# Release-pair benchmark: OpenWrt armsr/armv8 rootfs 23.05.4 to 23.05.5

Sample size: 1 release pair. A sample, not a rate: no detection rate and no comparison with any other tool. Intervals are Wilson score intervals; they treat each item as an independent trial, which items from one image are not, so the real uncertainty is wider.

## Held constant

- Engine: not shown: FDIE records no engine build (image built without FDIE_BUILD_SHA)
- NVD: held: the last NVD sync (2026-10-10T06:32:43.571477+00:00) precedes the first upload, so none ran during the pair
- EPSS: one EPSS snapshot in use for both; its load time is not recorded, so not shown

## OpenWrt 23.05.4 armsr-armv8 rootfs

- SHA-256 `922980e521f39f959888c994f29c47712bf5dbd086d6b99b652da2f183e5c76f`, from https://downloads.openwrt.org/releases/23.05.4/targets/armsr/armv8/openwrt-23.05.4-armsr-armv8-generic-squashfs-rootfs.img.gz
- Analysis c58732c0-9126-44da-baca-237780799261: complete (an existing analysis of the same bytes, reused); uploaded 2026-10-10T06:35:20.658979Z, last assessment written 2026-10-10T06:46:50.547590+00:00
- Extraction: 191 binaries analysed, 0 degraded; warnings: none
- Identification: 7 of 10 catalog products the release manifest lists (95% interval 40% to 89%); missed: linux_kernel, musl, ppp; found but not in the manifest: openwrt
- Versions: 3 of 3 found versions match the manifest (95% interval 44% to 100%); mismatches: none
- Runtime (tier1, run complete): 206 ELF files; not runnable on their own: Shared library 48, ELF kernel module (e_type=1) 112; runnable 46; ran 46 = finished 45 + timed out 1 (init); exit codes of finished runs: exit 1: 22, exit 0: 11, exit 255: 8, exit 127: 1, exit 2: 1, exit 16: 1, exit 3: 1
- Behaviour observations: Runtime: shell interpreter executed (/sbin/init) (LOW); Runtime: listening network service (/usr/sbin/dnsmasq) (MEDIUM)
- Findings: 451 = critical 14, high 197, medium 120, low 108, other or informational 12

## OpenWrt 23.05.5 armsr-armv8 rootfs

- SHA-256 `00bd253bfce5ea2d87c430dbbddc21528757b059d5b67b57b8f31397ddc7abbb`, from https://downloads.openwrt.org/releases/23.05.5/targets/armsr/armv8/openwrt-23.05.5-armsr-armv8-generic-squashfs-rootfs.img.gz
- Analysis f792ebb8-6dd0-4f88-96e1-65247dac909f: complete (an existing analysis of the same bytes, reused); uploaded 2026-10-10T06:46:36.530559Z, last assessment written 2026-10-10T06:55:55.190611+00:00
- Extraction: 191 binaries analysed, 0 degraded; warnings: none
- Identification: 7 of 10 catalog products the release manifest lists (95% interval 40% to 89%); missed: linux_kernel, musl, ppp; found but not in the manifest: openwrt
- Versions: 3 of 3 found versions match the manifest (95% interval 44% to 100%); mismatches: none
- Runtime (tier1, run complete): 206 ELF files; not runnable on their own: Shared library 48, ELF kernel module (e_type=1) 112; runnable 46; ran 46 = finished 45 + timed out 1 (init); exit codes of finished runs: exit 1: 22, exit 0: 11, exit 255: 8, exit 127: 1, exit 2: 1, exit 16: 1, exit 3: 1
- Behaviour observations: Runtime: shell interpreter executed (/sbin/init) (LOW); Runtime: listening network service (/usr/sbin/dnsmasq) (MEDIUM)
- Findings: 451 = critical 14, high 197, medium 120, low 108, other or informational 12

## Between the two releases

- Binaries: MODIFIED 102, UNCHANGED 89
- CVE candidates: new 0, no longer matched 0, persisting critical 6
- Patch verification: 39 rows; MODIFIED_NOT_FIXED 23, CONFIRMED_UNPATCHED 16
- firmware_v1: c58732c0-9126-44da-baca-237780799261
- firmware_v2: f792ebb8-6dd0-4f88-96e1-65247dac909f
- comparison_note: Differences compare recorded results. Static engine/feed provenance is incomplete; newly detected or missing matches do not establish a regression or verified fix. Review each assessment's settings, time and coverage.
- sbom_changes_count: 1
- sbom_added_count: 0
- sbom_removed_count: 0
- findings_delta_count: 21
- compliance_delta_count: 2
- config_changes_count: 4

## Function matching

- Changed binaries compared: 102; failures: none
- Functions in the older release: 5181; unchanged 2740, modified 11, renamed or moved 2425, added 5, removed 5
- libmbedcrypto.so.2.28.9 (was libmbedcrypto.so.2.28.8): of 758, 5 modified, 1 added, 1 removed: sub_0x34dd0, mbedtls_psa_rsa_sign_hash, mbedtls_psa_rsa_export_public_key, psa_verify_hash, psa_sign_hash
- luci.so: of 35, 1 modified, 0 added, 0 removed: sub_0x42dc
- nf_flow_table.ko: of 54, 1 modified, 0 added, 0 removed: sub_0x13154
- nf_tables.ko: of 238, 0 modified, 3 added, 3 removed
- nft_counter.ko: of 5, 1 modified, 0 added, 0 removed: sub_0x11010
- rvu_af.ko: of 381, 3 modified, 1 added, 1 removed: sub_0x20950, sub_0x2a360, sub_0x36f40