nx_openat_probe.nx source

1// nx_openat_probe.nx -- pins the EXACT root cause of finding F1 (project-nishi-eng-findings-2026-06-23) for the 2// toolchain engineer. The symptom: a raw openat that returned fd>=0 but whose write didn't land. Isolate the two 3// suspects -- the inline `"literal" as *u8 as i64` cast vs the O_APPEND flag -- with otherwise-identical opens: 4// A: inline literal double-cast + O_APPEND B: path VARIABLE + O_APPEND C: path variable + O_TRUNC 5// Whichever opens write 1 byte tells the team precisely which axis is broken. license_tier: ORIGINAL expect_exit: 0 6import "nx_syscalls.nx" 7 8func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 9func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 10func dun(p: *u8) -> i64 { __syscall(87, p as i64, 0, 0, 0, 0, 0); return 0 } 11func bytes(p: *u8) -> i64 { let lp: *i64 = sys_mmap(8) as *i64; let d: *u8 = sys_read_file(p, lp); if (d as i64)==0 { return 0 } return lp[0] } 12 13func main(argc: i64, argv: *i64) -> i64 { 14 w("=== nx_openat_probe -- isolate F1 (inline-cast vs O_APPEND) ===\n" as *u8) 15 dun("/tmp/oap_a" as *u8); dun("/tmp/oap_b" as *u8); dun("/tmp/oap_c" as *u8) 16 17 // A: inline literal double-cast `"..." as *u8 as i64` + O_APPEND (0x441) -- the original (broken?) construction 18 let fdA: i64 = __syscall(257, 0-100, "/tmp/oap_a" as *u8 as i64, 0x441, 0x1a4, 0, 0) 19 if fdA >= 0 { sys_write(fdA, "x" as *u8, 1); sys_close(fdA) } 20 w(" A inline-cast + O_APPEND: fd="); wn(fdA); w(" bytes="); wn(bytes("/tmp/oap_a" as *u8)); w("\n" as *u8) 21 22 // B: path VARIABLE + O_APPEND (same flags, only the path expression differs) 23 let pB: *u8 = "/tmp/oap_b" as *u8 24 let fdB: i64 = __syscall(257, 0-100, pB as i64, 0x441, 0x1a4, 0, 0) 25 if fdB >= 0 { sys_write(fdB, "x" as *u8, 1); sys_close(fdB) } 26 w(" B path-var + O_APPEND: fd="); wn(fdB); w(" bytes="); wn(bytes("/tmp/oap_b" as *u8)); w("\n" as *u8) 27 28 // C: path VARIABLE + O_TRUNC (0x241) -- the proven flags; controls for O_APPEND specifically 29 let pC: *u8 = "/tmp/oap_c" as *u8 30 let fdC: i64 = __syscall(257, 0-100, pC as i64, 0x241, 0x1a4, 0, 0) 31 if fdC >= 0 { sys_write(fdC, "x" as *u8, 1); sys_close(fdC) } 32 w(" C path-var + O_TRUNC : fd="); wn(fdC); w(" bytes="); wn(bytes("/tmp/oap_c" as *u8)); w("\n" as *u8) 33 34 // D: the WIDESPREAD pattern -- store the literal-double-cast in an i64 SLOT, read it back, use as a path. 35 // If D works, the bug is specific to the DIRECT __syscall-argument position (A), not slot assignment. 36 dun("/tmp/oap_d" as *u8) 37 let arr: *i64 = sys_mmap(8) as *i64 38 arr[0] = "/tmp/oap_d" as *u8 as i64 39 let pD: *u8 = arr[0] as *u8 40 let fdD: i64 = __syscall(257, 0-100, pD as i64, 0x241, 0x1a4, 0, 0) 41 if fdD >= 0 { sys_write(fdD, "x" as *u8, 1); sys_close(fdD) } 42 w(" D slot-store->readback: fd="); wn(fdD); w(" bytes="); wn(bytes("/tmp/oap_d" as *u8)); w(" firstchar="); wn(pD[0] as i64); w(" (47='/')\n" as *u8) 43 44 w("VERDICT: bytes=1 works; A vs D tells whether the bug is __syscall-ARG-position-only or also slot assignment.\n" as *u8) 45 sys_exit(0) 46 return 0 47}