<html>
<head>
<style>
@charset "UTF-8";
/**
box-shadow: 0px -2px 8px 0px rgba(0, 0, 0, 0.08), \u20280px 4px 8px 0px rgba(0, 0, 0, 0.08);
box-shadow: 0px -4px 16px 0px rgba(0, 0, 0, 0.08), \u20280px 8px 16px 0px rgba(0, 0, 0, 0.08);
box-shadow: 0px 0px 2px 0px rgba(0, 0, 0, 0.08) inset, \u20281px 1px 2px 0px rgba(0, 0, 0, 0.08) inset;
*/
table:not(.escaped-content) {
min-width: 75px;
border-collapse: collapse;
margin: 0;
overflow: hidden;
table-layout: fixed;
width: 100%;
}
table:not(.escaped-content) td,
table:not(.escaped-content) th {
border: 1px solid hsl(0, 0%, 70%);
border-color: var(--body-border-secondary);
box-sizing: border-box;
min-width: 1em;
padding: 6px 8px;
position: relative;
vertical-align: top;
}
table:not(.escaped-content) td > *,
table:not(.escaped-content) th > * {
margin-bottom: 0;
}
table:not(.escaped-content) th {
background-color: var(--body-bg-primary);
font-weight: bold;
text-align: left;
}
</style>
</head>
<body>
<p style="margin: 0px;">Hello!</p><p style="margin: 0px;"><br>Disclosure: This report and patch were developed by a ChatGPT AI agent. I manually sanity-checked both and manually tested the patch\u2019s effectiveness with the reader.</p><p style="margin: 0px;">On macOS, <code>scdaemon</code> resolves <code>SCardControl</code> with <code>dlsym()</code> but calls it through a seven-argument function pointer. Apple\u2019s PC/SC framework exports <code>SCardControl</code> as the legacy five-argument function; its seven-argument function is named <code>SCardControl132</code>. The header\u2019s macro mapping of <code>SCardControl</code> to <code>SCardControl132</code> does not affect a <code>dlsym()</code> lookup. OpenSC <a rel="noopener noreferrer nofollow" href="https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/reader-pcsc.c">selects </a><code>SCardControl132</code><a rel="noopener noreferrer nofollow" href="https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/reader-pcsc.c"> explicitly on macOS</a>.</p><p style="margin: 0px;"><br></p><p style="margin: 0px;">Test environment:</p><ul><li><p style="margin: 0px;">macOS 27.2 (build 26B5091g), arm64</p></li><li><p style="margin: 0px;">GnuPG 2.5.22, tested both unpatched and patched against the same reader and driver</p></li><li><p style="margin: 0px;">Cherry ST-2000 (USB 046a:003e) with an OpenPGP card, accessed through macOS PC/SC with CCID disabled in <code>scdaemon</code></p></li></ul><p style="margin: 0px;">In a read-only <code>SERIALNO openpgp</code> test, unpatched GnuPG 2.5.22 reads the card but logs:</p><pre><code>pcsc_control failed: not transacted (0x80100016)
pcsc_vendor_specific_init: GET_FEATURE_REQUEST failed: 65547</code></pre><p style="margin: 0px;">With the proposed patch, the same GnuPG version and reader complete the feature request and detect <code>FEATURE_VERIFY_PIN_DIRECT</code>. I then entered the PIN on the ST-2000 keypad, created a test signature, and verified that signature successfully. The original symptom\u2014PIN entry on the Mac instead of the reader\u2014was also observed with MacGPG 2.2.44.</p><p style="margin: 0px;">Proposed patch against GnuPG 2.5.22:</p><pre><code>--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -1182,7 +1182,13 @@
pcsc_end_transaction = dlsym (handle, "SCardEndTransaction");
pcsc_transmit = dlsym (handle, "SCardTransmit");
pcsc_set_timeout = dlsym (handle, "SCardSetTimeout");
+#ifdef __APPLE__
+ /* The 7-argument PC/SC API is exported under this name on macOS.
+ * SCardControl is the incompatible, older 5-argument API. */
+ pcsc_control = dlsym (handle, "SCardControl132");
+#else
pcsc_control = dlsym (handle, "SCardControl");
+#endif
if (!pcsc_establish_context
|| !pcsc_release_context</code></pre><p style="margin: 0px;">Could you review this macOS-specific lookup? I have tested it on the environment above, but not on older macOS releases.</p><p style="margin: 0px;"><br>-- </p><div><p style="margin: 0px;">Best regards</p><p style="margin: 0px;">Mario Hoberg</p><p style="margin: 0px;"><br></p><p style="margin: 0px;">E-Mail: mario.hoberg@iserv.de</p><p style="margin: 0px;">Internet: iserv.de</p><p style="margin: 0px;"><br></p><p style="margin: 0px;">Zentrale: IServ GmbH, Vossenkamp 6, 38104 Braunschweig</p><p style="margin: 0px;"><br></p><p style="margin: 0px;">Niederlassungen:</p><p style="margin: 0px;">IServ GmbH, Girardetstr. 6, 45131 Essen</p><p style="margin: 0px;">IServ GmbH, Fanningerstraße 13, 10365 Berlin</p><p style="margin: 0px;"><br></p><p style="margin: 0px;">USt-IdNr. DE265149425 | Amtsgericht Braunschweig | HRB 201822</p><p style="margin: 0px;">Geschäftsführer: Benjamin Heindl, Martin Hüppe, Jörg Ludwig</p><p style="margin: 0px;">Grundsätze zum Datenschutz: iserv.de/privacy</p><p style="margin: 0px;"><br></p><p style="margin: 0px;">
IServ - aus der Schule für die Schule</p></div>
</body>
</html>