Location
master/master_test.go, TestDiagnostics_requestResponseRoundTrip (around lines 339-376); also related coverage in diagnostic_test.go.
Finding
The round-trip test registers the 0x3D response through bus.Publish(lin.LINDiagResponseID, respFrame.Data) — the same enhanced-checksum path described in the companion checksum-type bug — and then only asserts on NAD, RSID, and Data equality. It never inspects the transmitted frame's ChecksumType or Checksum value. As a result the test passes even though the frame it exercises carries the wrong checksum type for a diagnostic frame, so this test currently gives false assurance for the checksum-related safety goal in the HARA. I confirmed this is still the case at current HEAD (commit 7c03bdd): no test in the package checks that a frame emitted on 0x3C or 0x3D carries the classic checksum type.
Recommendation
Add assertions that the transmitted request and response frames both have ChecksumType == lin.ClassicChecksum, and that the checksum byte matches the expected classic-checksum computation for that data. This should be tightened alongside the fix for the underlying checksum-type bug so the test actually catches a regression.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.
Location
master/master_test.go,TestDiagnostics_requestResponseRoundTrip(around lines 339-376); also related coverage indiagnostic_test.go.Finding
The round-trip test registers the 0x3D response through
bus.Publish(lin.LINDiagResponseID, respFrame.Data)— the same enhanced-checksum path described in the companion checksum-type bug — and then only asserts on NAD, RSID, and Data equality. It never inspects the transmitted frame'sChecksumTypeorChecksumvalue. As a result the test passes even though the frame it exercises carries the wrong checksum type for a diagnostic frame, so this test currently gives false assurance for the checksum-related safety goal in the HARA. I confirmed this is still the case at current HEAD (commit 7c03bdd): no test in the package checks that a frame emitted on 0x3C or 0x3D carries the classic checksum type.Recommendation
Add assertions that the transmitted request and response frames both have
ChecksumType == lin.ClassicChecksum, and that the checksum byte matches the expected classic-checksum computation for that data. This should be tightened alongside the fix for the underlying checksum-type bug so the test actually catches a regression.Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.