code wiki / _hdl_build / nx_probe_castmut_live.nx
nx_probe_castmut_live.nx source
↩ module page · 18 lines · 1007 B
1// nx_probe_castmut_live.nx -- RESIDUE EXPERIMENT (2026-08-05, climb v4 rung 1): does `b as i64` in
2// argument position MUTATE the local's recorded type? CONTROL (proven, nx_probe_ptrint_live.nx):
3// pi_int2(b) with NO prior cast REFUSES (`arg 1 is a POINTER but the parameter is an INTEGER`).
4// EXPERIMENT: the same pointer-into-int call placed AFTER pk_int(b as i64). If THIS FILE BUILDS,
5// the refusal vanished => the cast rewrote b's Value type to INTEGER in place, and the sys_munmap
6// arg-1 residue (57/70) is EXPLAINED: the corpus pattern is __syscall(..., req as i64, ...) followed
7// by sys_munmap(req) -- req reads as INTEGER at the later call. If it REFUSES, hypothesis dead.
8// license_tier: ORIGINAL expect_exit: 0
9import "nx_syscalls.nx"
10func pk_int(k: i64) -> i64 { return k }
11func pi_int2(k: i64) -> i64 { return k + 1 }
12func main(argc: i64, argv: *i64) -> i64 {
13 let b: *u8 = sys_mmap(64)
14 let r: i64 = pk_int(b as i64)
15 let x: i64 = pi_int2(b)
16 sys_exit(0)
17 return 0
18}