CouchDeck pairs a TV to a PC without anyone typing digits. The TV invents a PIN, starts pairing with the streaming host, and sends the same PIN to a small agent on the PC, which confirms it on the user’s behalf.
That’s convenient and, on its own, a hole: any device on the LAN could pair itself, forever. So confirmation only works inside a window that a human opens from the PC, capped at ten minutes, closed on the first success.
The window was implemented with the system clock. Then a live test on a freshly booted Windows machine paired a device eleven minutes after the window opened.
Windows corrects the system clock over NTP shortly after login. On that machine the clock stepped backwards by a couple of minutes after the window opened, so every later check counted less time than had really passed. The window had quietly extended itself.
The fix is one line: measure with a monotonic clock. The habit is wider: anything that gates access should run on a clock the OS won’t adjust behind your back. The window is also claimed and released around each confirmation, so two requests in the same tick can’t both pass.
Not a hard bug. But it only shows up on a real machine, right after boot, which is exactly when the installer runs.