@@ -366,25 +366,55 @@ The original description follows.
 All are cheap to fix with `volatile`. Practical impact is low (stale reads, not corruption), but
 `isConnected()` returning `true` long after unplug is user-visible.
 
----
-
-## Open findings
+## 9. `messagePort` (remote) creation is unchecked (macOS) — **FIXED**
+
+> **Status:** Fixed on 2026-07-06. `startAsyncIOThread` now null-checks all *three* CF creations
+> that can return NULL — `CFMessagePortCreateLocal`, `CFMessagePortCreateRunLoopSource`, and
+> `CFMessagePortCreateRemote` (a NULL anywhere in the chain causes the same downstream damage,
+> e.g. when bootstrap-port registration fails in a sandboxed process) — and throws a `UsbException`
+> naming the failed call. The remote port is assigned to the `messagePort` field only after the
+> check, so `removeEventSource` can never send on a NULL port.
+>
+> The naive throw would have traded the leak for a hang: the singleton would be stuck in state
+> `STARTING` and every later `addEventSource` call would block forever in `waitForRunLoopReady`.
+> The catch block therefore releases the partially created ports (`CFRelease`; releasing the last
+> reference also invalidates the local port and deregisters its name, so a retry can recreate it)
+> and resets the state to `NOT_STARTED`, so a later `open()` retries cleanly. The exception
+> surfaces from `MacosUsbDevice.open()` before anything is registered with the run loop.
+>
+> Verified with the full hardware test suite on macOS (59 tests, all passing); the failure paths
+> themselves require injected CF failures and are verified by inspection.
 
-## 9. `messagePort` (remote) creation is unchecked (macOS)
+The original description follows.
 
 `MacosAsyncTask.java:135`: `CFMessagePortCreateRemote` can return NULL (e.g. a
 race where the local port's run-loop source isn't serviced yet).
 `removeEventSource` would then send on a NULL port and the event source would
 never be removed — a slow leak of run-loop sources. Worth asserting non-null at
 creation.
 
-## 10. Magic-number reinterpret in `loadDescription` (macOS)
+## 10. Magic-number reinterpret in `loadDescription` (macOS) — **FIXED**
+
+> **Status:** Fixed on 2026-07-06. The pointer returned by `GetConfigurationDescriptorPtr` is now
+> first reinterpreted to exactly `ConfigurationDescriptor.LAYOUT.byteSize()` (9 bytes) — the
+> minimum needed to read the header — then, after a sanity check that `wTotalLength` is at least
+> the header size (throwing a `UsbException` naming the bogus value otherwise), reinterpreted to
+> exactly `totalLength`. No magic number remains, and the view never claims memory beyond the
+> kernel buffer, which IOKit itself sized from the same `wTotalLength` field when caching the
+> descriptor. Verified with the full hardware test suite on macOS (59 tests, all passing) —
+> `loadDescription` runs during enumeration of every connected device.
+
+The original description follows.
 
 `MacosUsbDevice.java:194`: `dereference(descPtrHolder).reinterpret(999999)`
 before re-slicing to `totalLength()`. It's bounded immediately afterward so it's
 safe in practice, but the arbitrary size is fragile if a malformed descriptor
 ever reports a `totalLength` beyond the real buffer.
 
+---
+
+## Open findings
+
 ## 11. `open()` holds the device monitor across up to 4×90 ms sleeps (macOS)
 
 `MacosUsbDevice.java:103-135` is `synchronized` and sleeps while retrying
@@ -464,8 +494,7 @@ timeout rather than an infinite block).
 
 ## Recommended priority
 
-Findings 1–8 are fixed (see above). Next up: the macOS message-port null check of
-finding 9. Findings 10–12 are low-priority robustness notes.
+Findings 1–10 are fixed (see above). Findings 11–12 are low-priority robustness notes.
 
 The Linux fixes for findings 1–3 still need a hardware test run on a Linux machine, and the
 finding 7 fix a hardware regression run on Windows.
@@ -118,7 +118,8 @@ void removeEventSource(MemorySegment source) {
      */
     @SuppressWarnings("java:S125")
     private void startAsyncIOThread() {
-        MemorySegment messagePortSource;
+        MemorySegment messagePortSource = NULL;
+        MemorySegment localPort = NULL;
 
         try {
             state = TaskState.STARTING;
@@ -130,19 +131,37 @@ private void startAsyncIOThread() {
             var methodHandle = asyncIOCompletedMH.bindTo(this);
             completionUpcallStub = Linker.nativeLinker().upcallStub(methodHandle, completionHandlerFuncDesc, Arena.global());
 
-            // create local and remote message ports
+            // create local and remote message ports (all three CF creations can return NULL,
+            // e.g. if bootstrap port registration fails in a sandboxed process)
             var pid = ProcessHandle.current().pid();
             var portName = CoreFoundationHelper.createCFStringRef("net.codecrete.usb.macos.eventsource." + pid, Arena.global());
             var messagePortCallback = CFMessagePortCreateLocal$callout.allocate(this::messagePortCallback, Arena.global());
-            var localPort = CoreFoundation.CFMessagePortCreateLocal(NULL, portName, messagePortCallback, NULL, NULL);
+            localPort = CoreFoundation.CFMessagePortCreateLocal(NULL, portName, messagePortCallback, NULL, NULL);
+            if (localPort.address() == 0)
+                throw new UsbException("internal error (CFMessagePortCreateLocal failed)");
             messagePortSource = CoreFoundation.CFMessagePortCreateRunLoopSource(NULL, localPort, 0);
-            messagePort = CoreFoundation.CFMessagePortCreateRemote(NULL, portName);
+            if (messagePortSource.address() == 0)
+                throw new UsbException("internal error (CFMessagePortCreateRunLoopSource failed)");
+            var remotePort = CoreFoundation.CFMessagePortCreateRemote(NULL, portName);
+            if (remotePort.address() == 0)
+                throw new UsbException("internal error (CFMessagePortCreateRemote failed)");
+            messagePort = remotePort;
 
-        } catch (IllegalAccessException | NoSuchMethodException e) {
+        } catch (Exception e) {
+            // release partially created ports and reset the state; otherwise the task would be
+            // stuck in STARTING and all later addEventSource() calls would wait forever
+            if (messagePortSource.address() != 0)
+                CoreFoundation.CFRelease(messagePortSource);
+            if (localPort.address() != 0)
+                CoreFoundation.CFRelease(localPort);
+            state = TaskState.NOT_STARTED;
+            if (e instanceof RuntimeException runtimeException)
+                throw runtimeException;
             throw new UsbException("internal error (creating method handle)", e);
         }
 
-        var thread = new Thread(() -> asyncIOCompletionTask(messagePortSource), "USB async IO");
+        var source = messagePortSource;
+        var thread = new Thread(() -> asyncIOCompletionTask(source), "USB async IO");
         thread.setDaemon(true);
         thread.start();
     }
 
@@ -199,9 +199,14 @@ private void loadDescription(MemorySegment device) {
             if (ret != 0)
                 throwException(ret, "querying first configuration failed");
 
-            var configDesc = dereference(descPtrHolder).reinterpret(999999);
-            var configDescHeader = new ConfigurationDescriptor(configDesc);
-            configDesc = configDesc.asSlice(0, configDescHeader.totalLength());
+            // read the descriptor header with a minimally sized view first, then resize to the
+            // total length the header reports (the kernel buffer was sized from the same field)
+            var headerSize = ConfigurationDescriptor.LAYOUT.byteSize();
+            var configDescHeader = new ConfigurationDescriptor(dereference(descPtrHolder).reinterpret(headerSize));
+            var totalLength = configDescHeader.totalLength();
+            if (totalLength < headerSize)
+                throwException("invalid configuration descriptor (wTotalLength: %d)", totalLength);
+            var configDesc = dereference(descPtrHolder).reinterpret(totalLength);
 
             var configuration = setConfigurationDescriptor(configDesc);
             configurationValue = 255 & configuration.configValue();