From 845f3d4e3bf1f2e9b8c00420cbde44e89849a38a Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Thu, 13 Aug 2026 10:02:51 -0400 Subject: [PATCH] FABRIC-2.md: confirm and close hotwords_cache_promote() NULL-write item Ruling recorded: real defect, unreachable under all four call sites' existing NULL guards, leave as-is. --- FABRIC-2.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/FABRIC-2.md b/FABRIC-2.md index aee95e7..2101c0a 100644 --- a/FABRIC-2.md +++ b/FABRIC-2.md @@ -173,8 +173,17 @@ and recorded. bug to fix now. - [ ] `tools/README.md` documents a `fbtest.c` example that does not actually exist in `tools/` — stale-doc discrepancy. -- [ ] `hotwords_cache_promote()` has a NULL-write bug on a full cache. Unreachable under - today's workloads, not fixed. +- [x] **`hotwords_cache_promote()` has a NULL-write bug on a full cache.** Confirmed + 2026-08-13: the full-cache branch (`src/physics_hotwords_cache.c:362-371`) writes `word` + into `cache->cache[cache->lru_index]` unconditionally once `cache->cache_count >= + HOTWORDS_CACHE_SIZE` — it does not check `word` for NULL on that path, unlike the + slot-available branch below it, which does. A NULL `word` would silently evict a live + cache entry and replace it with NULL. Confirmed unreachable in practice: all four call + sites (`physics_hotwords_cache.c:284`, `physics_execution_hooks.c:140`, + `rolling_window_of_truth.c:787`, `src/starkernel/vm/vm_core.c:731`) only call + `hotwords_cache_promote()` after a `DictEntry*` NULL check has already passed. **Ruling:** + flag and leave as-is, matching the `arch_mmu_init()`/block_subsystem precedent — real + defect, no live trigger, not fixed without explicit instruction. - [ ] `heartbeat_trust()` has zero callers — dead code. - [ ] `m5_time_trust`/`m5_variance` are declared and never used. - [ ] `src/*.c.bak` files (`vm.c.bak`, `doe_metrics.c.bak`, `inference_engine.c.bak`) remain