Fix real WIREBIND crash: stale active-VM pointer dispatched after blocking read (FABRIC-3.md §XII.3)

Browse Source

The interpreter_enabled guard added in the previous commit (662ef44) was a
real but incomplete fix -- re-running the exact repro against it still
panicked (this time as a raw #PF page fault), proving something deeper
was wrong.

Root cause, found via targeted console_puts probes (not GDB --
starkernel_kernel.elf's symbols don't correspond to the actual running
starkernel_loader.efi binary for this monolithic build, same gotcha
already on record from the 2026-08-18 aarch64 investigation):

sk_repl_run()'s main loop captures `active` once, before calling
sk_console_readline(), which then blocks for the next full line. If the
identity `active` points at is killed while that read is still blocked,
the bailout meant to catch this (sk_console_identity_present()) only
checks a generic "is anyone attached" boolean, not "is the specific
identity active belonged to still attached" -- a fast detach of one
identity followed by attach of a different one never produces an
observable gap in that boolean, so the bailout never fires. The stale
`active`, now pointing at freed memory, gets dispatched into.

Fix: re-resolve `active` fresh from g_repl_active_vm immediately before
dispatch, right after sk_console_readline() returns. One line, no
registry lookup, no dereference of the stale pointer -- closes the race
regardless of whether the bailout catches it first.

Verified: rebuilt amd64 clean, reproduced the exact same attach/USE/
detach/attach/USE sequence against the fixed build -- clean switch, no
fault, exerciser runs correctly afterward.

FABRIC-3.md §XII.2 also corrected to stop claiming the interpreter_
enabled guard alone closed the crash -- it didn't, per the above.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EXieurDfDSsDFdnSyusuWo

...

This commit is contained in:

Robert Allan James

2026-09-10 17:19:01 -04:00

co-authored by Claude Sonnet 5

parent 662ef44e59

commit 70421bdd43

10 changed files with 45475 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

logs/20260910-160811/amd64/qemu-amd64-20260910-160811.log

+9260

File diff suppressed because it is too large Load Diff

logs/20260910-170448/amd64/qemu-amd64-20260910-170448.log

+9002

File diff suppressed because it is too large Load Diff

logs/20260910-171002/amd64/qemu-amd64-20260910-171002.log

+9013

File diff suppressed because it is too large Load Diff

logs/20260910-171308/amd64/qemu-amd64-20260910-171308.log

+9015

File diff suppressed because it is too large Load Diff

logs/20260910-171632/amd64/qemu-amd64-20260910-171632.log

+9108

File diff suppressed because it is too large Load Diff