e.g. CP3A.260905.009) causes wcscspn() and wcspbrk() to incorrectly treat any wide character >= U+0100 as a match whenever the reject set contains two or more characters all below U+0100. This breaks code scanning wide strings for ASCII delimiters (newlines, wildcards) as soon as the text contains an emoji, CJK, Cyrillic, Greek, or Latin Extended character. The public android17-release sources from June 2026 are unaffected, meaning the bug was introduced between June and September. A disassembly of the shipped libc.so pinpoints the faulty assembly path, and a real-world break is documented in Visual Pinball's libwinevbs (Wine's vbscript engine), which stopped loading tables with emoji in comments and misidentified non-ASCII paths as wildcard patterns. A workaround was shipped downstream by replacing the calls with plain loops. A Google engineer confirmed the bug, found the existing test was flawed, and is working on a fix and backport. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does wcscspn() in Android 17 stop early when scanning a wide string containing an emoji or CJK character? Android 17 builds from September 2026 (e.g. CP3A.260905.009) contain a bionic libc regression where wcscspn() and wcspbrk() incorrectly treat any wchar_t >= U+0100 as a match whenever the reject set has two or more characters all below U+0100. The scan stops at the first non-ASCII character instead of continuing, breaking delimiter searches on strings containing emoji, CJK, Cyrillic, Greek, or Latin Extended characters. _Native Android developers chasing wide-string bugs can track bionic libc fixes and regressions like this on daily.dev._ ### Which Android 17 bionic string functions are affected by the wide-character matching bug and which are safe to use? wcscspn() and wcspbrk() are broken when their reject set has two or more members all below U+0100, while wcsspn(), wcschr(), wcsrchr(), wmemchr(), and wcsstr() behave correctly. A single-character reject set also works fine, and so does a haystack limited to U+0080-U+00FF, since the bug only triggers when the haystack contains a character at or above U+0100. _Developers auditing native code for this bionic regression can keep tabs on the fix and backport status via daily.dev._ ### Is there a known workaround for the Android 17 wcspbrk/wcscspn bug affecting non-ASCII wide strings? Yes, replacing the library calls with a plain manual loop avoids the faulty table-scan path entirely. This fix was applied downstream in libwinevbs (a Unix build of Wine's vbscript engine used by Visual Pinball on Android), shipped in pull request #41 and released in a corresponding vpinball commit, after the bug caused comments containing emoji to break VBScript parsing. _Teams patching around platform-level string bugs can follow real fixes like this libwinevbs workaround on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 106 comments across hackernews (as of 2026-10-14). **TL;DR:** The discussion barely engages with the specific bionic libc bug and instead spirals into a broader debate about Google delaying AOSP source releases, alleged motives (EU Cyber Resilience Act compliance timing), and whether Android alternatives like GrapheneOS, LineageOS, or forks are viable. **Sentiment:** 5% positive · 20% mixed · 75% skeptical **The case for** - Some note Google is still more open than Apple, shipping unlockable bootloaders and source code eventually, even if late. - A few point out AI-assisted disassembly/reverse-engineering made it possible to find and report the bug despite missing source. **The pushback** - Many suspect Google is deliberately delaying public AOSP source releases to dodge EU Cyber Resilience Act security-update obligations. - Commenters argue forking or replacing Android is impractical since alternatives lack banking/WhatsApp support due to Play Integrity attestation locking out non-Google-approved OSes. - Several note most OEMs (especially Samsung) are locking bootloaders further, making AOSP-based alternatives harder to sustain regardless of source availability. - Some doubt any community fork could keep pace with Google's resources, risking becoming an outdated, broken mess. **By community** - hackernews (heated): Discussion diverges from the bug itself into a contentious back-and-forth about Google's motives for delaying AOSP releases, EU regulation effects, and the feasibility of Android alternatives/forks. **Hottest debate:** Whether Google's slower AOSP source releases are a deliberate strategy to dodge EU Cyber Resilience Act reporting obligations or just normal engineering/partner coordination delay. **Open questions** - Does the Cyber Resilience Act's 'without undue delay' timeline actually force manufacturers to withhold source releases, or is that a misinterpretation by corporate legal teams? - Could a viable, sufficiently funded AOSP fork actually keep pace with Google's own development given the complexity of Android and NDK? **Highlights** > I can't prove it, but I still think this is (partly) due to a recent EU regulation majorly backfiring. I can't remember which one it was, but one of the recent regulations mandates that devices get updates for a certain period. Within that period a manufacturer must provide each update for all their devices in a short timeframe. The intention was to prevent flagships getting updates immediately and lower end devices having to wait months. However, due to some (also well intentioned) wording about open source, the release of the source code is counted as the first release of an update and starts the timer. I'm pretty sure Google is delaying public AOSP updates to give their partners (mainly Samsung I suppose) more time to finish building their updates on top of AOSP. > — [kodebach on hackernews · 8 comments](https://news.ycombinator.com/item?id=50083839) > It's Cyber Resilience Act (Regulation (EU) 2024/2847) - if there's a security patch that shows up in public, then the manufacturers are fined if they don't immediately roll it out as an update ("without undue delay"). I think that's the one that made a lot of OEMs pull back on opensource publishing, because their legal departments want to batch the CVE monitoring and reporting obligations into smaller batches. > — [izacus on hackernews · 3 comments](https://news.ycombinator.com/item?id=50083867) > How are /e/OS, GrapheneOS, or LineageOS alternatives? Google can kill them in an instant, they need the AOSP source to survive. > — [mrbn100ful on hackernews](https://news.ycombinator.com/item?id=50084222) > Yes, let's throw away a fully mature smartphone OS (AOSP) and replace it by something that does not even have proper app sandboxing. /s The alternative are other AOSP-based OSes like GrapheneOS and Lineage. Once they are used widely enough and funded enough, they could fork AOSP when needed. In some sense they have already soft-forked in that they use major and QPR2 releases, but put a lot of patches on top to fix issues, improve security, etc. GrapheneOS has an estimated 500,000 active installs now, apparently LineageOS has 1.4M active installs. Probably around two orders of magnitude more than traditional Linux desktop-based phones, which have been trying since, checking notes, Maemo in 2005? > — [microtonal on hackernews · 1 comments](https://news.ycombinator.com/item?id=50083786) > One character: a plain compare loop. Correct. Not surprisingly, I get slight hints of Claudism in the text. AI "opening" the source of software is one of the best things I've seen going for it so far. > — [userbinator on hackernews · 3 comments](https://news.ycombinator.com/item?id=50083614) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50083130) · 211 points · 106 comments ## Similar posts on daily.dev - [The following is a valid DOS COM executable](https://daily.dev/posts/the-following-is-a-valid-dos-com-executable-9dmiwxytc) · Lobsters · 0 upvotes · 0 comments - [C\+\+26: Standard library hardening](https://daily.dev/posts/c-26-standard-library-hardening-eykurnwet) · Sandor Dargo · 23 upvotes · 1 comments - [Full Unicode Search at 50× ICU Speed with AVX‑512](https://daily.dev/posts/full-unicode-search-at-50-icu-speed-with-avx-512-s9bwdg8zf) · Hacker News · 0 upvotes · 0 comments - [CVE-2026-46644: insecure equivalence in symfony/polyfill-intl-idn for ASCII-only xn-- labels \(Symfony Blog\)](https://daily.dev/posts/cve-2026-46644-insecure-equivalence-in-symfony-polyfill-intl-idn-for-ascii-only-xn---labels-symfon-snlmcskyi) · Symfony · 0 upvotes · 0 comments --- Tags: [#android](https://daily.dev/tags/android) [View this post on daily.dev](https://daily.dev/posts/aosp-source-releases-are-so-late-developers-disassemble-libraries-to-report-bugs-okecue09p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs","url":"https://daily.dev/posts/aosp-source-releases-are-so-late-developers-disassemble-libraries-to-report-bugs-okecue09p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aosp-source-releases-are-so-late-developers-disassemble-libraries-to-report-bugs-okecue09p"},"datePublished":"2026-10-14T07:47:30.533Z","dateModified":"2026-10-14T09:14:35.684Z","description":"A regression in Android 17's bionic libc (builds from September 2026, e.g. CP3A.260905.009) causes wcscspn() and wcspbrk() to incorrectly treat any wide...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7bd7992f887eb479d96070bdd577a355?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7bd7992f887eb479d96070bdd577a355?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aosp-source-releases-are-so-late-developers-disassemble-libraries-to-report-bugs-okecue09p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"android","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"AOSP Source Releases Are So Late Developers Disassemble Libraries to Report Bugs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aosp-source-releases-are-so-late-developers-disassemble-libraries-to-report-bugs-okecue09p#faq","mainEntity":[{"@type":"Question","name":"Why does wcscspn() in Android 17 stop early when scanning a wide string containing an emoji or CJK character?","acceptedAnswer":{"@type":"Answer","text":"Android 17 builds from September 2026 (e.g. CP3A.260905.009) contain a bionic libc regression where wcscspn() and wcspbrk() incorrectly treat any wchar_t >= U+0100 as a match whenever the reject set has two or more characters all below U+0100. The scan stops at the first non-ASCII character instead of continuing, breaking delimiter searches on strings containing emoji, CJK, Cyrillic, Greek, or Latin Extended characters. Native Android developers chasing wide-string bugs can track bionic libc fixes and regressions like this on daily.dev."}},{"@type":"Question","name":"Which Android 17 bionic string functions are affected by the wide-character matching bug and which are safe to use?","acceptedAnswer":{"@type":"Answer","text":"wcscspn() and wcspbrk() are broken when their reject set has two or more members all below U+0100, while wcsspn(), wcschr(), wcsrchr(), wmemchr(), and wcsstr() behave correctly. A single-character reject set also works fine, and so does a haystack limited to U+0080-U+00FF, since the bug only triggers when the haystack contains a character at or above U+0100. Developers auditing native code for this bionic regression can keep tabs on the fix and backport status via daily.dev."}},{"@type":"Question","name":"Is there a known workaround for the Android 17 wcspbrk/wcscspn bug affecting non-ASCII wide strings?","acceptedAnswer":{"@type":"Answer","text":"Yes, replacing the library calls with a plain manual loop avoids the faulty table-scan path entirely. This fix was applied downstream in libwinevbs (a Unix build of Wine's vbscript engine used by Visual Pinball on Android), shipped in pull request #41 and released in a corresponding vpinball commit, after the bug caused comments containing emoji to break VBScript parsing. Teams patching around platform-level string bugs can follow real fixes like this libwinevbs workaround on daily.dev."}}]} ```