Deshittification Part 3: The Cold-Boot Consent Trap in Three Acts

by: Lari Huttunen

In my first write-up, Deshittification as a Service, I laid out a network blueprint using OpenBSD, pf and Unbound to isolate an LG Smart TV running WebOS inside a dedicated VLAN. In Part 2: Bypassing the App Store Gatekeeper, I documented how WebOS responds to telemetry blocking by locking users out of the LG Content Store with artificial error codes, effectively holding software management hostage.

Getting past the app store gatekeeper felt like a victory, but the real battle was just beginning.

Modern Smart TVs are no longer passive display devices. They are ad-delivery platforms, Automatic Content Recognition (ACR) surveillance nodes and data-broker endpoints stationed directly in living rooms. When a user attempts to reclaim network sovereignty by blocking telemetry, WebOS does not gracefully degrade. Instead, it deploys an active and stateful “Kill Switch” targeting third-party streaming applications.

This write-up uses three reproducible experiments with network captures and time-synced screenshots to examine WebOS. It breaks down how the OS weaponizes its TCP/IP stack against Netflix and explains why this conditional sabotage most likely violates GDPR Article 7(4).

Act I: Active Sabotage and Socket Termination #

In the initial test, the local Unbound DNS resolver was configured to return NXDomain for primary LG telemetry domains (wiselg.com and lgsmartad.com). The TV was powered on normally, and Netflix was launched.

Timestamp (UTC)          | Local (EEST)    | Source / Routing                    | Event / Packet Info
--------------------------------------------------------------------------------------------------------------------------------------------
2026-09-26 07:25:41.273  | 10:25:41.273    | NET: 10.2.0.1 -> 10.2.0.10          | Standard query response 0xfbc4 No such name A FI.info.lgsmartad.com
2026-09-26 07:25:55.904  | 10:25:55.904    | NET: 10.2.0.10 -> 63.35.126.25      | 35816 → 443 [FIN, ACK] Seq=1659 Ack=15997 Win=48512
2026-09-26 07:25:55.944  | 10:25:55.944    | NET: 63.35.126.25 -> 10.2.0.10      | 443 → 35816 [FIN, ACK] Seq=16028 Ack=1660 Win=40448
2026-09-26 07:25:55.946  | 10:25:55.946    | NET: 10.2.0.10 -> 63.35.126.25      | 35816 → 443 [RST] Seq=1660 Win=0 Len=0

Technical Findings #

1. Stateful Socket Tracking: WebOS does not blindly drop packets or sever routing. The OS kernel actively tracks open sockets associated with the application and reads exact TCP sequence numbers (Seq=1660) from memory to execute targeted aborts.
2. The “One-Two Punch” Mechanism: The OS initiates a socket closure via [FIN, ACK]. The millisecond the remote server acknowledges the FIN packet, WebOS fires a hard [RST] packet.
3. Zero Window Size (Win=0): The RST packet forces Win=0, signaling a hard buffer tear-down at the OS level and informing the remote endpoint that memory buffers for this socket have been forcibly stripped.

Act II: The Control Group: Compliance Restores the Pipe #

To establish absolute causality, an A/B baseline test was conducted. Telemetry domain blocks were temporarily removed from Unbound DNS, granting LG unhindered access to its ad and telemetry servers.

Timestamp (UTC)          | Local (EEST)    | Source / Routing                    | Event / Packet Info
--------------------------------------------------------------------------------------------------------------------------------------------
2026-09-26 07:51:51.797  | 10:51:51.797    | NET: 10.2.0.10 -> 23.43.20.149      | 60594 → 80 [FIN, ACK] Seq=187 Ack=144923 Win=255744
2026-09-26 07:51:51.809  | 10:51:51.809    | NET: 23.43.20.149 -> 10.2.0.10      | 80 → 60594 [FIN, ACK] Seq=144923 Ack=188 Win=65024

Technical and Visual Findings #

• Clean TCP Stack: Every [RST Win=0] abort packet disappeared from the network capture. Traffic reverted entirely to standard RFC-compliant TCP connection management ([FIN, ACK]).
• The Visual Tax: Unblocking LG immediately repopulated the WebOS Home Screen with dynamic ad banners.

In exchange for displaying ads and harvesting ACR data, WebOS permitted Netflix to stream 4K video flawlessly.

• Eliminating Alternative Hypotheses: This baseline refutes any potential defense claiming local router misconfigurations or ISP-level drops. The local network operates perfectly; application failure occurs exclusively when LG telemetry is blocked.

Act III: The Cold-Boot Consent Trap #

In the final and most conclusive test, all confounding variables were isolated:

1. “Always Ready” quick-standby mode was disabled on the TV, forcing a full cold boot on power-up.
2. All third-party domain blocks (Netflix logging endpoints, Philips Hue and others) were unblocked, leaving exclusively LG telemetry domains blocked.

Timestamp (UTC)          | Local (EEST)    | Source / Routing                    | Event / Packet Info
--------------------------------------------------------------------------------------------------------------------------------------------
2026-09-26 08:17:40.570  | 11:17:40.570    | NET: 10.2.0.1 -> 10.2.0.10          | Standard query response No such name A FI.tv.wiselg.com
2026-09-26 08:17:45.224  | 11:17:45.224    | NET: 10.2.0.10 -> 63.35.126.25      | 43208 → 443 [RST] Seq=1660 Win=0 Len=0
2026-09-26 08:18:09.951  | 11:18:09.951    | NET: 10.2.0.10 -> 45.57.36.139      | 46022 → 443 [RST] Seq=1839 Win=0 Len=0 (x32 packets)
2026-09-26 08:18:44.121  | 11:18:44.121    | FILE: IMG_5088.HEIC                 | User Action: Error "tvq-pb-101 (5.2.undefined)"

The Trap in Action #

• Pre-Emptive Watchdog Activation: On a cold boot, WebOS performs initial telemetry pre-flight checks. Receiving NXDomain responses for LG domains triggers an OS-level lockout state before Netflix is launched.
• Targeted Socket Termination: While Netflix’s own API and logging endpoints resolve and operate normally, WebOS unleashes a barrage of over 30 [RST Win=0] packets within a single second directly at active Netflix Open Connect CDN sockets (45.57.36.139).
• Application Collapse: The video stream fails to buffer a single frame, dying instantly with error tvq-pb-101 (5.2.undefined).

Legal and Technical Conclusion: GDPR Article 7(4) #

This three-act analysis demonstrates two core facts:

1. Active Sabotage vs Network Degradation: App crashes on WebOS when blocking telemetry are not caused by general network connectivity issues. The operating system deliberately weaponizes its TCP stack to abort active socket connections of targeted applications.
2. Selective Enforcement: Sabotage is selectively enforced against high-value ACR targets like Netflix, while non-commercial regional apps remain unaffected.

Article 7(4) of the General Data Protection Regulation (GDPR) prohibits conditioning the provision of a service on consent to the processing of personal data that is not necessary for the performance of that contract.

When LG hardcodes an operating system routine that actively dismantles third-party streaming connections at the socket level because a user blocks telemetry, it is not a technical glitch. It is an intentional, software-enforced consent trap.

Evidence and Artifacts #

For full transparency and independent technical audit, the sanitized analysis logs are available here:

• Act I Analysis Trace: 2026-09-26-act1-killswitch.txt
• Act II Analysis Trace: 2026-09-26-act2-baseline.txt
• Act III Analysis Trace: 2026-09-26-act3-coldboot.txt

This technical documentation, network traces and camera-captured screen artifacts have been compiled into a formal evidentiary package for submission to regulatory authorities (NOYB and national Data Protection Authorities).

Broken vendor incentives cannot be fixed through menu toggles. Holding manufacturers accountable requires authoritative network instrumentation and verifiable packet-level proof.