Validation-Execution Desynchronization in Batch Request Processors

Batch endpoints accept many sub-operations in one request and dispatch each to a handler. We characterize a defect class in which such a processor validates and executes its sub-operations in two separate passes whose correspondence is positional, so that any divergence between the two index spaces makes a later element execute under a result produced for a different element. No check is skipped: validation runs per element and reaches a correct verdict, and the failure is one of attribution. This separates the class from missing per-element authorization, whose standard remedy, adding checks inside the dispatch loop, does not apply here. We give an operational model with an explicit correspondence function and a dispatch invariant, derive three preconditions from it, and enumerate seven coupling mechanisms and four masking factors. We classify six mitigations by what they establish. Five preserve the invariant; the most intuitive one, a length assertion, establishes nothing and converts a security failure into an availability failure. To test the model we build two verifiers, a single-function pattern rule and an interprocedural query over a code property graph. Each fires exactly once on the vulnerable release of a widely deployed content management system, at the vulnerable function, and not on the patched release. Across eight PHP projects (98,783 files) the pattern rule reports 138 distinct candidate locations, of which 46 were triaged and none confirmed. The graph query, run to completion on seven of the eight and on 59% of the eighth's non-bundled files, reports one instance, a robustness defect of low security impact at a site we had first misjudged as benign. Evidence for the class is therefore one disclosed vulnerability and one low-severity instance; the contribution is the model and the mitigation analysis.