docs(release): add v4.8.1 changelog for StrongBox op rejection fix

fix(interception): enforce StrongBox op limit for software-generated keys
trackAndEnforceOpLimit was only called in the Domain.KEY_ID not-found path, so software-generated keys (found via Domain.APP) bypassed the STRONGBOX_MAX_CONCURRENT_OPS=4 limit entirely. DuckDetector's concurrent signing handles test created 24+ operations that all succeeded via LRU pruning instead of being rejected with TOO_MANY_OPERATIONS (-29).
2026-03-18 03:24:58 +01:00 · 2026-03-18 03:21:34 +01:00
2 changed files with 8 additions and 0 deletions
@@ -267,6 +267,8 @@ class KeyMintSecurityLevelInterceptor(
            }
        }

+        trackAndEnforceOpLimit(callingUid, txId)?.let { return it }
+
        SystemLogger.info("[TX_ID: $txId] Creating SOFTWARE operation for uid=$callingUid.")

        val params = data.createTypedArray(KeyParameter.CREATOR)!!
@@ -1,3 +1,9 @@
+## TEESimulator-RS v4.8.1: StrongBox Op Rejection Fix
+
+- **StrongBox op limit gate fix** — `trackAndEnforceOpLimit` was only called in the `Domain.KEY_ID` not-found path, so software-generated keys (found via `Domain.APP`) bypassed `STRONGBOX_MAX_CONCURRENT_OPS=4` entirely. DuckDetector's concurrent signing handles test created 24+ operations that all succeeded via LRU pruning instead of being rejected with `TOO_MANY_OPERATIONS (-29)`. Now enforced for all StrongBox createOperation paths.
+
+---
+
 ## TEESimulator-RS v4.8: StrongBox Hardening & LRU Pruning

 Tested against DuckDetector on OnePlus (Android 16, KSU). Tamper score dropped from 32 to 8.