From b9d820639c2a4965b0cbd8f40436e908bc79fa2d Mon Sep 17 00:00:00 2001
From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Date: Mon, 2 Nov 2026 09:54:22 -0800
Subject: [PATCH] fix(audit): keep coverage unknown for a PE header past the
 probe

A packaged member whose PE signature lies beyond the probe prefix stayed
unclassified, so the embedded-package probe never ran and coverage stayed
complete. A map inside such an image then read as not_observed.

Record the member as an unexamined package where it is already marked as
a possible native image.
---
 src/artifacts/ReleaseExposureReader.test.ts | 1 +
 src/artifacts/ReleaseExposureReader.ts      | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/artifacts/ReleaseExposureReader.test.ts b/src/artifacts/ReleaseExposureReader.test.ts
index c7d973d35a..758f9c8c1e 100644
--- a/src/artifacts/ReleaseExposureReader.test.ts
+++ b/src/artifacts/ReleaseExposureReader.test.ts
@@ -2147,6 +2147,7 @@ describe("ReleaseExposureReader unexpanded packages", () => {
     expect(scanned.omitted).toContainEqual(
       expect.objectContaining({ subject: PACKAGED_NATIVE_IMAGES, count: 1 }),
     );
+    expect(scanned.coverage).toBe("unknown");
   });
 });
 
diff --git a/src/artifacts/ReleaseExposureReader.ts b/src/artifacts/ReleaseExposureReader.ts
index c68c777da4..d45113dbc0 100644
--- a/src/artifacts/ReleaseExposureReader.ts
+++ b/src/artifacts/ReleaseExposureReader.ts
@@ -1557,9 +1557,11 @@ const examinePackagedBinary = async (
       windows.state === "signature-needed" ||
       (windows.state === "candidate" && windows.signature === "unobserved")
     ) {
-      // The image may be native, so it stays unexamined by the on-disk readers.
+      // The image may be native, so it stays unexamined by the on-disk readers,
+      // and it may carry a package that nothing here can clear.
       state.packagedNative += 1;
       notePeNotExamined(state, member.location);
+      noteUnexaminedPackage(state);
     }
   }
   if (native === null && header !== null && holdsAsarHeader(header)) {