@@ -763,7 +763,7 @@ void Test_TuyaMCU_Robustness() {
763763 // -----------------------------------------------------------------------
764764 // Part 1: Truncated STATE packet (v3, cmd 0x07)
765765 //
766- // Malformed packet: 55AA03070007010200040000172F
766+ // Malformed packet: 55AA030700070102000400001730
767767 // version=3, cmd=STATE(0x07), payload_len=7
768768 // payload: dpId=1 type=2(value) sectorLen=4, data bytes present=3
769769 // remaining after header = 3, so 4 > 3 => guard fires, break.
@@ -777,7 +777,7 @@ void Test_TuyaMCU_Robustness() {
777777 SELFTEST_ASSERT_CHANNEL (20 , 99 );
778778
779779 // inject the truncated STATE packet
780- CMD_ExecuteCommand ("uartFakeHex 55AA03070007010200040000172F " , 0 );
780+ CMD_ExecuteCommand ("uartFakeHex 55AA030700070102000400001730 " , 0 );
781781 Sim_RunFrames (100 , false);
782782
783783 // channel must be untouched - guard prevented parsing
@@ -791,7 +791,7 @@ void Test_TuyaMCU_Robustness() {
791791 // -----------------------------------------------------------------------
792792 // Part 2: Truncated V0 cmd 0x05 packet (no datetime prefix)
793793 //
794- // Malformed packet: 55AA000500070102000400001225
794+ // Malformed packet: 55AA000500070102000400001226
795795 // version=0, cmd=0x05(TUYA_CMD_WIFI_SELECT), payload_len=7
796796 // payload: dpId=1 type=2(value) sectorLen=4, data bytes present=3
797797 // remaining=3, guard fires.
@@ -805,7 +805,7 @@ void Test_TuyaMCU_Robustness() {
805805 SELFTEST_ASSERT_CHANNEL (21 , 77 );
806806
807807 // inject truncated V0 no-date packet
808- CMD_ExecuteCommand ("uartFakeHex 55AA000500070102000400001225 " , 0 );
808+ CMD_ExecuteCommand ("uartFakeHex 55AA000500070102000400001226 " , 0 );
809809 Sim_RunFrames (100 , false);
810810
811811 SELFTEST_ASSERT_CHANNEL (21 , 77 );
@@ -818,7 +818,7 @@ void Test_TuyaMCU_Robustness() {
818818 // -----------------------------------------------------------------------
819819 // Part 3: Truncated V0 cmd 0x08 packet (with 7-byte datetime prefix)
820820 //
821- // Malformed packet: 55AA0008000E000000000000000102000400001C39
821+ // Malformed packet: 55AA0008000E000000000000000102000400001C3A
822822 // version=0, cmd=0x08(TUYA_CMD_QUERY_STATE), payload_len=14
823823 // 7 datetime bytes (all zero) + dpId=1 type=2(value) sectorLen=4
824824 // data bytes present=3, so remaining=3 and the guard fires.
@@ -832,7 +832,7 @@ void Test_TuyaMCU_Robustness() {
832832 SELFTEST_ASSERT_CHANNEL (22 , 55 );
833833
834834 // inject truncated V0 with-date packet
835- CMD_ExecuteCommand ("uartFakeHex 55AA0008000E000000000000000102000400001C39 " , 0 );
835+ CMD_ExecuteCommand ("uartFakeHex 55AA0008000E000000000000000102000400001C3A " , 0 );
836836 Sim_RunFrames (100 , false);
837837
838838 SELFTEST_ASSERT_CHANNEL (22 , 55 );
0 commit comments