erofs-freebsd-out-tree/docs/pre15-stage0/P15-052.md

P15-052 Stage0 Decision

Status: STOP. B20 is complete as STOP-NO-SOURCE; B21 was not started.

The authoritative G06 replay uses frozen BASE ca7bb4fe6b33e4a1bdf423801134b0ed6bda86dd. It verifies the exact current FreeBSD and Linux source hashes, the FreeBSD amd64 PAGE_SHIFT=12 contract, signed 64-bit off_t, and GEOM's off_t mediasize before evaluating every listed branch.

Exact Branch Result

All twelve proposed on-disk arithmetic branches have unique source sites, but none has a target marker reachable from one validated on-disk field mutation. The current source text returns positive EOVERFLOW at those defensive sites; the proposed mapping would be positive EINTEGRITY. Linux has no matching checked branches in these functions, so its relevant semantic mapping is negative -EFSCORRUPTED, not a textual negative copy of the FreeBSD return.

The decisive counterexample to the supplied READY prototype is xattr.metadata.header_add. The prototype directly mutates the local aligned_off value. The real helper first rejects input above UINT64_MAX - 3, then rounds to four bytes. The greatest surviving aligned offset is therefore UINT64_MAX - 3; adding the two-byte header cannot overflow. The named branch cannot be independently reached.

The other prototype vectors likewise inject values outside current provenance: mounted image bytes are bounded by GEOM's signed off_t mediasize; inode size is bounded by OFF_MAX; decoded physical blocks are at most 48 bits; blkszbits is at most 12; prefix start and shared IDs are 32-bit. These bounds prevent each proposed shift, add, alignment, and index overflow before the listed target.

Preserved Semantics

The replay separately freezes corruption, unsupported, provider I/O, EOF, and short-read behavior. Disk/backing range contradictions remain positive EINTEGRITY; exact zero-length EOF remains success; provider EIO and media ENXIO remain exact; unsupported xattr layout remains positive EOPNOTSUPP; allocation remains positive ENOMEM and outside B20. Linux counterparts retain negative errno or PTR_ERR propagation.

The nominal erofs_xattr_read_backing() off > INT64_MAX positive EOVERFLOW site is also not reachable for a mounted primary provider: the preceding range check requires off <= backing_size, while mount validation requires backing_size <= INT64_MAX. This site remains unchanged because a STOP decision has no source diff.

Atomic Decision

G06 requires every listed branch to be independently reachable. One missing branch stops all of P15-052; this replay finds twelve missing target markers. No data.c or xattr.c errno is changed, no B20 case/fixture is created, and no candidate replay or QEMU run can cure a host-proven reachability failure. The full feature suite was not run.

The authoritative command was:

timeout -k 10 240 tests/pre15/gates/P15-052.sh \
    --base ca7bb4fe6b33e4a1bdf423801134b0ed6bda86dd \
    --output OWNED_OUTPUT

It exited 1 because a valid gate STOP is not GO. Two fresh output directories were byte-identical. The initial replay produced result SHA256 37280545d8ef5a6b87c7b9d536939513a1bbac8e4e4b2389e84f5ca77e1aa522, branch-ledger SHA256 8024a2cb6b43bd10fbcf446cf8cf44de37f1f9d6df25718c641cb9db4c257169, and preservation-ledger SHA256 d17e05b8df43ea5173bed6e58d7431b37a7a9c4a143e07717b543efcb54ecc66.

B21 is not authorized because the execution request requires B20 PASS before B21. Wave16 is therefore not ready from this serial chain.