@@ -5,6 +5,7 @@
  *      Author: tcanham
  */
 
+#include <Fw/Logger/Logger.hpp>
 #include <Fw/Types/Assert.hpp>
 #include <Os/File.hpp>
 #include <Svc/EventManager/EventManager.hpp>
@@ -66,7 +67,14 @@ void EventManager::loqQueue_internalInterfaceHandler(FwEventIdType id,
     this->m_logPacket.setLogBuffer(args);
     this->m_comBuffer.resetSer();
     Fw::SerializeStatus stat = this->m_logPacket.serializeTo(this->m_comBuffer);
-    FW_ASSERT(Fw::FW_SERIALIZE_OK == stat, static_cast<FwAssertArgType>(stat));
+    // A maximum-size LogBuffer plus the packet header can exceed the com buffer capacity.
+    // Drop the event rather than asserting, since the arguments may arrive from
+    // external sources (e.g. a hub bridging another address space).
+    if (Fw::FW_SERIALIZE_OK != stat) {
+        Fw::Logger::log("[ERROR] EventManager: dropping event 0x%x (serialize status %d)\n", static_cast<U32>(id),
+                        static_cast<I32>(stat));
+        return;
+    }
 
     if (this->isConnected_PktSend_OutputPort(0)) {
         this->PktSend_out(0, this->m_comBuffer, 0);
 
@@ -61,8 +61,9 @@ void GenericHub::bufferOutReturn_handler(FwIndexType portNum, Fw::Buffer& fwBuff
 
 void GenericHub ::cmdDispIn_handler(FwIndexType portNum, Fw::ComBuffer& data, U32 context) {
     Fw::SerializeStatus status;
-    // Buffer to send and a buffer used to write to it
-    U8 buffer[Fw::ComBuffer::SERIALIZED_SIZE];
+    // Buffer to send and a buffer used to write to it. Must hold a maximum-size
+    // command buffer (serialized without its length token) plus the context word.
+    U8 buffer[FW_COM_BUFFER_MAX_SIZE + sizeof(U32)];
 
     Fw::ExternalSerializeBuffer serializer(buffer, sizeof(buffer));
     serializer.resetSer();
 
@@ -160,6 +160,18 @@ void GenericHubTester ::test_command_dispatch() {
     ASSERT_from_cmdDispOut_SIZE(1);
     ASSERT_from_cmdDispOut(0, buffer, 279);
     clearFromPortHistory();
+
+    // A maximum-size command payload must round-trip without overflow
+    buffer.resetSer();
+    for (U32 i = 0; i < FW_COM_BUFFER_MAX_SIZE; i++) {
+        ASSERT_EQ(Fw::FW_SERIALIZE_OK, buffer.serializeFrom(static_cast<U8>(STest::Pick::any())));
+    }
+    invoke_to_cmdDispIn(0, buffer, 280);
+
+    ASSERT_from_fromBufferDriverReturn_SIZE(1);
+    ASSERT_from_cmdDispOut_SIZE(1);
+    ASSERT_from_cmdDispOut(0, buffer, 280);
+    clearFromPortHistory();
 }
 
 void GenericHubTester ::test_command_response() {
 
@@ -9,6 +9,7 @@
 #include <Svc/PrmDb/PrmDbImpl.hpp>
 
 #include <Os/File.hpp>
+#include <Os/SandboxedFile.hpp>
 #include <Utils/Hash/Hash.hpp>
 
 #include <cstdio>
@@ -54,6 +55,11 @@ void PrmDbImpl::configure(const char* file) {
     this->m_fileName = file;
 }
 
+void PrmDbImpl::configureLoadSandbox(const char* directory) {
+    FW_ASSERT(directory != nullptr);
+    this->m_sandboxDir = directory;
+}
+
 void PrmDbImpl::readParamFile() {
     // Assumed to run at initialization time
     // State should be IDLE upon entry
@@ -389,10 +395,22 @@ PrmDbImpl::PrmLoadStatus PrmDbImpl::readParamFileImpl(const Fw::StringBase& file
     FW_ASSERT(dbType == PrmDbType::DB_ACTIVE or dbType == PrmDbType::DB_STAGING);
     FW_ASSERT(fileName.length() > 0);
 
-    Fw::String dbString = getDbString(dbType);
-
-    // load file. FIXME: Put more robust file checking, such as a CRC.
+    // Commanded loads (staging) may carry a ground-supplied path; restrict them
+    // to the configured sandbox directory to prevent path traversal
+    if ((dbType == PrmDbType::DB_STAGING) && (this->m_sandboxDir.length() > 0)) {
+        Os::SandboxedFile paramFile;
+        paramFile.configure(this->m_sandboxDir.toChar());
+        return this->readParamFileWork(paramFile, fileName, dbType);
+    }
     Os::File paramFile;
+    return this->readParamFileWork(paramFile, fileName, dbType);
+}
+
+template <typename FileType>
+PrmDbImpl::PrmLoadStatus PrmDbImpl::readParamFileWork(FileType& paramFile,
+                                                      const Fw::StringBase& fileName,
+                                                      PrmDbType dbType) {
+    Fw::String dbString = getDbString(dbType);
 
     Os::File::Status stat = paramFile.open(fileName.toChar(), Os::File::OPEN_READ);
     if (stat != Os::File::OP_OK) {
 
@@ -57,6 +57,14 @@ class PrmDbImpl final : public PrmDbComponentBase {
     //!  \param file file where parameters are stored.
     void configure(const char* file);
 
+    //!  \brief PrmDb load sandbox configure method
+    //!
+    //!  Restricts the directory from which PRM_LOAD_FILE may read parameter
+    //!  files. If never called, any path is allowed (legacy behavior).
+    //!
+    //!  \param directory directory that ground-commanded parameter file loads are restricted to.
+    void configureLoadSandbox(const char* directory);
+
     //!  \brief PrmDb file read function
     //!
     //!  The readFile function reads the set of parameters from the file passed in to
@@ -84,7 +92,8 @@ class PrmDbImpl final : public PrmDbComponentBase {
 
   protected:
   private:
-    Fw::String m_fileName;  //!< filename for parameter storage
+    Fw::String m_fileName;    //!< filename for parameter storage
+    Fw::String m_sandboxDir;  //!< directory restriction for commanded file loads (empty = unrestricted)
 
     PrmDbFileLoadState m_state;  // Current file load state of the parameter database
 
@@ -117,6 +126,14 @@ class PrmDbImpl final : public PrmDbComponentBase {
     //!  \return status success (True) / failure(False)
     PrmLoadStatus readParamFileImpl(const Fw::StringBase& fileName, PrmDbType dbType);
 
+    //!  \brief Read parameter file contents through an open-capable file object
+    //!
+    //!  \param paramFile file object (Os::File or Os::SandboxedFile) to read through
+    //!  \param fileName file where parameters are stored
+    //!  \param dbType database to store the parameters in
+    template <typename FileType>
+    PrmLoadStatus readParamFileWork(FileType& paramFile, const Fw::StringBase& fileName, PrmDbType dbType);
+
     //!  \brief PrmDb parameter get handler
     //!
     //!  This function retrieves a parameter value from the loaded set of stored parameters
 
@@ -271,6 +271,22 @@ TEST(ParameterDbTest, PrmFileLoadIllegalActions) {
     tester.runPrmFileLoadIllegal();
 }
 
+TEST(ParameterDbTest, PrmFileLoadSandboxViolation) {
+    Svc::PrmDbImpl impl("PrmDbImpl");
+
+    impl.init(10, 0);
+    impl.configure("TestFile.prm");
+
+    Svc::PrmDbTester tester(impl);
+
+    tester.init();
+
+    // connect ports
+    connectPorts(impl, tester);
+
+    tester.runPrmFileLoadSandboxViolation();
+}
+
 TEST(ParameterDbTest, PrmShorterSaveDoesNotCorrupt) {
     Svc::PrmDbImpl impl("PrmDbImpl");
 
 
@@ -1130,6 +1130,40 @@ void PrmDbTester::runPrmFileLoadWithErrors() {
     EXPECT_EQ(this->m_impl.m_stagingDb->getSize(), 0);
 }
 
+void PrmDbTester::runPrmFileLoadSandboxViolation() {
+    Fw::QueuedComponentBase::MsgDispatchStatus dispatchStatus;
+
+    // Restrict commanded loads to /prm
+    this->m_impl.configureLoadSandbox("/prm");
+
+    // 1. A path escaping the sandbox must be rejected before any file I/O
+    this->clearEvents();
+    this->clearHistory();
+    this->sendCmd_PRM_LOAD_FILE(0, 10, Fw::String("/prm/../etc/passwd"), PrmDb_Merge::RESET);
+    dispatchStatus = this->m_impl.doDispatch();
+    EXPECT_EQ(dispatchStatus, Fw::QueuedComponentBase::MSG_DISPATCH_OK);
+
+    ASSERT_CMD_RESPONSE_SIZE(1);
+    ASSERT_CMD_RESPONSE(0, PrmDbImpl::OPCODE_PRM_LOAD_FILE, 10, Fw::CmdResponse::EXECUTION_ERROR);
+    ASSERT_EVENTS_PrmFileReadError_SIZE(1);
+    ASSERT_EVENTS_PrmFileReadError(0, PrmDb_PrmReadError::OPEN, 0, Os::File::OUTSIDE_SANDBOX);
+    ASSERT_EVENTS_PrmDbFileLoadFailed_SIZE(1);
+
+    // 2. A path inside the sandbox passes containment and reaches file I/O
+    this->clearEvents();
+    this->clearHistory();
+    Os::Stub::File::Test::StaticData::setNextStatus(Os::File::DOESNT_EXIST);
+    this->sendCmd_PRM_LOAD_FILE(0, 11, Fw::String("/prm/good.prm"), PrmDb_Merge::RESET);
+    dispatchStatus = this->m_impl.doDispatch();
+    EXPECT_EQ(dispatchStatus, Fw::QueuedComponentBase::MSG_DISPATCH_OK);
+
+    ASSERT_CMD_RESPONSE_SIZE(1);
+    ASSERT_CMD_RESPONSE(0, PrmDbImpl::OPCODE_PRM_LOAD_FILE, 11, Fw::CmdResponse::EXECUTION_ERROR);
+    ASSERT_EVENTS_PrmFileReadError_SIZE(1);
+    ASSERT_EVENTS_PrmFileReadError(0, PrmDb_PrmReadError::OPEN, 0, Os::File::DOESNT_EXIST);
+    Os::Stub::File::Test::StaticData::setNextStatus(Os::File::OP_OK);
+}
+
 void PrmDbTester::runPrmFileLoadIllegal() {
     Fw::QueuedComponentBase::MsgDispatchStatus dispatchStatus;
     Fw::ParamBuffer pBuff;
 
@@ -32,6 +32,7 @@ class PrmDbTester : public PrmDbGTestBase {
     void runPrmFileLoadNominal();
     void runPrmFileLoadWithErrors();
     void runPrmFileLoadIllegal();
+    void runPrmFileLoadSandboxViolation();
     void runShorterSaveDoesNotCorrupt();
 
     void runRefPrmFile();
 
@@ -246,8 +246,12 @@ void TlmChan::TlmRecv_handler(FwIndexType portNum, FwChanIdType id, Fw::Time& ti
                     entryToUse = entryToUse->next;
                 }
             } else {
-                // Make sure that we haven't run out of buckets
-                FW_ASSERT(this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)].free < TLMCHAN_HASH_BUCKETS);
+                // Out of buckets: drop the new channel rather than asserting, since
+                // telemetry IDs may arrive from external sources (e.g. a hub)
+                if (this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)].free >= TLMCHAN_HASH_BUCKETS) {
+                    this->log_WARNING_HI_TlmChanBucketPoolExhausted(id);
+                    return;
+                }
                 // add new bucket from free list
                 entryToUse = &this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)]
                                   .buckets[this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)].free++];
@@ -258,7 +262,12 @@ void TlmChan::TlmRecv_handler(FwIndexType portNum, FwChanIdType id, Fw::Time& ti
             }
         }
     } else {
-        FW_ASSERT(this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)].free < TLMCHAN_HASH_BUCKETS);
+        // Out of buckets: drop the new channel rather than asserting, since
+        // telemetry IDs may arrive from external sources (e.g. a hub)
+        if (this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)].free >= TLMCHAN_HASH_BUCKETS) {
+            this->log_WARNING_HI_TlmChanBucketPoolExhausted(id);
+            return;
+        }
         this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)].slots[index] =
             &this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)]
                  .buckets[this->m_tlmEntries[static_cast<U8>(this->m_activeBuffer)].free++];
 
@@ -12,6 +12,13 @@ module Svc {
     ) severity warning high \
     format "TlmChan epoch processing cap reached: {} entries deferred (cumulative: {})"
 
+    @ Hash bucket pool is exhausted; the new telemetry channel was dropped
+    event TlmChanBucketPoolExhausted(
+        Id: FwChanIdType @< The telemetry ID that could not be stored
+    ) severity warning high \
+    format "TlmChan bucket pool exhausted: dropping new telemetry ID 0x{x}" \
+    throttle 10
+
 #-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
 #Ports
 #-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --