[lalith-AE30]

Blue Team Patch: Generator Replay Detection

Summary

Adds Pattern 16 to detect generator-based replay attacks where:

• A generator function is defined with yield
• The generator is primed with next()
• generator.send is exposed as custom_kernel

Target Red Submission

• KG Red ID: 94
• Author: WazupSteve
• Attack: custom_kernel = g.send where g is a primed generator retaining replay state

Detection Results

>>> kg.detect_generator_replay(code)
[{'pattern': 'GENERATOR_REPLAY', 'severity': 'high', 'evidence': 'Generator-based replay attack: generator.send() exposed as callable'}]

Files Changed

• kernelguard.py: Added RE_GEN_REPLAY pattern and detect_generator_replay() function

KernelGuard-Red-Submission: 94

[github-actions]

KernelGuard Blue Evaluation

• Evaluation job: 40
• Blue submission: 29
• Result: failed
• Target red submission caught: False
• Validation suite: TP 20/20, FP 20/20
• Surgicalness score: 1.0
• Workflow run: https://github.com/SinatrasC/kernelguard/actions/runs/25227237416

[SinatrasC]

Thanks for the KernelGuard Flywheel Campaign contribution. We are not merging this narrow variant separately because the consolidated rule-family implementation in #273 is the merge path for this detector area.