[GH-ISSUE #7324] [Bug] Kernel-module guide describes the 28-byte trailer magic as 27 bytes #4352

New issue

Open

opened 2026-10-31 00:49:08 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:49:08 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 26, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7324

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

The kernel-module guide calls ~Module signature appended~\n a “27-byte magic.” Including the newline, that magic is 28 bytes. Independent public CLI inspection reports signature.magic.bytes: 28; removing the newline produces an absent-trailer result. The observed error is the guide's numeric count.

Reproduction

From the stated source revision with its compiled CLI already built and the pinned Node runtime on PATH, run the following. It creates an inert ELF64 ET_REL fixture and a control, inspects them without loading either file, and removes the disposable files. This script was executed once; a separate independent probe also produced the same two results.

set -eu
repo="$PWD"
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT
python3 - "$work" <<'PY'
import pathlib, struct, sys
work = pathlib.Path(sys.argv[1])
names = b'\0.shstrtab\0.modinfo\0'
modinfo = b'license=GPL\0'
section_offset = (64 + len(names) + len(modinfo) + 7) & ~7
ident = b'\x7fELF\x02\x01\x01' + bytes(9)
elf = struct.pack('<16sHHIQQQIHHHHHH', ident, 1, 62, 1, 0, 0, section_offset, 0, 64, 0, 0, 64, 3, 1)
elf += names + modinfo
elf += bytes(section_offset - len(elf)) + bytes(64)
elf += struct.pack('<IIQQQQIIQQ', 1, 3, 0, 0, 64, len(names), 0, 0, 1, 0)
elf += struct.pack('<IIQQQQIIQQ', 11, 1, 2, 0, 64 + len(names), len(modinfo), 0, 0, 1, 0)
payload = b'fixture'
info = bytes([0, 0, 2, 0, 0, 0, 0, 0]) + struct.pack('>I', len(payload))
magic = b'~Module signature appended~\n'
print('magic bytes including newline:', len(magic))
print('magic bytes excluding newline:', len(magic[:-1]))
(work/'with-newline.ko').write_bytes(elf + payload + info + magic)
(work/'without-newline.ko').write_bytes(elf + payload + info + magic[:-1])
for name in ('home', 'config', 'data', 'cache', 'state', 'temp'):
    (work/name).mkdir()
PY
for name in with-newline without-newline; do
  echo "$name"
  env -i PATH="$PATH" HOME="$work/home" XDG_CONFIG_HOME="$work/config" \
    XDG_DATA_HOME="$work/data" XDG_CACHE_HOME="$work/cache" \
    XDG_STATE_HOME="$work/state" TMPDIR="$work/temp" REA_LOG_LEVEL=silent \
    node "$repo/scripts/rea.mjs" inspect-kernel-module "$work/$name.ko" \
    --filter-output normalized_result.signature --json
done

Expected behavior

The guide's byte count agrees with its displayed magic interpreted with the trailing newline and with the parser's reported range: 28 bytes including the newline.

Impact and scope

P3 documentation wording error. The count is one byte shorter than the described trailer, which can confuse readers checking its layout. The observed CLI results correctly locate the full magic. No downstream tooling failure, signature-validation failure, or runtime decoding error was observed. Scope checked: one ELF64 little-endian x86-64 synthetic artifact and its no-newline control. Readers can use the reported signature.magic.bytes value to obtain the correct length.

REA version

Source revision ace4dbf36e8c8f36a0e192aff9a11484ed428358, package version 6.8.0.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1 arm64. Fixture generation used Python 3; no compiler, disassembler, or Linux host was required.

Target and artifact context

Generated 288-byte ELF64 little-endian x86-64 ET_REL image with a section-name table and one .modinfo entry, followed by a seven-byte inert payload, a 12-byte trailer information block and the 28-byte magic. The control omits the final newline. The payload is arbitrary fixture data; no claim of cryptographic validity is made.

Interface

CLI

Earliest failure stage

Unknown

Relevant output or evidence

Expected source: src/domain/native/kernelModule.ts:46-47 explicitly includes the trailing newline in MODULE_SIGNATURE_MAGIC; src/native/elf/KernelModuleParser.ts:415-429 compares the complete Latin1 suffix and reports its byte length. The CLI routes to that provider through src/cli/binaryDiagnosticsCommands.ts:127 and src/composition/binaryDiagnostics.ts:55.
Failure source: docs/kernel-modules.md:62 reads “The signature trailer is the 27-byte magic ~Module signature appended~\n”; the executed fixture generator counts 28 bytes and the public CLI returns a 28-byte range for that magic.
Evidence provenance: observed byte count and CLI results, corroborated by static source inspection.
Local verification: reproduced; both fixture and control exited 0 with empty stderr in each of two completed local probes.
Reproduction completeness: complete.

The reproduction prints magic bytes including newline: 28 and magic bytes excluding newline: 27. For the full magic, the CLI reports status: "present", magic: {"offset":307,"bytes":28}, info.location: {"offset":295,"bytes":12} and info.sig_len: 7. For the no-newline control it reports status: "absent" and null magic, info and PKCS#7 fields. The selected failure-stage value is Unknown because the defect is documentation wording and neither runtime command fails.

Additional context

Restoration check (proposed, not executed): the guide's numeric count agrees with the 28-byte literal including its newline, while the same CLI fixture continues to report 28 bytes and the 27-byte no-newline control continues to report an absent trailer. This preserves the distinction between correcting prose and changing the recognized magic.

The supplied open/closed issue archive and full matching bodies contain no report of this count error. Merged PR #7010 added kernel-module inspection; its related release reference lists the capability and does not address the byte count. A current upstream issue/PR search before submission found no matching count report; the feature PR remains closed and merged. NOT_ENOUGH_INFO: the last version with a correct guide count has not been established.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: The observed defect is a numeric wording mismatch; both runtime range results are correct, and no consequential downstream failure was observed.
Workaround status: available
Workaround basis: The executed public CLI directly reports signature.magic.bytes: 28 for the full trailer, providing the correct count without any code change.

Originally created by @coygeek on GitHub (Oct 26, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7324 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Documentation ## Observed behavior The kernel-module guide calls `~Module signature appended~\n` a “27-byte magic.” Including the newline, that magic is 28 bytes. Independent public CLI inspection reports `signature.magic.bytes: 28`; removing the newline produces an absent-trailer result. The observed error is the guide's numeric count. ## Reproduction From the stated source revision with its compiled CLI already built and the pinned Node runtime on PATH, run the following. It creates an inert ELF64 ET_REL fixture and a control, inspects them without loading either file, and removes the disposable files. This script was executed once; a separate independent probe also produced the same two results. ```sh set -eu repo="$PWD" work=$(mktemp -d) trap 'rm -rf "$work"' EXIT python3 - "$work" <<'PY' import pathlib, struct, sys work = pathlib.Path(sys.argv[1]) names = b'\0.shstrtab\0.modinfo\0' modinfo = b'license=GPL\0' section_offset = (64 + len(names) + len(modinfo) + 7) & ~7 ident = b'\x7fELF\x02\x01\x01' + bytes(9) elf = struct.pack('<16sHHIQQQIHHHHHH', ident, 1, 62, 1, 0, 0, section_offset, 0, 64, 0, 0, 64, 3, 1) elf += names + modinfo elf += bytes(section_offset - len(elf)) + bytes(64) elf += struct.pack('<IIQQQQIIQQ', 1, 3, 0, 0, 64, len(names), 0, 0, 1, 0) elf += struct.pack('<IIQQQQIIQQ', 11, 1, 2, 0, 64 + len(names), len(modinfo), 0, 0, 1, 0) payload = b'fixture' info = bytes([0, 0, 2, 0, 0, 0, 0, 0]) + struct.pack('>I', len(payload)) magic = b'~Module signature appended~\n' print('magic bytes including newline:', len(magic)) print('magic bytes excluding newline:', len(magic[:-1])) (work/'with-newline.ko').write_bytes(elf + payload + info + magic) (work/'without-newline.ko').write_bytes(elf + payload + info + magic[:-1]) for name in ('home', 'config', 'data', 'cache', 'state', 'temp'): (work/name).mkdir() PY for name in with-newline without-newline; do echo "$name" env -i PATH="$PATH" HOME="$work/home" XDG_CONFIG_HOME="$work/config" \ XDG_DATA_HOME="$work/data" XDG_CACHE_HOME="$work/cache" \ XDG_STATE_HOME="$work/state" TMPDIR="$work/temp" REA_LOG_LEVEL=silent \ node "$repo/scripts/rea.mjs" inspect-kernel-module "$work/$name.ko" \ --filter-output normalized_result.signature --json done ``` ## Expected behavior The guide's byte count agrees with its displayed magic interpreted with the trailing newline and with the parser's reported range: 28 bytes including the newline. ## Impact and scope P3 documentation wording error. The count is one byte shorter than the described trailer, which can confuse readers checking its layout. The observed CLI results correctly locate the full magic. No downstream tooling failure, signature-validation failure, or runtime decoding error was observed. Scope checked: one ELF64 little-endian x86-64 synthetic artifact and its no-newline control. Readers can use the reported `signature.magic.bytes` value to obtain the correct length. ## REA version Source revision `ace4dbf36e8c8f36a0e192aff9a11484ed428358`, package version 6.8.0. ## Runtime and platform Node.js v24.22.1; macOS 27.0.1 arm64. Fixture generation used Python 3; no compiler, disassembler, or Linux host was required. ## Target and artifact context Generated 288-byte ELF64 little-endian x86-64 ET_REL image with a section-name table and one `.modinfo` entry, followed by a seven-byte inert payload, a 12-byte trailer information block and the 28-byte magic. The control omits the final newline. The payload is arbitrary fixture data; no claim of cryptographic validity is made. ## Interface CLI ## Earliest failure stage Unknown ## Relevant output or evidence - Expected source: `src/domain/native/kernelModule.ts:46-47` explicitly includes the trailing newline in `MODULE_SIGNATURE_MAGIC`; `src/native/elf/KernelModuleParser.ts:415-429` compares the complete Latin1 suffix and reports its byte length. The CLI routes to that provider through `src/cli/binaryDiagnosticsCommands.ts:127` and `src/composition/binaryDiagnostics.ts:55`. - Failure source: `docs/kernel-modules.md:62` reads “The signature trailer is the 27-byte magic `~Module signature appended~\n`”; the executed fixture generator counts 28 bytes and the public CLI returns a 28-byte range for that magic. - Evidence provenance: observed byte count and CLI results, corroborated by static source inspection. - Local verification: reproduced; both fixture and control exited 0 with empty stderr in each of two completed local probes. - Reproduction completeness: complete. The reproduction prints `magic bytes including newline: 28` and `magic bytes excluding newline: 27`. For the full magic, the CLI reports `status: "present"`, `magic: {"offset":307,"bytes":28}`, `info.location: {"offset":295,"bytes":12}` and `info.sig_len: 7`. For the no-newline control it reports `status: "absent"` and null magic, info and PKCS#7 fields. The selected failure-stage value is Unknown because the defect is documentation wording and neither runtime command fails. ## Additional context Restoration check (proposed, not executed): the guide's numeric count agrees with the 28-byte literal including its newline, while the same CLI fixture continues to report 28 bytes and the 27-byte no-newline control continues to report an absent trailer. This preserves the distinction between correcting prose and changing the recognized magic. The supplied open/closed issue archive and full matching bodies contain no report of this count error. Merged PR #7010 added kernel-module inspection; its related release reference lists the capability and does not address the byte count. A current upstream issue/PR search before submission found no matching count report; the feature PR remains closed and merged. NOT_ENOUGH_INFO: the last version with a correct guide count has not been established. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: The observed defect is a numeric wording mismatch; both runtime range results are correct, and no consequential downstream failure was observed. - Workaround status: available - Workaround basis: The executed public CLI directly reports `signature.magic.bytes: 28` for the full trailer, providing the correct count without any code change.

bsakaguchi referenced this issue

2026-10-31 01:12:35 +00:00

[PR #4352] [MERGED] fix(artifacts): reconcile ARM32 Mach-O slice names by subtype #6194

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425