nx_boundscheck.nx

nx_boundscheck.nx -- LN3 RAW-POINTER PROVENANCE fixture organ (lang.plan rung LN3, watch symbol bck_ptr_provenance on /compare/lang row "Raw-pointer access prevented"). WHAT THIS IS. The runnable witness for the compiler's --ptrprov declared mode: a `let`-bound sys_mmap(<const>) pointer's indexing is bounds-checked like a typed array (nx_parse.nx, the LN3 block). Each phase is selected by argv so a single trap ends exactly one phase and the gate (nx_boundscheck_gate) can assert every outcome independently: nx_boundscheck ok in-range read+write+alias walk -> exit 0 under BOTH modes (the positive control: a deny mode that refuses everything fails here) nx_boundscheck read the 2026-07-08 READ-TO-NUL class (CWE-125): a scan with no length bound walks off a 64-byte allocation. Default build: the over-read SURVIVES on arena/page slack (exit 0 -- reading bytes that belong to a NEIGHBORING allocation, the silent-wrong-answer this rung exists to kill). --ptrprov build: traps exit 71 (NX_TRAP_BOUNDS) at index 64. nx_boundscheck write CWE-787, the corruption primitive: s[10] on a 10-element allocation. Default: lands in slack, exit 0. --ptrprov: traps exit 71. The sibling witness nx_boundscheck_constidx.nx carries the COMPILE-TIME leg (a constant out-of-range index refused before any binary exists). license_tier: ORIGINAL No hw writes (Rule 26).