[cpp-RCP-01] PWM_OUT payload fields are 32-bit instead of the required 16-bit (field order is correct) #70

Location: include/rcp/pwm.hpp — PwmValue struct (~lines 55-58) and PwmOutEndpoint::handle_write.

Finding: PwmValue models both period and active_duration as uint32_t, giving an 8-byte payload. The governing spec's PWM_OUT request/response payload is a fixed 4 bytes, carried as two 16-bit values — not two 32-bit values. This implementation is therefore twice the required wire width for this endpoint's payload, which will corrupt every field on the wire against any conformant peer (fields overlap or truncate depending on how a receiver framed the payload). Separately, this header also layers GPIO's 8-way bitmask/saturating-write combinator onto PWM values via apply_bitmask_write, a write-semantics model the spec does not define for this endpoint type.

Correction to the audit's field-order claim: the audit register this was sourced from also claimed the two fields are in the wrong order (asserting the spec puts active-time before period). Having checked the actual wire-format figure in the governing specification, the on-wire order is period first, then active time — which is the same order PwmValue's two members are already declared in. So the field-order part of that claim does not hold; the real, verified defect is the field width (32-bit instead of 16-bit), not the field order. Please disregard any "swap the fields" framing if it shows up elsewhere — that would introduce a new bug, not fix one.

Recommendation: Change PwmValue to two uint16_t fields (keeping the existing period-then-active_duration order) and serialize them as two big-endian 16-bit words for a 4-byte payload; add a decode test asserting the exact 4-byte wire size. Separately reconsider whether GPIO's bitmask-write combinator belongs on PWM_OUT at all, since the spec doesn't define that semantics for this endpoint type.

Verification: Independently re-read include/rcp/pwm.hpp against current HEAD (commit 4b9449a, 2026-07-29), and cross-checked the wire format against the governing specification's PWM_OUT request-handling section and figure. Confirmed the width defect; refuted the order defect as described above.

Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.