_arg7_minrepro.nx source
↩ module page · 73 lines · 2377 B
1// _arg7_minrepro.nx -- isolate the >6-argument call miscompile
2// (Jun-2 nx_compile_x86_native.elf; TLS-KDF assertion-#31 root cause
3// candidate). A 7-param function forwards its 6th + 7th params to a
4// callee; prints what arrives. Expected output: 60 70 / 61 71.
5//
6// expect_exit: 0
7// license_tier: ORIGINAL
8
9import "nx_syscalls.nx"
10
11func a7_dec(v: i64) -> i64 {
12 var av: i64 = v
13 if av < 0 {
14 let neg: *u8 = sys_mmap(8); neg[0] = 0x2D; sys_write(1, neg, 1)
15 av = 0 - av
16 }
17 if av == 0 {
18 let z: *u8 = sys_mmap(8); z[0] = 0x30; sys_write(1, z, 1)
19 }
20 if av > 0 {
21 let buf: *u8 = sys_mmap(32)
22 var pos: i64 = 0
23 var x: i64 = av
24 while x > 0 { buf[pos] = (0x30 + (x % 10)) as u8; x = x / 10; pos = pos + 1 }
25 let out: *u8 = sys_mmap(32)
26 var oi: i64 = 0
27 while oi < pos { out[oi] = buf[pos - 1 - oi]; oi = oi + 1 }
28 sys_write(1, out, pos)
29 }
30 let nl: *u8 = sys_mmap(8); nl[0] = 0x0A; sys_write(1, nl, 1)
31 return 0
32}
33
34// 2-arg sink: prints both.
35func a7_sink2(a: i64, b: i64) -> i64 {
36 a7_dec(a)
37 a7_dec(b)
38 return 0
39}
40
41// 7-param forwarder: passes its 6th and 7th params on.
42func a7_fwd7(p1: i64, p2: i64, p3: i64, p4: i64, p5: i64, p6: i64, p7: i64) -> i64 {
43 return a7_sink2(p6, p7)
44}
45
46// 7-param forwarder that ALSO makes an unrelated call first (mirrors
47// tls13_hkdf_expand_label: mmap + helper call BEFORE the forward).
48func a7_fwd7_after_call(p1: i64, p2: i64, p3: i64, p4: i64, p5: i64, p6: i64, p7: i64) -> i64 {
49 let scratch: *u8 = sys_mmap(16)
50 scratch[0] = 1 as u8
51 return a7_sink2(p6, p7)
52}
53
54// 7-arg sink: prints its 7th arg (the stack-passed one).
55func a7_sink7(p1: i64, p2: i64, p3: i64, p4: i64, p5: i64, p6: i64, p7: i64) -> i64 {
56 a7_dec(p7)
57 return p7
58}
59
60// THE defect shape: a TAIL CALL (`return f(...)`) to a >6-arg callee.
61// Jun-2 compiler emits frame-pop + jmp and DROPS the stack-passed
62// 7th argument (proven on tls13_derive_secret -> tls13_hkdf_expand_label).
63func a7_tail7(x: i64) -> i64 {
64 return a7_sink7(1, 2, 3, 4, 5, 6, x)
65}
66
67func main() -> i64 {
68 a7_fwd7(10, 20, 30, 40, 50, 60, 70)
69 a7_fwd7_after_call(11, 21, 31, 41, 51, 61, 71)
70 let r: i64 = a7_tail7(777) // expect 777; miscompile yields garbage
71 if r != 777 { return 9 } // gate-row contract: nonzero = REGRESSED
72 return 0
73}