The write is awaiting your permission. Please approve the write to `final_report.md` and I'll save the report. While you do that, here's what the audit produced:

---

## Audit Summary

All key findings from the scan/triage phases were verified against source files. Here's the final picture:

### P0 — Fix before next deployment (2)

| ID | Location | Issue |
|---|---|---|
| **P0-1** | `api.py:111-127` | Unauthenticated `/api/v1/claim/info` returns the AES-GCM `e2e_key` to any LAN client; unclaimed devices can be hijacked in 2 HTTP requests |
| **P0-2** | `setuid.c:104,208` + `add_user_wireguard.sh:79` | `char cmd[255]` + unchecked-length username fed to `sprintf` in SUID-root binary → stack overflow → root. Confirmed call chain via `wireguard.py:add_user()` |

### P1 — Fix this sprint (7)

| ID | Location | Issue |
|---|---|---|
| **P1-1** | `setuid.c:143` | `s > 30` allows `scommands[30]` OOB read → `popen` with garbage memory as command |
| **P1-2** | `device.py:957` | `shared_remote_key.priv` is one key for every Pod fleet-wide — one breach → fleet access |
| **P1-3** | `device.py:858-866` | Unsigned config fetch from backend — BGP/DNS hijack can redirect MQTT to attacker broker |
| **P1-4** | `forward_ports.py:40-41` | **2022 regression** — `verify=False` on HTTPS POST of `local_token` |
| **P1-5** | `messages.py:128` | `self.logger.info(clear_text)` logs decrypted E2EE plaintext |
| **P1-6** | `setup/iptables-rules` | No ip6tables rules at all; also the file is from 2016 with hardcoded IPs |
| **P1-7** | `api.py:65` | `DEBUG=True` in production Flask app |

### False Positives Closed (4)

- **#47** (`argv[7]` OOB): Not read by `sprintf` — 4-specifier format string, 5th variadic arg is `NULL` per C99
- **#7** (`sanitize_b64` strips `\n`): `\n` not in `ok_chars` → replaced with `_`
- **#19** (recovery.py debug path): `/etc/pproxy/logging.ini` is the *production* path
- **#5** (OpenVPN certname injection): Both `shlex.split`+`shell=False` (Python) and `${1//[^a-zA-Z0-9_\.]/}` (bash) protect it
