Android 17 wcscspn()/wcspbrk() functions fail on wide characters >= U+0100

Critical Bug in Wide String Functions

A significant bug has been identified in the `wcscspn()` and `wcspbrk()` functions within Android 17 builds from September 2026. These functions incorrectly report a match when encountering any wide character (wchar_t) with a value greater than or equal to U+0100, even if that character is not present in the specified reject set. This behavior manifests when the reject set consists of two or more characters, all of which are less than U+0100.

Impact on Applications

The flaw directly impacts applications that scan wide strings for ASCII delimiters, such as newline or wildcard characters. Any such code will fail as soon as the string content includes non-ASCII characters like emojis, CJK characters, Cyrillic, Greek, or Latin Extended characters. This can lead to incorrect string processing and potential application errors.

Discovery Through Disassembly

The bug was discovered by developers who resorted to disassembling the `libc.so` library from shipped Android 17 builds. This method was necessary due to delays in the release of the corresponding Android Open Source Project (AOSP) source code. The disassembly revealed that the faulty logic resides in a specific code path within `wcscspn()` that handles reject sets with two or more characters, all below U+0100.

Regression Analysis

Analysis indicates that the public `android17-release` sources (version `android-17.0.0_r1`, June 2026) build `wcscspn()` and `wcspbrk()` from `external/llvm-libc`, which implements a correct plain nested loop. The problematic code path was introduced between the June and September 2026 releases of Android 17, indicating a regression in the `bionic` library.