# Title

Arm NN native deserializer uses unknown layer union discriminator as parser-table index

# Description

Arm NN commit `2b61cecc9df7a43fca1463795062cf359e6be820`
contains an out-of-bounds dispatch-table read in the native `.armnn`
deserializer.

The `DeserializerImpl` constructor creates `m_ParserFunctions` with
`Layer_MAX + 1` entries. `CreateNetworkFromGraph()` then indexes that vector
directly with the model-controlled `AnyLayer.layer_type()` union
discriminator:

```cpp
auto& parserFunction = m_ParserFunctions[layer->layer_type()];
(this->*parserFunction)(graph, layerIndex);
```

The outer FlatBuffer verifier accepts unknown enum value 123. The generated
`Layer` enum ends at `Layer_MAX`, so the lookup at
`src/armnnDeserializer/Deserializer.cpp:933` reads a member-function pointer
beyond the heap allocation.

# Reproduction

The public repository contains a deterministic one-byte differential:

- `control.armnn`: byte 763 is `0x09` (`InputLayer`)
- `trigger.armnn`: byte 763 is `0x7b` (123, outside the generated enum)
- every other byte is identical

Run:

```bash
./reproduce.sh /absolute/path/to/makemoney
```

Observed:

- control: 3/3 exit 0
- trigger: 3/3 exit 134

Representative sanitizer output:

```text
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 8
#0 armnnDeserializer::IDeserializer::DeserializerImpl::CreateNetworkFromGraph(...)
SUMMARY: AddressSanitizer: heap-buffer-overflow in ...::CreateNetworkFromGraph(...)
```

SHA-256:

```text
e1d1d9895e1629eaea453ac60cdc21cd38aef7bea9422aaefb41e23921cfd7ae  control.armnn
ff1c59432c9de9a631f1df9aab69d077d8b7a31e2e74b82aba4114da66f064bd  trigger.armnn
```

# Impact

Loading an untrusted native Arm NN model causes a load-time out-of-bounds read
from the parser member-function dispatch table and a reliable process crash.
The out-of-bounds bytes are then interpreted as a member-function pointer for
an indirect call. This report claims the demonstrated memory-safety violation
and denial of service, not code execution.

# Prior art

Authenticated and manual searches found no disclosure for
`AnyLayer.layer_type`, `m_ParserFunctions`, `CreateNetworkFromGraph`, source
line 933, the current fixture hash, or the sanitizer signature. Existing
native Arm NN reports concern different semantic fields and sinks. The TFLite
`opcode_index` finding uses a different input format, parser implementation,
dispatch table, and remediation site.

# Suggested remediation

Before the dispatch-table lookup, reject `Layer_NONE`, values greater than
`Layer_MAX`, and any union discriminator not backed by the expected table
type. The generated union verifier should also reject unknown discriminators.