code wiki / (root) / nx_ownership_alias.nx

nx_ownership_alias.nx

buildroot/runtime/nx_ownership_alias.nx

993 B25 linesdepth 2pulls 2 transitivereach 0 importersview sourcekind tooltopic ownership
docsdependenciesstructsconstsfunctions

about

nx_ownership_alias.nx -- the ALIAS-SWEEP witness for LN5 (nx_ownership_gate). `q` is a second name for one buffer. `p` is released. `q` is read anyway. A checker that marked only the name written inside the sys_munmap would report NOTHING here -- and this is not an exotic shape, it is what `let q = p` means. The refusal must name `q`, the name at the use, not `p`. Under the default this compiles and runs exit 0 (64 bytes is below NXA_SMALL_MAX, so the release is an arena no-op) -- the same false comfort the main fixture records. license_tier: ORIGINAL No hw writes (Rule 26).

dependencies 1 imports · 0 importers

nx_syscalls.nx nx_ownership_alias.nx

imports: nx_syscalls.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main own_alias_uaf sys_mmap nxa_die sys_write sys_exit nxa_lock_take nxa_lock_addr sys_write ↻ nxa_lock_give nxa_lock_addr ↻ nxa_report_overrun sys_write ↻ nxa_dump_printable sys_write ↻ nxa_dump_sizes sys_write ↻ sys_munmap

structs

none

consts

11const OWN_AL_BYTES: i64 = 64
12const OWN_AL_MARK: i64 = 11

functions

14func own_alias_uaf(seed: i64) -> i64
called by 1: main calls 2: sys_mmapsys_munmap
22func main(argc: i64, argv: *i64) -> i64
calls 1: own_alias_uaf