Devices become unusable — "Run out of weaver slots" caused by setResetPasswordToken

Question

We manage Samsung tablets with Headwind MDM Community Edition, the agent is Device Owner,
enrolled via QR code.

On MediaTek-based models (SM-X236B and SM-X230, Android 16) the device becomes unusable
after a few weeks:

- After a reboot it works normally.
- Once the screen is locked, the correct password is accepted but the device goes straight
  back to the lock screen. Forever. The password is never reported as wrong.
- The Settings app crashes whenever it asks to confirm the password (factory reset,
  change screen lock), and the user is thrown back to the launcher.
- Rebooting fixes it, until the screen is locked again.

This is the error:

    java.lang.IllegalStateException: Run out of weaver slots.
        at SyntheticPasswordManager.getNextAvailableWeaverSlot
        at SyntheticPasswordManager.createTokenBasedProtector
        at LockSettingsService.activateEscrowTokens
        at LockSettingsService.onCredentialVerified
        at LockSettingsService.doVerifyCredential

The cause is in the agent. Utils.initPasswordReset() calls dpm.setResetPasswordToken()
every single time it runs, and clearResetPasswordToken() is never called anywhere in the
app. Each call registers a new escrow token and orphans the previous one.

Every orphaned token permanently consumes one hardware Weaver slot, and these devices only
have 16. Once they run out, every password verification fails at the step right after the
password was already accepted. The exception is thrown back at whoever asked for the
verification, which is why the keyguard and Settings crash.

Devices without a Weaver HAL (Qualcomm models) are not affected. They leak just the same,
but there is no slot limit to run out of, so nothing ever breaks.

Two questions:

1. Is there any way to recover an affected device without a factory reset?
2. Could the agent call clearResetPasswordToken() before registering a new token, or skip
   registration entirely when isResetPasswordTokenActive() already returns true?

Answer 1

As far as we know. the dpm.setResetPasswordToken() call does not require clearing  password tokens if not used. The official docs says that password tokens are lost when the device reboots. So the behavior you're reporting sounds like a firmware bug (you say that it is only observed on some devices).

However you're right that it's better to avoid issuing multiple outstanding tokens.

Could you please submit this bug report here: https://github.com/h-mdm/hmdm-android/issues

We will review the issue with generating of multiple outstanding password tokens and, if confirmed, fix it in future versions of Headwind MDM.

As per the official developer docs, password tokens should be cleared by rebooting the device. However, if reboot doesn't help, unfortunately I do not know a way to recover an affected device without a factory reset.