From d94b18652ddfb264aa9a34514ea790230d80bcc2 Mon Sep 17 00:00:00 2001 From: user Date: Fri, 17 Jul 2026 20:22:07 +0200 Subject: net: fix truncated TCP field offsets corrupting multi-segment recv SK_STATE/SK_SND/SK_RCV sat at struct offsets 305/306/310, past the 288-byte SK_RXBUF. But the field accessors add the offset as an 8-bit immediate (add SK_x; ld l,a), so rgbasm truncated 305->49, 306->50, 310->54 (the -Wtruncation warnings we'd been ignoring) - putting STATE and the sequence numbers *inside* RXBUF at offsets 49/50/54. Any TCP segment with >=33 payload bytes therefore overwrote the connection's own STATE and rcv_nxt/snd_nxt with message text. The first segment of a stream landed, its data clobbered STATE to a garbage value, and every subsequent segment was dropped because tcp_in no longer saw ESTABLISHED - so multi-segment TCP receives (an IRC MOTD, any HTTP body past one segment) silently stalled. wget appeared to 'work' only because a single-segment reply plus a never-honored FIN still printed once. Fix: reorder the struct so STATE/SND/RCV precede the big RXBUF, keeping every field offset < 256 (SK_SIZE unchanged at 314, all accessors are symbolic). Zero -Wtruncation warnings remain. Verified an 11-line IRC registration burst now arrives intact. --- src/socket.asm | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/socket.asm b/src/socket.asm index 20ed982..0720b0a 100644 --- a/src/socket.asm +++ b/src/socket.asm @@ -21,10 +21,16 @@ DEF SK_HASRX EQU 9 ; 1 rxbuf holds a datagram DEF SK_RXLEN EQU 10 ; 1 payload length DEF SK_SRCIP EQU 11 ; 4 sender IP DEF SK_SRCPORT EQU 15 ; 2 sender port -DEF SK_RXBUF EQU 17 ; 288 payload (holds a DHCP reply, or a max segment) -DEF SK_STATE EQU 305 ; 1 TCP state (see TCP_* below) -DEF SK_SND EQU 306 ; 4 snd_nxt (our next sequence number) -DEF SK_RCV EQU 310 ; 4 rcv_nxt (next sequence we expect from peer) +; TCP bookkeeping MUST stay below offset 256: the field accessors do +; `add SK_x` as an 8-bit immediate, so any constant >=256 is silently +; truncated (e.g. 305 -> 49) and lands *inside* RXBUF, where an incoming +; segment's payload then overwrites the connection's STATE/seq numbers - +; corrupting every multi-segment TCP receive. Keep STATE/SND/RCV ahead of +; the big RXBUF; RXBUF is only ever based via a 16-bit-safe add. +DEF SK_STATE EQU 17 ; 1 TCP state (see TCP_* below) +DEF SK_SND EQU 18 ; 4 snd_nxt (our next sequence number) +DEF SK_RCV EQU 22 ; 4 rcv_nxt (next sequence we expect from peer) +DEF SK_RXBUF EQU 26 ; 288 payload (holds a DHCP reply, or a max segment) DEF SK_SIZE EQU 314 DEF TCP_MSS EQU 200 -- cgit v1.3.1-sl0p