drm: close the round-13 review findings

- the ABI refusal message has a branch for an unverified MINOR. It had
  only two, so a library NEWER than the pinned minor was told it
  "predates the split-capture API" - the opposite of its problem, and
  the kind of message that sends someone looking in the wrong place.
  the warn line names the accepted minor too.
- the libdrm floor no longer claims 18.04 ships 2.4.101: base bionic
  shipped 2.4.91, which is BELOW the 2.4.95 the GetFB2 API needs, and
  only the updates/HWE stack clears it. read as "18.04 with updates,
  or newer".
- the drm-build marker scan reads the staged binaries chunked inside a
  `with`, overlapping by len(marker)-1 so a marker cannot fall across
  a chunk boundary, instead of pulling a 45 MB librustdesk.so into
  memory and leaning on refcounting to close the file. verified
  against a real drm build (found) and an unrelated binary (not
  found).

build.py

@@ -655,7 +655,21 @@ def build_deb_from_folder(version, binary_folder, want_drm=False):
         marker = b'/usr/lib/rustdesk/libdrmtap.so.0'
         binaries = [p for p in glob.glob('tmpdeb/usr/share/rustdesk/lib/librustdesk.so')
                     + glob.glob('tmpdeb/usr/share/rustdesk/rustdesk') if os.path.isfile(p)]
-        if not any(marker in open(p, 'rb').read() for p in binaries):
+        def _carries_marker(path):
+            # Chunked, with an overlap of len(marker)-1 so the marker cannot be missed at a chunk
+            # boundary: librustdesk.so is ~45 MB and there is no reason to hold it all in memory,
+            # and the `with` closes deterministically instead of relying on refcounting.
+            with open(path, 'rb') as f:
+                tail = b''
+                while True:
+                    chunk = f.read(1 << 20)
+                    if not chunk:
+                        return False
+                    if marker in tail + chunk:
+                        return True
+                    tail = chunk[-(len(marker) - 1):]
+
+        if not any(_carries_marker(p) for p in binaries):
             raise Exception(
                 f'--drm was requested but the staged bundle does not look like a drm build (no '
                 f'{marker.decode()} dlopen path in {binaries or "any staged binary"}); refusing to '

docs/DRM_CAPTURE_SECURITY.md

@@ -196,9 +196,11 @@ presents) but reuses RustDesk's own hardened IPC.
   the capture runs inside the root `--service`, which already holds the
   capability it needs. Hosts without `/dev/dri` access (or where the library
   fails to load) transparently fall back to the PipeWire/portal path.
-- **Minimum libdrm: 2.4.95 (Ubuntu 18.04 or equivalent).** `libdrmtap` needs the DRM
-  `GetFB2` framebuffer API (libdrm 2.4.95); Ubuntu 18.04 ships 2.4.101, so every supported
-  distribution satisfies the API floor. That is an API statement, not a binary-compatibility one:
+- **Minimum libdrm: 2.4.95.** `libdrmtap` needs the DRM `GetFB2` framebuffer API, which
+  landed in libdrm 2.4.95. Ubuntu 18.04 is the oldest distribution worth naming here, and it
+  straddles the floor: base bionic shipped 2.4.91, below it, while the updates/HWE stack
+  (2.4.101) is above — so read this as "18.04 with updates, or anything newer", not as
+  "any 18.04". That is an API statement, not a binary-compatibility one:
   the `rustdesk-unattended-wayland` deb in this repo's CI is built on an ubuntu-24.04 runner, so the
   shipped binaries carry that build host's glibc floor. Running on an older distribution means
   building the deb there (or in a matching container), which the libdrm floor above permits.

libs/scrap/src/common/drmtap_dl.rs

@@ -287,6 +287,15 @@ impl DrmtapLib {
                 let why = if major != DRMTAP_ABI_MAJOR {
                     "the struct layouts this build mirrors track the ABI major, so reading a \
                      frame descriptor through a mismatched one would mis-decode it"
+                } else if minor != DRMTAP_ABI_MINOR {
+                    // A NEWER minor lands here too, and telling its user the library "predates the
+                    // split" would send them looking for the wrong problem. Under 0.x semver the
+                    // minor is the breaking axis, and the structs this file mirrors are not frozen,
+                    // so an unverified minor could be read at the wrong offsets.
+                    "this build mirrors the struct layouts of one minor and only that one; \
+                     under 0.x semver the minor is the breaking axis, so an unverified minor \
+                     could be read at the wrong offsets. Widening it is a deliberate act, done \
+                     with the layouts re-checked field by field"
                 } else {
                     "it predates the split-capture API, so its only capture path converts \
                      in-process, which in the root service means loading the GL stack there"
@@ -294,7 +303,7 @@ impl DrmtapLib {
                 let (min_minor, min_patch) = DRMTAP_MIN_MINOR_PATCH;
                 log::warn!(
                     "libdrmtap {name} reports v{major}.{minor}.{patch}, which this build cannot \
-                     use (needs ABI major {DRMTAP_ABI_MAJOR}, at least \
+                     use (needs ABI major {DRMTAP_ABI_MAJOR}, minor {DRMTAP_ABI_MINOR}, at least \
                      v{DRMTAP_ABI_MAJOR}.{min_minor}.{min_patch}): {why}. Refusing to load; \
                      falling back to PipeWire/portal."
                 );