From dad74600a1d9621c0a8443bcf98f717ec6c04922 Mon Sep 17 00:00:00 2001
From: Theo Arends <11044339+arendst@users.noreply.github.com>
Date: Fri, 16 Oct 2026 11:41:14 +0200
Subject: [PATCH] Fix possible OOB

---
 tasmota/tasmota_xdrv_driver/xdrv_15_pca9685.ino |  4 +++-
 tasmota/tasmota_xnrg_energy/xnrg_30_dummy.ino   |  4 ++--
 tasmota/tasmota_xsns_sensor/xsns_57_tsl2591.ino | 15 ++++++++++++++-
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/tasmota/tasmota_xdrv_driver/xdrv_15_pca9685.ino b/tasmota/tasmota_xdrv_driver/xdrv_15_pca9685.ino
index 4a07562df..f9aa1f11b 100644
--- a/tasmota/tasmota_xdrv_driver/xdrv_15_pca9685.ino
+++ b/tasmota/tasmota_xdrv_driver/xdrv_15_pca9685.ino
@@ -135,7 +135,9 @@ void PCA9685_SetPWM(uint8_t pin, uint16_t pwm, bool inverted) {
   } else {
     PCA9685_SetPWM_Reg(pin, 0, pwm_val);
   }
-  pca9685_pin_pwm_value[pin] = pwm_val;
+  if (pin < 16) {  // Skip 61
+    pca9685_pin_pwm_value[pin] = pwm_val;
+  }
 }
 
 bool PCA9685_Command(void) {
diff --git a/tasmota/tasmota_xnrg_energy/xnrg_30_dummy.ino b/tasmota/tasmota_xnrg_energy/xnrg_30_dummy.ino
index d12cf89df..bb88023ed 100644
--- a/tasmota/tasmota_xnrg_energy/xnrg_30_dummy.ino
+++ b/tasmota/tasmota_xnrg_energy/xnrg_30_dummy.ino
@@ -138,11 +138,11 @@ bool NrgDummyCommand(void) {
 #ifdef ESP32
     // EnergyConfig11 to 18 = Set Energy->current[channel] in A like 0.417 for 417mA
     if ((XdrvMailbox.index > 10) && (XdrvMailbox.index < ENERGY_MAX_PHASES + 10)) {
-      NrgDummy.current[XdrvMailbox.index -1] = value;
+      NrgDummy.current[XdrvMailbox.index -11] = value;
     }
     // EnergyConfig111 to 118 = Set Energy->active_power[channel] in W like 100 for 100W
     if ((XdrvMailbox.index > 110) && (XdrvMailbox.index < ENERGY_MAX_PHASES +110)) {
-      NrgDummy.power[XdrvMailbox.index -4] = value;
+      NrgDummy.power[XdrvMailbox.index -111] = value;
     }
 #endif
   }
diff --git a/tasmota/tasmota_xsns_sensor/xsns_57_tsl2591.ino b/tasmota/tasmota_xsns_sensor/xsns_57_tsl2591.ino
index 5578c7121..082051058 100644
--- a/tasmota/tasmota_xsns_sensor/xsns_57_tsl2591.ino
+++ b/tasmota/tasmota_xsns_sensor/xsns_57_tsl2591.ino
@@ -99,7 +99,14 @@ void Tsl2591Show(bool json)
 }
 
 bool tsl2591CommandSensor() {
+  // Sensor57 <timing>,<gain>
+  // Sensor57 1..4, 1..6
   bool serviced = true;
+
+  if ((XdrvMailbox.payload < 1) || (XdrvMailbox.payload > 4)) {
+    return false;
+  }
+
   char argument[XdrvMailbox.data_len];
   long value = 0;
 
@@ -108,7 +115,13 @@ bool tsl2591CommandSensor() {
   }
 
   bool any_value = (strchr(XdrvMailbox.data, ',') != nullptr);
-  if (any_value) { value = strtol(ArgV(argument, 2), nullptr, 10); }
+  if (any_value) { 
+    value = strtol(ArgV(argument, 2), nullptr, 10);
+  }
+
+  if ((value < 1) || (value > 6)) {
+    return false;
+  }
 
   tsl.setGain(gain_enum_array[XdrvMailbox.payload-1]);
   tsl.setTiming(int_enum_array[value-1]);