AIKIDO-2026-663411

TL;DR

The smartcard cache request decoders accept a NULL NDR pointer for the lookup name in the read-cache and write-cache device controls and return success with a valid card identifier. When smartcard emulation is enabled, the emulated cache sink calls strlen on that NULL lookup name, terminating the client process. A peer-controlled smartcard cache request with a NULL lookup-name pointer reaches this path and crashes the client. The fix rejects a NULL lookup name during decoding and in the emulated cache handlers.