| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
The previous pass swept single dwords exhaustively, but corruption often needs a
combination such as a length field together with a count field, and the randomized
multi-field fuzz had only ever drawn offsets from the first part of the buffer. Widened to
draw from the whole declared window with up to five simultaneous mutations per invoke,
seven applications and over fifteen thousand invokes produce no non-benign status, no
stall, no write past the declared window and no drift in the periodic fixed re-probe.
Combined with the previous pass's exhaustive single-dword mutations, the shared-buffer
parameter space is now covered both exhaustively for singles and combinatorially for
tuples on real hardware. The objective is not met.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
The deep randomized fuzz, the highest-yield dynamic class and the one enabled by the
earlier ring fix, had only covered three applications. Extending it to the rest, with the
two known wedge commands excluded so a wedge cannot truncate a run, gives twenty-three
thousand deep randomized invokes across ten applications, each invoke carrying up to four
simultaneous boundary-value field mutations and checked for non-benign status, stalls,
writes past the declared window and drift in a periodic fixed re-probe.
No anomalies of any class. The deep-fuzz class is now complete across every invokable
application on this part, standing results are unchanged, and the dynamic evidence base is
large enough that the negative is not plausibly a sampling artifact.
|
|
|
The previous pass showed our harness caps every boot at about a thousand invokes, which
limited every fuzz in this audit, so the ceiling was worth removing. A wrapping submit is
monkeypatched onto the live processor object without editing the vendor driver. The first
attempt still failed at the same index, because wrapping only the byte offset is
insufficient when frames fit the ring exactly and the straddle case never fires while the
write pointer itself grows out of range; keeping the pointer modulo the ring capacity
fixes it, and three thousand invokes now complete cleanly. That independently reconfirms
the previous pass's diagnosis that the ceiling was ours.
With the ceiling gone, a seeded randomized fuzz runs twenty-five hundred invokes per
application with up to four simultaneous field mutations drawn from a boundary-value set,
checking status, stalls, writes past the declared window and drift in a periodic fixed
re-probe. Three applications and seventy-five hundred invokes produce no anomalies of any
class.
The objective is not met, with standing results unchanged.
|
