philips-tv-speicher-voll/diagnostics/vendor-bugs/PHILIPS-TECHNICAL-REPORT-EN.md

Technical report – storage exhaustion on Philips TPM191E

Executive summary

Device: Philips 43PUS7394/12, firmware TPM191E_R.211.000.103.000, Android TV 12/API 31. Three reproducible functional defects and one problematic warning policy were isolated to concrete binary methods. The dominant EPG defect has exceptionally strong evidence from a controlled live repair and a complete offline patch test. A separate confidential security finding is available on request and is not part of this package.

Impact and successful live validation

Before repair, EpgDatabase.db was 1,742,053,376 bytes and contained 3,071,250 expired schedule records. /data was 73% used and the Philips low-internal- storage warning was visible.

After a schema-identical compact replacement, the DB was initially 159,744 bytes and about 806,912 bytes after real EPG reacquisition. It contained 59 Now, 48 Next and 1,041 Schedule rows spanning 25 Aug 2026 19:00 through 1 Sep 2026 02:50; integrity_check=ok. Free /data increased by 1,701,400 KiB (1.62258 GiB), reducing use to 39%. Live TV, picture/audio, zapping, channels, favorites, Guide/Now-Next, recordings, timers and reminders were visually confirmed; the warning disappeared.

Findings and durable fixes

1. BUG-001, EPG stale cleanup (High, CONFIRMED). EpgProvider$deleteStaleDataRunnable.run() in channels.apk!/classes4.dex (code_off=0xe298c) calculates/logs a boundary but performs no mutation. The Phase 6 fix converts the millisecond clock once to the database's actual epoch-second fields and deletes scheduletable in indexed 2,000-row transactions with seven-day retention. A copy of the 1.62-GiB DB lost 3,063,863 rows, retained 7,387, shrank to 4,059,136 bytes and produced an identical no-op second run.
2. BUG-002, GEL WorkManager (Medium, CONFIRMED). GatheringService.onStartCommand (code_off=0x50bf0) appends every Intent below unique name GEL_WORK with policy 4, APPEND_OR_REPLACE. This explains the 229,453,824-byte WorkDB and long enqueue traversal. KEEP alone would lose distinct Intents. Use a bounded persistent FIFO/outbox, verified selective coalescing, one KEEP drain worker and a watchdog. The model passed 10,000+10,000 events.
3. BUG-003, USB free size zero (Medium, CONFIRMED). UsbVolumeListerImpl.getVolumes(String) in tvfw.jar (code_off=0x17b5e0) assigns size only when sys.mtk.dmremoteservice.ready=1, otherwise publishing default zero. Validate the KiB DeviceManager result and fall back to StatFs on the real mount path, publishing MiB; failures remain UNKNOWN. The offline matrix, including >2 TiB, passed.
4. DESIGN-001, storage warning policy (Medium). TVStorageMonitorService$2.run() (code_off=0x2ad380) uses fixed 500-MB/ 1-GiB thresholds and mixes capacity with eMMC lifetime. Replace it with Android volume thresholds, debounce/hysteresis/cooldown and owner-specific cleanup. Flash health must have separate maintenance wording.

Delivery boundary

Channels, GEL and TPTvService use android.uid.system and the same Philips platform signer. A /data/app update needs its private key/accepted lineage. tvfw.jar is a registered shared library requiring coherent DEX, ART/client and AVB system-image integration. The device is locked/green. Therefore the package contains validated specifications and tests, deliberately not randomly signed APKs or unsafe images. Recommended order: Philips-signed Channels update, then USB, GEL and warning policy separately with proven rollback.

Privacy-safe individual reports and hashes are in this directory; implementation and tests are under patches/.