|
|
the only case
Generalised the FE0D defect into a detector: flag an IT block that materialises an
error-looking constant and then falls through to a non-stack store before any
return, which is the shape that distinguishes FE0D from its safe sibling FE0B
(which branches away on a bad handle).
The first version of the detector found nothing, including in FE0D itself, because
capstone writes the condition before the width suffix as movne.w and the pattern
had that backwards. A detector that cannot rediscover the known bug is worthless,
and that is how the error surfaced; it now reports FE0D exactly.
Swept over every non-library function in all twelve TAs: three leads, of which
FE0D is the only real one. Both others are in opm_asd301_path and are false
positives -- 0x58 is the 88-byte crypto slot stride feeding index arithmetic
rather than an error code, and the second is a predicated store in the success arm
followed by a loop counter increment.
So the desync defect is specific to GCP FE0D rather than a house style, which
strengthens the report: a single-handler mistake sitting next to a correct
sibling.
|
