Repository navigation
First real 4-shell fuzz run: 6 zsh boundary divergences fixed - #17
Merged
Merged
Conversation
The first real four-shell baseline run (busybox built locally, so the fuzzshell oracle finally ran) found six divergences. All six are the documented zsh residual: zsh's $(( )) truncates operand value text above 2^63-1 to 18 digits and keeps going with the wrong value, exit unchanged. The existing carve only tracked INT_MIN sources directly; it missed values that wrap into the boundary at runtime (int_max() + 1) and boundary values hidden behind dict.get/unwrap_or. The oracle now carves every boundary source (both int64 edge literals and math.int_min()/math.int_max()) with data-flow taint through the IR. programReachesIntMinArith stays untouched as the done-signal predicate. Six minimized reproducers are curated as regressions, and the docs are corrected: the old "loud zsh error" claim was wrong, zsh warns and returns a wrong value. Gates: go test ./... and the four-shell fuzzshell suite are green; the seeded baseline and curated replay both come back clean.
The done-signal section named only intmin-via-var.json. Add a paragraph covering the six boundary-*.json entries: discovered by the first real four-shell baseline, shrunk, committed with real provenance.
mitchellnemitz
force-pushed
the
impl-2026-08-17-fuzz-boundary-carve
branch
from
August 18, 2026 14:23
d961f3e to
fb03e33
Compare
The guide's correction (zsh warns and continues with a truncated value, not a loud error) applies to the changelog entry too.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The fuzzer's four-shell oracle never ran: busybox was missing locally, so the fuzzshell baseline skipped. With busybox built from source (ash-only config), the SC-005 baseline ran for the first time and found six divergences, all one class.
zsh's
$(( ))converts an operand's value text with its own number parser, which truncates any magnitude above 2^63-1 after 18 digits and continues with the wrong value (exit unchanged). The existing carve only tracked INT_MIN sources with direct data flow, so it missed two shapes the baseline hit: values that wrap into the boundary at runtime (math.int_max() + 1) and boundary values hidden behinddict.get/unwrap_or.What changed
programReachesBoundaryArith: the oracle now carves zsh for any boundary source (both int64 edge literals,math.int_min()/math.int_max()) with data-flow taint through the IR (bindings, arithmetic, collection literals,dict.get/unwrap_or/index). Everything outside that reach is still compared against all four shells;programReachesIntMinArithstays as the done-signal predicate.Verification
go test ./...and the four-shell fuzzshell suite (baseline, curated replay, done-signal) green;wisp-fuzz seededandreplayclean.