The Bug Is on Every Android 17 Phone, but Not in the Source Code Anyone Can See

Description and use

In Android 17, wcscspn() and wcspbrk() returned incorrect results for characters above U+0100, causing application failures. The bug was identified via a minimal reproducer, code sweep, and binary disassembly, then fixed in the source and tests updated.

Problem

Android 17’s libc functions wcscspn() and wcspbrk() returned incorrect results for inputs containing characters above U+0100, causing failures in applications such as Visual Pinball that rely on these functions.

Outcome

The bug was traced to an incorrect branch in an optimized lookup table path for wcscspn() and wcspbrk(), fixed in the libc source, and the test suite was corrected to prevent future regressions.

Workflow

• 1. Isolate the issue with a minimal C reproducer that demonstrates the incorrect return value.
• 2. Sweep the Unicode code point space to quantify affected inputs (1,111,808).
• 3. Analyze the input space to identify the boundary conditions (two or more ASCII characters in the set).
• 4. Disassemble the shipped libc.so from a Pixel 7/8a to reconstruct the optimized loop logic.
• 5. File a detailed issue on the Android NDK repository with build fingerprints and reproducer.
• 6. Verify the fix and update the test suite to assert correct behavior.

Evidence

On Android 17 builds from September 2026, two standard C functions stop working correctly: wcscspn() and wcspbrk().

Source

The existing test itself asserted the incorrect behavior. It expected wcscspn(L"he￾lo", L"lo") to return 2, when the correct answer is 3.

Source

The reporter swept every code point from U+0001 to U+10FFFF. The function returns a wrong answer for 1,111,808 of them.

Source