Or the intent is something other than what the report assumes?

Just to be clear; the (incomplete) code snippets in the report have been through a code mangler. The only names readable are of the api that is actually used.