nx_ownership_alias.nx
buildroot/runtime/nx_ownership_alias.nx
about
nx_ownership_alias.nx -- the ALIAS-SWEEP witness for LN5 (nx_ownership_gate).
`q` is a second name for one buffer. `p` is released. `q` is read anyway. A checker that marked
only the name written inside the sys_munmap would report NOTHING here -- and this is not an exotic
shape, it is what `let q = p` means. The refusal must name `q`, the name at the use, not `p`.
Under the default this compiles and runs exit 0 (64 bytes is below NXA_SMALL_MAX, so the release
is an arena no-op) -- the same false comfort the main fixture records.
license_tier: ORIGINAL No hw writes (Rule 26).
dependencies 1 imports · 0 importers
imports: nx_syscalls.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 11 | const OWN_AL_BYTES: i64 = 64 |
| 12 | const OWN_AL_MARK: i64 = 11 |
functions
| 14 | func own_alias_uaf(seed: i64) -> i64 |
| 22 | func main(argc: i64, argv: *i64) -> i64 calls 1: own_alias_uaf |