Default Is The Mitigation

A security patch closes a CVE by changing a default value rather than removing the unsafe code path. The dangerous behavior is preserved behind a flag the caller controls through the same untrusted request surface the bug was triggered through. The patched binary contains the unpatched primitive; only the value at which the primitive activates has moved. The audit-readable scope of the fix is one number; the runtime behavior depends on whether the caller supplies the toggle.