scdaemon on macOS resolves legacy SCardControl, preventing PIN-pad use

[Mario Hoberg]

Hello!

Disclosure: This report and patch were developed by a ChatGPT AI agent. I manually sanity-checked both and manually tested the patch’s effectiveness with the reader.
On macOS, scdaemon resolves SCardControl with dlsym() but calls it through a seven-argument function pointer. Apple’s PC/SC framework exports SCardControl as the legacy five-argument function; its seven-argument function is named SCardControl132. The header’s macro mapping of SCardControl to SCardControl132 does not affect a dlsym() lookup. OpenSC selects SCardControl132 explicitly on macOS.

Test environment:


macOS 27.2 (build 26B5091g), arm64

GnuPG 2.5.22, tested both unpatched and patched against the same reader and driver

Cherry ST-2000 (USB 046a:003e) with an OpenPGP card, accessed through macOS PC/SC with CCID disabled in scdaemon
In a read-only SERIALNO openpgp test, unpatched GnuPG 2.5.22 reads the card but logs:
pcsc_control failed: not transacted (0x80100016)
pcsc_vendor_specific_init: GET_FEATURE_REQUEST failed: 65547
With the proposed patch, the same GnuPG version and reader complete the feature request and detect FEATURE_VERIFY_PIN_DIRECT. I then entered the PIN on the ST-2000 keypad, created a test signature, and verified that signature successfully. The original symptom—PIN entry on the Mac instead of the reader—was also observed with MacGPG 2.2.44.
Proposed patch against GnuPG 2.5.22:
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -1182,7 +1182,13 @@
       pcsc_end_transaction   = dlsym (handle, "SCardEndTransaction");
       pcsc_transmit          = dlsym (handle, "SCardTransmit");
       pcsc_set_timeout       = dlsym (handle, "SCardSetTimeout");
+#ifdef __APPLE__
+      /* The 7-argument PC/SC API is exported under this name on macOS.
+       * SCardControl is the incompatible, older 5-argument API.  */
+      pcsc_control           = dlsym (handle, "SCardControl132");
+#else
       pcsc_control           = dlsym (handle, "SCardControl");
+#endif

       if (!pcsc_establish_context
           || !pcsc_release_context
Could you review this macOS-specific lookup? I have tested it on the environment above, but not on older macOS releases.

-- 

Best regards
Mario Hoberg

E-Mail: mario.hoberg at iserv.de
Internet: iserv.de

Zentrale:  IServ GmbH, Vossenkamp 6, 38104 Braunschweig

Niederlassungen:
IServ GmbH, Girardetstr. 6, 45131 Essen
IServ GmbH, Fanningerstraße 13, 10365 Berlin

USt-IdNr. DE265149425 | Amtsgericht Braunschweig | HRB 201822
Geschäftsführer: Benjamin Heindl, Martin Hüppe, Jörg Ludwig
Grundsätze zum Datenschutz: iserv.de/privacy


IServ -  aus der Schule für die Schule
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20260923/09e9dc72/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gnupg-2.5.22-macos-scardcontrol132.patch
Type: text/x-diff
Size: 640 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20260923/09e9dc72/attachment.patch>