How One NUL Byte Broke Verification Across 14,994 Signed Records

A single embedded NUL byte can make a newly imported record fail a content-hash check—and, in one developer’s reported incident, leave every later record in a 14,994-message chain appearing tampered. The cause was not timestamp ordering: the database retained the byte, but the application’s readback path did not return the same value that had been hashed.

What failed—and what the error meant

Srinivas Kondepudi, who says he built the local AI-session audit log Chron, imported 33 Claude Code transcripts from his machine. He reports that they covered about 70,000 events. Verification flagged row 8842 in the largest chain, which contained 14,994 messages, with a content_hash mismatch. He says the imported records were new and had not been altered. These counts and results are his account of his own environment, not an independently reproduced finding. Kondepudi’s DEV Community account

#	Preview	Product	Price
1		FIDO U2F Security Key, Thetis [Aluminum Folding Design] Universal Two Factor Authentication USB...	$20.69	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

The distinction between a row-content error and a chain-link error mattered in this case. A content_hash mismatch meant the verifier’s content digest differed from the digest expected for that row. Kondepudi’s implementation reported a prev_hash mismatch for a broken link to the preceding row. That distinction applies to the error semantics he describes; other verification systems may label or handle failures differently.

Why timestamp ordering was a plausible false lead

Kondepudi initially suspected that imported lines had been chained in transcript order rather than sorted by timestamp. In his corpus, 11,591 lines had timestamps earlier than the line immediately before them. But that would not explain the reported error: under his verifier’s semantics, a linkage or ordering problem should surface as a prev_hash mismatch, not the observed content_hash mismatch.

#1 Best Overall

Sale

FIDO U2F Security Key, Thetis [Aluminum Folding Design] Universal Two Factor Authentication USB (Type A) for Extra Protection in Windows/Linux/Mac OS, Gmail, Facebook, Dropbox, SalesForce, GitHub

• Protect Online Account - Offer a strong factor authentication to your online account. Never lose your accounts through password theft, phishing, hacking or keylogging scams.
• Universal Compatibility - The Thetis U2F key can be used on any websites which support U2F protocol with the latest Chrome installed on your Windows, Mac OS or Linux. (Important Note: Not compatible with any email clients including Apple Mail, Mozilla Thunderbird or Microsoft Outlook)
• FIDO-U2f-Certified - Safety is our priority. Certified by world's largest Ecosystem for Standards-based, interoperable Authentication. Only support U2F protocol (No UAF or OTP). Provide low-cost and simple solution with high security.
• Extremly Durable - Designed with a 360° rotating metal cover that shields the USB connector when not in use. Also, crafted from a durable aluminum alloy to protect the Key from drops, bumps and scratches.
• Portable Design - Compact, ultra-portable design allows you to take your FIDO key anywhere you need it.

$20.69

Buy on Amazon

This is a useful debugging split: first establish whether the verifier objects to the row’s content or its relationship to the previous row. Do not infer the cause from the word “tampered” alone. Check what the specific verifier’s error means and trace the row that first fails.

How the embedded NUL changed the value

To inspect the failing record, Kondepudi compared character length, byte length and the location of a NUL using SQLite expressions. He reports that the stored value measured 298 characters and 530 bytes, with a NUL at position 299. In his test, SQLite retained the full value, but SQLite’s length() result and the JavaScript client’s string readback stopped at the embedded NUL.

That left the write and verification paths hashing different representations. The write path hashed 530 bytes. The value returned by the driver was 298 characters and 308 bytes, and hashing that readback produced a different digest. The original row could therefore fail verification even though no one had edited it after import.

The author attributes the NUL to tool output. In his corpus, one affected row among 73,526 was enough to break verification of the 14,994-event chain because subsequent rows depended on the preceding chain state. These figures describe that corpus only; they do not establish how often embedded NULs occur in other workloads or stacks.

Why changing only the hash input is not enough

Kondepudi’s rule is: “Hash what you can read back.” If the application removes or changes a byte only while computing the hash, but stores the unmodified content, the database can still return a different representation later. The hash input and the stored value would remain out of alignment.

His fix normalizes content before it enters the database, so the representation used for hashing can survive storage and readback. He says he replaces NUL and lone surrogate code units with U+FFFD rather than deleting them. This is the behavior reported for his implementation, not a universal database requirement or a guarantee that another driver will behave the same way.

What his round-trip probe found

Instead of assuming that arbitrary text survives a database client unchanged, Kondepudi tested values through a write, readback and hash comparison. In the setup he reports—@libsql/client 0.17.3 and Node 23—the results varied by character class:

• Embedded NUL: equality and hash agreement failed.
• Lone high and low surrogates: readback changed the values, but the hashes matched because the client’s UTF-8 path and Node’s encoder both substituted U+FFFD.
• Valid emoji surrogate pairs, CRLF and tab, and ESC/DEL: these survived the tested round trip.

The matching digest for lone surrogates was an outcome of the two encoders substituting the same replacement character, not a documented guarantee. Kondepudi cautions against treating that coincidence as a safe property of the stack. The report does not establish whether the behavior reproduces on other SQLite builds, drivers, platforms or newer library and runtime versions.

A practical way to investigate a content-hash failure

1. Find the first failing row. Record whether verification reports a content-hash error, a previous-hash error or another specific condition; do not treat those labels as interchangeable.
2. Inspect the stored value and its representation. Compare character length, encoded byte length and unusual code points, including embedded NULs and lone surrogates. For SQLite, use expressions appropriate to the column and SQLite build; a string-length result alone may not reveal all stored bytes.
3. Probe the complete path. Write representative edge-case strings, read them through the same client used by the verifier, and compare the returned value and digest with the canonical value used at write time.
4. Canonicalize before storage and hashing. If the readback path cannot preserve a value, define a deliberate normalization policy before persistence. Keep the stored representation and the bytes used for hashing consistent.
5. Verify the full dataset after the change. A sample can miss a rare affected row. Check every record when making an integrity claim, and report the first failing row if verification still breaks.

Kondepudi reports that reverting his normalization caused 11 of 21 tests to fail, including verification through each write path and a twelve-row chain. With the fix restored, he reports that all 21 passed. These are his project’s test results, not an independent test run or a guarantee for other configurations.

Quick Recap

SaleBestseller No. 1

FIDO U2F Security Key, Thetis [Aluminum Folding Design] Universal Two Factor Authentication USB (Type A) for Extra Protection in Windows/Linux/Mac OS, Gmail, Facebook, Dropbox, SalesForce, GitHub

$20.69

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.