At the risk of being a little draconic, any device that receives data from sources outside a whitelist of validated origins falls under this example. In particu

At the risk of being a little draconic, any device that receives data from sources outside a whitelist of validated origins falls under this example. In particular, anything that can plug into arbitrary computers (and is therefore exposed to an arbitrary USB stack on the master side), or that receives network packets (especially from networks with relatively weak authentication/security and are therefore easy to join by malicious actors) falls under this description. Off the top of my head: fitness bracelets and the like (which can contain health or even location data, or at least data that can be partially leveraged to determine location), hardware authentication keys, wireless medical implants/devices (even if there's no opportunity for data retrieval, stack smashing is a cheap way to deny service, and I have had tons of fun debugging stack smashes...)