Crowdstrike did follow up with that longer root cause analysis like I said I would be watching for. It is at least more specific now. www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf
I found the typography unbearably hard to look at so I spent like ten minutes futzing around with getting the text into a font size and line length I could tolerate; if you have the same problem, allow me to summarize for you:
(edit: the report is so obtusely written that on my third attempt to read it I don't even think this is that accurate, but the numbers 20 and 21 sure are involved somehow)
Despite their insistence that there is extremely thorough automated testing of every data update, none of the tests, across multiple components, checked whether a file that is expected to have exactly 21 entries does in fact contain exactly 21 entries. (Seems like literally the first thing you'd check...?) As such, when they accidentally shipped a file with 20 entries, the driver tried to access the 21st through a wild pointer. Overly enthusiastic use of regex was involved in one of the tests. That's it, that's everything
