On Android 17 builds from September 2026, wcscspn() and wcspbrk() treat every wchar_t >= 0x100 as a match when the reject set has two or more characters all < U+0100. This breaks wide string scanning for ASCII delimiters like newlines once text contains emoji, CJK, Cyrillic, Greek or Latin Extended characters. The bug stems from a 256-byte lookup table implementation that stops scanning upon encountering any character beyond U+00FF, incorrectly reporting it as a match.
Devices running the September 2026 builds are affected, including Pixel 7 and Pixel 8a, while Nothing Phone 2 on Android 16 remains unaffected. The regression was introduced between the June 2026 public sources and the September builds. The issue impacts real-world applications such as Visual Pinball, where emoji in VBScript comments cause the lexer to misidentify line ends, and file path handling treats characters >= U+0100 as wildcard patterns.
A test case like EXPECT_EQ(3u, wcscspn(L"a\u0100b\n", L"x\n")) would expose the defect. The Android public sources from June 2026 build correct wcscspn/wcspbrk from external/llvm-libc, confirming the regression occurred in the September libc.so update.
Source: Hacker News · Summarized by HeadlinesBriefing