Claude/audit ps2 spsc 20260731

docs/stability-audit-2026-07-31.md

@@ -0,0 +1,41 @@
+# DuetOS Stability Audit Ledger
+
+Status: active; static and host-side partial verification complete. Full kernel/runtime verification is pending.
+
+## Coverage
+
+- 1,777 tracked kernel/tools sources checked by the include-tracking audit.
+- Kernel passes covered architecture/core/CPU, scheduler/synchronization, memory, filesystems, networking, IPC, Linux and Win32 subsystems, drivers, loader, security, diagnostics, applications, shell, web, crypto, time, and utilities.
+- Userland passes covered native apps, libc/CRT, Win32 DLL layers, graphics DLLs, networking DLLs, smoke tests, and PE/SEH/TLS fixtures.
+- Boot coverage included UEFI source and boot metadata.
+- Rust coverage included the 27 workspace crates and their FFI boundaries; hosted `unwrap` uses found were confined to test fixtures.
+- Test assets inventoried: host tests and 35 fuzz targets/shims.
+
+## Evidence
+
+- `alloc-null-check-audit.py`: PASS.
+- `include-tracked-audit.py`: PASS for 1,777 sources.
+- `check-syscall-numbers.py`: 223 enum entries, 112 annotated sites, 274 assertions, 0 errors.
+- `invariant-check.sh`: all gating invariants pass.
+- `waitqueue-block-lock-audit.py`: 0 unguarded sites; 19 explicitly CLI-only sites; 2 spinlock untimed sites.
+- Focused syntax-only compilation and cppcheck passes cover every modified translation unit.
+- The address-space map-failure slice covered the production PE/ELF/DLL loaders, Linux `brk`/`mmap`/`mremap`/`munmap`/`mincore`, vDSO and stack growth, Win32 heap/vmap/fiber/thread allocation, and the shared page-table walker. The follow-on `mincore` validation also passed g++ C++23 syntax-only and focused cppcheck checks; the focused runs had no new correctness findings.
+- The Linux socket/I/O boundary slice covered `recvmsg`/`accept4` output ownership, socket KFile-attachment failure cleanup, `recvmmsg`/`sendmmsg` address spans, and `readv`/`writev`/`preadv`/`pwritev` iovec arithmetic. The three changed translation units passed g++ C++23 syntax-only and focused cppcheck checks.
+- The Linux timer/async timeout slice covered saturating alarm, interval-timer, and POSIX-timer nanosecond conversions/deadline rearming, timespec validation, timer output narrowing, overrun saturation, and `epoll_pwait2` negative/invalid/overflowing timeout handling. Both changed translation units passed g++ C++23 syntax-only and focused cppcheck checks; remaining cppcheck output was pre-existing style/flow guidance in surrounding code.
+- A follow-up fd-lifetime review covered `pidfd_getfd`, cross-process Linux fd copying, shared OFD close/dup paths, and Win32 IOCP close/lookup behavior. `pidfd_splice.cpp` and `iocp_syscall.cpp` passed g++ C++23 syntax-only; the known target-fd concurrent-close race and first-duplicate-IOCP-close semantics remain explicitly isolated design gaps pending their owning lifetime contracts.
+- Existing host CTest tree: 68 registered tests; 34 passed, 34 were not run because their prebuilt executables are absent. This tree was not rebuilt against the audit commits.
+
+## Implemented hardening
+
+Recent audit commits include teardown pinning for socket/IPC/async pools, timeout and overflow saturation, address-space map refusal/partial-table rollback, Linux mapping-span and `mincore` validation, socket boundary failure cleanup, PE-loader map refusal checks, driver/loader range arithmetic, diagnostic formatting safety, filesystem label walks, Linux directory-prefix copying, and explicit userland ABI/CRT contracts. The latest timer/async hardening code commit is `4d921155`; the branch is clean after the accompanying ledger update.
+
+## Remaining verification
+
+- Full MSVC build and link.
+- Rebuilt host test suite for all 68 registered tests.
+- QEMU boot, syscall/fuzz/stress campaigns, SMP/S3 paths, and graphical/runtime smoke tests.
+- Hardware-dependent storage, networking, GPU, ACPI, and USB paths.
+- Static analyzer residuals classified as intentional canary/SEH fixtures, linker/PE image-base contracts, inline-assembly parser limitations, or bounded NUL-terminated pointer contracts; they should be revisited after a target-aware compiler/analyzer run.
+- Active-path design risks retained for follow-up: IOCP close currently marks the port closed on the first handle close if duplicate IOCP handles become supported; the current userland `DuplicateHandle` implementation aliases the numeric source handle, and no `NtDuplicateObject`/kernel duplicate dispatch exists for IOCP. `pidfd_getfd` reads a target Linux fd table without a per-process fd lock during concurrent close; the array is directly read by many Linux syscall paths, so adding a lock only at `pidfd_getfd` would not establish an invariant. Both require their owning handle/fd-lifetime contracts before a safe fix.
+
+The machine preflight currently reports STOP-level resource pressure, so no build or QEMU process was launched during this audit slice.

kernel/apps/calculator.cpp

@@ -173,7 +173,7 @@ constinit State g_state = {duetos::drivers::video::kWindowInvalid, {}, 0, {}, 0,
 void SetDisplayLiteral(const char* s)
 {
     u32 n = 0;
-    while (s[n] != '\0' && n < kDisplayCap)
+    while (n < kDisplayCap && s[n] != '\0')
     {
         g_state.display[n] = s[n];
         ++n;

kernel/apps/charmap.cpp

@@ -535,8 +535,8 @@ void RebindCharmapBounds(u32 cx, u32 cy, u32 cw, u32 ch)
 void RefreshCharmapHeader()
 {
     u32 o = 0;
-    const char* prefix = "U+";
-    while (prefix[o] != '\0' && o + 1 < sizeof(g_header_text))
+    const char prefix[] = "U+";
+    while (o + 1 < sizeof(g_header_text) && o < sizeof(prefix) - 1 && prefix[o] != '\0')
     {
         g_header_text[o] = prefix[o];
         ++o;
@@ -620,8 +620,8 @@ void ClickCopy()
     CopySelectionToClipboard();
     char buf[64];
     u32 o = 0;
-    const char* p = "copied U+";
-    while (p[o] != '\0' && o + 1 < sizeof(buf))
+    const char p[] = "copied U+";
+    while (o < sizeof(p) - 1 && o + 1 < sizeof(buf) && p[o] != '\0')
     {
         buf[o] = p[o];
         ++o;
@@ -751,8 +751,8 @@ bool CharMapFeedChar(char c)
         CopySelectionToClipboard();
         char buf[64];
         u32 o = 0;
-        const char* p = "copied U+";
-        while (p[o] != '\0' && o + 1 < sizeof(buf))
+        const char p[] = "copied U+";
+        while (o < sizeof(p) - 1 && o + 1 < sizeof(buf) && p[o] != '\0')
         {
             buf[o] = p[o];
             ++o;

kernel/apps/dbg_core.cpp

@@ -304,11 +304,12 @@ usize ScanBytes(u64 pid, const u8* needle, usize nlen, u64* hits, usize cap)
     // and direct — no AS walks.
     if (pid == kKernelPid)
     {
-        const u8* lo = _text_start;
-        const u8* hi = _text_end;
-        if (hi <= lo)
+        const u64 lo_addr = reinterpret_cast<u64>(_text_start);
+        const u64 hi_addr = reinterpret_cast<u64>(_text_end);
+        if (hi_addr <= lo_addr)
             return 0;
-        const u64 size = static_cast<u64>(hi - lo);
+        const u8* lo = reinterpret_cast<const u8*>(lo_addr);
+        const u64 size = hi_addr - lo_addr;
         for (u64 off = 0; off + nlen <= size && hit_count < cap; ++off)
         {
             bool match = true;

kernel/apps/files.cpp

@@ -2039,14 +2039,14 @@ bool MaybeLaunchRamfsExe(const duetos::fs::RamfsNode* sel)
         return false;
     char tag[40];
     duetos::u32 ti = 0;
-    const char* prefix = "ramfs-launch:";
-    while (prefix[ti] != '\0' && ti < sizeof(tag) - 1)
+    const char prefix[] = "ramfs-launch:";
+    while (ti < sizeof(prefix) - 1 && ti < sizeof(tag) - 1 && prefix[ti] != '\0')
     {
         tag[ti] = prefix[ti];
         ++ti;
     }
     duetos::u32 ni = 0;
-    while (sel->name[ni] != '\0' && ti < sizeof(tag) - 1)
+    while (ti < sizeof(tag) - 1 && sel->name[ni] != '\0')
     {
         tag[ti++] = sel->name[ni++];
     }
@@ -2117,13 +2117,13 @@ bool MaybeLaunchFat32Entry(const duetos::fs::fat32::DirEntry& e)
     }
     char tag[40];
     duetos::u32 ti = 0;
-    const char* prefix = "fat32-launch:";
-    while (prefix[ti] != '\0' && ti < sizeof(tag) - 1)
+    const char prefix[] = "fat32-launch:";
+    while (ti < sizeof(prefix) - 1 && ti < sizeof(tag) - 1 && prefix[ti] != '\0')
     {
         tag[ti] = prefix[ti];
         ++ti;
     }
-    for (duetos::u32 i = 0; e.name[i] != '\0' && ti < sizeof(tag) - 1; ++i)
+    for (duetos::u32 i = 0; ti < sizeof(tag) - 1 && e.name[i] != '\0'; ++i)
         tag[ti++] = e.name[i];
     tag[ti] = '\0';
     // Build the volume-relative path so SpawnPeFile can derive the

kernel/apps/imageview.cpp

@@ -410,7 +410,7 @@ enum class ImageFormat : u8
 ImageFormat ClassifyByName(const char* name)
 {
     u32 len = 0;
-    while (name[len] != '\0' && len < kNameCap)
+    while (len < kNameCap && name[len] != '\0')
         ++len;
     if (len < 5)
         return ImageFormat::Unknown;

kernel/apps/notes.cpp

@@ -902,7 +902,7 @@ void DrawFn(u32 cx, u32 cy, u32 cw, u32 ch, void* /*cookie*/)
         // bytes ~= glyph cell count for the Caption role bitmap
         // path, which is the v0 default).
         u32 base_len = 0;
-        while (g_status_text[base_len] != '\0' && base_len < sizeof(g_status_text))
+        while (base_len < sizeof(g_status_text) - 1 && g_status_text[base_len] != '\0')
             ++base_len;
         const u32 fx = sx + base_len * kGlyphW;
         const u32 max_x = cx + cw - kPad;

kernel/apps/screenshot.cpp

@@ -446,8 +446,8 @@ bool ScreenshotCapture()
     // confirmation the F-key actually wrote anything.
     char toast[40];
     u32 to = 0;
-    const char* prefix = "saved ";
-    while (prefix[to] != '\0' && to + 1 < sizeof(toast))
+    constexpr char prefix[] = "saved ";
+    while (to < sizeof(prefix) - 1 && to + 1 < sizeof(toast) && prefix[to] != '\0')
     {
         toast[to] = prefix[to];
         ++to;
@@ -552,8 +552,8 @@ bool ScreenshotCaptureTga()
     SetLastStatus("saved");
     char toast[40];
     u32 to = 0;
-    const char* prefix = "saved ";
-    while (prefix[to] != '\0' && to + 1 < sizeof(toast))
+    constexpr char prefix[] = "saved ";
+    while (to < sizeof(prefix) - 1 && to + 1 < sizeof(toast) && prefix[to] != '\0')
     {
         toast[to] = prefix[to];
         ++to;

kernel/apps/settings_datetime.cpp

@@ -138,20 +138,21 @@ void AppendStr(char* out, u32 cap, u32* o, const char* s)
 
 void AppendSignedDec(char* out, u32 cap, u32* o, i32 v)
 {
-    if (v < 0)
+    i64 value = v;
+    if (value < 0)
     {
         if (*o + 1 < cap)
             out[(*o)++] = '-';
-        v = -v;
+        value = -value;
     }
     char tmp[12];
     u32 n = 0;
-    if (v == 0)
+    if (value == 0)
         tmp[n++] = '0';
-    while (v > 0 && n < sizeof(tmp))
+    while (value > 0 && n + 1 < sizeof(tmp))
     {
-        tmp[n++] = static_cast<char>('0' + (v % 10));
-        v /= 10;
+        tmp[n++] = static_cast<char>('0' + (value % 10));
+        value /= 10;
     }
     while (n > 0 && *o + 1 < cap)
         out[(*o)++] = tmp[--n];
@@ -379,7 +380,6 @@ bool Key(char c)
         {
             // Well-known Google time server — same as the shell `ntp` command.
             duetos::net::Ipv4Address srv{{216, 239, 35, 0}};
-            AppendStr(g_ntp_status, sizeof(g_ntp_status), nullptr, ""); // unused; direct write below
             // Update status to "querying" immediately so the panel
             // shows activity on the next frame.
             g_ntp_status[0] = 'N';

kernel/arch/x86_64/acpi_wakeup.cpp

@@ -74,7 +74,9 @@ AcpiWakeContext& AcpiWakeContextGet()
 
 bool AcpiWakeArm()
 {
-    const u64 len = static_cast<u64>(acpi_wake_tramp_end - acpi_wake_tramp_start);
+    const u64 start = reinterpret_cast<u64>(acpi_wake_tramp_start);
+    const u64 end = reinterpret_cast<u64>(acpi_wake_tramp_end);
+    const u64 len = end >= start ? end - start : 0;
     if (len == 0 || len > kTrampolineMaxLen)
     {
         KLOG_WARN_V("arch/acpi-wake", "wake trampoline image does not fit its page — S3 unavailable", len);
@@ -124,7 +126,9 @@ void AcpiWakeSelfTest()
 {
     using core::PanicWithValue;
 
-    const u64 len = static_cast<u64>(acpi_wake_tramp_end - acpi_wake_tramp_start);
+    const u64 start = reinterpret_cast<u64>(acpi_wake_tramp_start);
+    const u64 end = reinterpret_cast<u64>(acpi_wake_tramp_end);
+    const u64 len = end >= start ? end - start : 0;
     if (len != kTrampolineMaxLen)
         PanicWithValue("arch/acpi-wake", "wake trampoline blob is not exactly one page", len);
 

kernel/arch/x86_64/smp.cpp

@@ -1024,7 +1024,9 @@ u64 SmpStartAps()
     // Copy the trampoline image into physical 0x8000. Frame allocator
     // has the low 1 MiB permanently reserved, so nobody else owns this
     // memory.
-    const u64 tramp_len = static_cast<u64>(ap_trampoline_end - ap_trampoline_start);
+    const u64 tramp_start = reinterpret_cast<u64>(ap_trampoline_start);
+    const u64 tramp_end = reinterpret_cast<u64>(ap_trampoline_end);
+    const u64 tramp_len = tramp_end >= tramp_start ? tramp_end - tramp_start : 0;
     if (tramp_len > 0x1000)
     {
         // Build-time invariant violated. Debug: panic so the

kernel/core/boot_bringup.cpp

@@ -4239,7 +4239,7 @@ void BootBringupDesktop(duetos::uptr multiboot_info)
         if (hit != nullptr)
         {
             duetos::u32 n = 0;
-            while (hit[n] != '\0' && hit[n] != ' ' && n < sizeof(g_peexec_path) - 1)
+            while (n < sizeof(g_peexec_path) - 1 && hit[n] != '\0' && hit[n] != ' ')
             {
                 g_peexec_path[n] = hit[n];
                 ++n;

kernel/core/init.cpp

@@ -344,7 +344,10 @@ extern "C" void (*__init_array_end[])();
 
 void RunInitArray()
 {
-    const u64 count = static_cast<u64>(__init_array_end - __init_array_start);
+    const u64 begin = reinterpret_cast<u64>(__init_array_start);
+    const u64 end = reinterpret_cast<u64>(__init_array_end);
+    const u64 bytes = end >= begin ? end - begin : 0;
+    const u64 count = bytes / sizeof(__init_array_start[0]);
     arch::SerialWrite("[init] _init_array: ");
     arch::SerialWriteHex(count);
     arch::SerialWrite(" entries\n");

kernel/core/menu_dispatch.cpp

@@ -605,8 +605,6 @@ void DispatchMenuAction(duetos::u32 action, duetos::u32 ctx)
                                     duetos::u64 v = pid;
                                     char tmp[24];
                                     duetos::u32 ti = 0;
-                                    if (v == 0)
-                                        tmp[ti++] = '0';
                                     while (v != 0)
                                     {
                                         tmp[ti++] = static_cast<char>('0' + v % 10);

kernel/debug/hot_patch.cpp

@@ -500,10 +500,15 @@ bool HotPatchSelfTest()
 HotPatchBulkResult HotPatchApplyAll()
 {
     HotPatchBulkResult r{};
-    const auto* p = __duetos_hotpatch_pairs_start;
-    const auto* end = __duetos_hotpatch_pairs_end;
-    for (; p < end; ++p)
+    const u64 begin = reinterpret_cast<u64>(__duetos_hotpatch_pairs_start);
+    const u64 end = reinterpret_cast<u64>(__duetos_hotpatch_pairs_end);
+    if (end < begin)
+        return r;
+    const u64 count = (end - begin) / sizeof(HotPatchPair);
+    const auto* pairs = __duetos_hotpatch_pairs_start;
+    for (u64 index = 0; index < count; ++index)
     {
+        const auto* p = &pairs[index];
         ++r.considered;
         const u64 target_va = reinterpret_cast<u64>(p->target);
         const u64 replacement_va = reinterpret_cast<u64>(p->replacement);

kernel/diag/bsod.cpp

@@ -201,7 +201,7 @@ u32 DrawDecU32(u32 x, u32 y, u32 v, u32 fg, u32 bg)
     }
     else
     {
-        while (v > 0 && n < sizeof(buf))
+        while (v > 0 && n + 1 < sizeof(buf))
         {
             buf[n++] = static_cast<char>('0' + v % 10);
             v /= 10;

kernel/diag/cleanroom_trace.cpp

@@ -163,7 +163,7 @@ void WriteDec(u64 v)
     }
     char buf[24];
     u32 n = 0;
-    while (v > 0 && n < sizeof(buf))
+    while (v > 0 && n + 1 < sizeof(buf))
     {
         buf[n++] = static_cast<char>('0' + (v % 10));
         v /= 10;

kernel/diag/kpath_selftest.cpp

@@ -46,9 +46,9 @@ bool IterMatchCallback(const KPathIterRow& row, void* /*ctx*/)
         // Pointer-equality is sufficient because both source sites
         // use the same string literal (string-pooled by the linker).
         const char* a = row.name;
-        const char* b = "kpath.selftest.site";
+        constexpr char b[] = "kpath.selftest.site";
         bool match = true;
-        for (::duetos::u32 i = 0; i < 24; ++i)
+        for (::duetos::u32 i = 0; i < sizeof(b); ++i)
         {
             if (a[i] != b[i])
             {

kernel/diag/runtime_checker.cpp

@@ -909,9 +909,10 @@ DUETOS_NO_SANITIZE_WRAP u64 ComputeTextSpotHash()
     constexpr u64 kFnvPrime = 0x100000001b3ULL;
     constexpr u64 kSpotBytes = 4096;
     u64 h = kFnvOffset;
-    const u8* s = _text_start;
-    const u8* e = _text_end;
-    const u64 text_bytes = u64(e - s);
+    const u64 start = reinterpret_cast<u64>(_text_start);
+    const u64 end = reinterpret_cast<u64>(_text_end);
+    const u64 text_bytes = end >= start ? end - start : 0;
+    const u8* s = reinterpret_cast<const u8*>(start);
     const u64 head_bytes = (text_bytes < kSpotBytes) ? text_bytes : kSpotBytes;
     for (u64 i = 0; i < head_bytes; ++i)
     {
@@ -922,7 +923,7 @@ DUETOS_NO_SANITIZE_WRAP u64 ComputeTextSpotHash()
     {
         for (u64 i = 0; i < kSpotBytes; ++i)
         {
-            h ^= e[-i64(kSpotBytes) + i64(i)];
+            h ^= s[text_bytes - kSpotBytes + i];
             h *= kFnvPrime;
         }
     }
@@ -938,11 +939,14 @@ DUETOS_NO_SANITIZE_WRAP u64 ComputeTextFullHash()
     constexpr u64 kFnvOffset = 0xcbf29ce484222325ULL;
     constexpr u64 kFnvPrime = 0x100000001b3ULL;
     u64 h = kFnvOffset;
-    const u8* s = _text_start;
-    const u8* e = _text_end;
-    for (const u8* p = s; p < e; ++p)
+    const u64 start = reinterpret_cast<u64>(_text_start);
+    const u64 end = reinterpret_cast<u64>(_text_end);
+    if (end < start)
+        return h;
+    const u8* s = reinterpret_cast<const u8*>(start);
+    for (u64 i = 0; i < end - start; ++i)
     {
-        h ^= *p;
+        h ^= s[i];
         h *= kFnvPrime;
     }
     return h;

kernel/drivers/gpu/cea861.cpp

@@ -210,7 +210,7 @@ void WriteDec(u32 v)
         ConsoleWrite("0");
         return;
     }
-    while (v != 0 && i < sizeof(buf))
+    while (v != 0 && i + 1 < sizeof(buf))
     {
         buf[i++] = static_cast<char>('0' + (v % 10));
         v /= 10;
@@ -318,9 +318,9 @@ const char* CeaVicName(u8 vic, char scratch[16])
     // Format "vic-N" into scratch.
     if (scratch == nullptr)
         return "vic-?";
-    const char* p = "vic-";
+    constexpr char p[] = "vic-";
     u32 i = 0;
-    while (p[i] != 0 && i < 15)
+    while (i < sizeof(p) - 1 && p[i] != 0)
     {
         scratch[i] = p[i];
         ++i;

kernel/drivers/gpu/edid.cpp

@@ -304,7 +304,7 @@ void WriteDec(u32 v)
         ConsoleWrite("0");
         return;
     }
-    while (v != 0 && i < sizeof(buf))
+    while (v != 0 && i + 1 < sizeof(buf))
     {
         buf[i++] = static_cast<char>('0' + (v % 10));
         v /= 10;