[GH-ISSUE #7670] [Bug] Kernel-module guide lists a trailer-truncation reason no admitted ELF can produce #4591

New issue

Open

opened 2026-10-31 00:51:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:51:05 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7670

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

The kernel-module guide lists signature_trailer_truncated as the result for an appended magic with fewer than 12 preceding bytes. Source inspection establishes that this reason cannot be returned through the supported operation: an input satisfying that condition is too short to pass the earlier ELF-header read.

I ran node scripts/rea.mjs inspect-kernel-module <fixture> --json with synthetic local files. A minimum 52-byte ELF32 header was accepted, an ELF32 header followed immediately by the magic returned signature_id_type_not_pkcs7, and a complete trailer returned present. A magic-only file failed ELF validation. These executions corroborate the source finding; they do not establish a separate runtime parsing defect.

Reproduction

Use the stated built checkout and its pinned Node runtime. Run the following from the repository root. It creates inert fixtures and isolated state, blocks package-manager execution, inspects only kernel-module metadata, and removes its temporary files. This reduced sequence was executed once after an initial independent probe of the same six fixture layouts.

set -u
repo="$PWD"
node_bin="$(dirname "$(node -p process.execPath)")"
work=$(mktemp -d)
trap 'rm -rf "$work"' EXIT
python3 - "$work" <<'PY'
import pathlib, struct, sys
work = pathlib.Path(sys.argv[1])
for name in ('home', 'config', 'data', 'cache', 'state', 'temp', 'bin'):
    (work / name).mkdir()
for name in ('npx', 'npm', 'bun'):
    tool = work / 'bin' / name
    tool.write_text('#!/bin/sh\nexit 127\n')
    tool.chmod(0o755)
ident = b'\x7fELF\x01\x01\x01' + bytes(9)
elf = struct.pack('<16sHHIIIIIHHHHHH', ident, 1, 3, 1,
                  0, 0, 0, 0, 52, 0, 0, 40, 0, 0)
magic = b'~Module signature appended~\n'
info = bytes([0, 0, 2, 0, 0, 0, 0, 0]) + struct.pack('>I', 3)
fixtures = {
    'header': elf,
    'magic-only': magic,
    'bare-magic': elf + magic,
    'partial-info': elf + info[-6:] + magic,
    'complete': elf + b'abc' + info + magic,
    'no-newline': elf + b'abc' + info + magic[:-1],
}
assert len(elf) == 52 and len(magic) == 28
for name, data in fixtures.items():
    (work / (name + '.ko')).write_bytes(data)
PY
for name in header magic-only bare-magic partial-info complete no-newline; do
  printf '%s\n' "$name"
  env -i PATH="$work/bin:$node_bin:/usr/bin:/bin" HOME="$work/home" \
    XDG_CONFIG_HOME="$work/config" XDG_DATA_HOME="$work/data" \
    XDG_CACHE_HOME="$work/cache" XDG_STATE_HOME="$work/state" \
    TMPDIR="$work/temp" npm_config_prefix="$work/home/npm-global" \
    REA_LOG_LEVEL=silent \
    node "$repo/scripts/rea.mjs" inspect-kernel-module "$work/$name.ko" \
      --filter-output normalized_result.signature --json
  printf 'exit=%s\n' "$?"
done

Compare the returned reasons with the guide and follow the source ordering described under Evidence. None of these commands returns signature_trailer_truncated; the source bounds prove that no other admitted ELF can reach that branch either.

Expected behavior

The guide should describe failure reasons that the documented operation can actually produce, or qualify this reason as unreachable under current ELF admission. Correcting or removing this sentence would resolve the documentation issue without changing the parser's treatment of malformed ELF files.

Impact and scope

P3 documentation defect. The guide advertises an unavailable diagnostic, which can mislead readers interpreting malformed-trailer results. I did not demonstrate a consequential inspection failure, incorrect cryptographic validation, or execution of a module. The complete synthetic trailer is identified successfully. This report makes no claim that an ELF plus bare magic must receive a different runtime classification.

REA version

Exact node scripts/rea.mjs --version stdout: 6.8.0 followed by a newline. Source baseline: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node.js v24.22.1, Darwin arm64. Python 3 generated the fixtures. No external analysis provider was used.

Target and artifact context

Synthetic little-endian ELF32 ET_REL header with no program or section tables, plus bare, partial, complete, and newline-truncated trailer variants. The complete fixture contains the arbitrary three-byte payload abc; it is not a cryptographically valid PKCS#7 object, and this workflow does not validate it.

Interface

CLI

Earliest failure stage

Unknown

Relevant output or evidence

Observed CLI results, initially obtained from full JSON and repeated with the filtered reproduction above:

Fixture	Bytes	Exit	Signature result
header	52	0	`absent`, no reason
magic-only	28	1	`invalid_request`; `invalid_format`; `Native directory range is truncated or outside the file`
bare-magic	80	0	`unsupported`; `signature_id_type_not_pkcs7`
partial-info	86	0	`unsupported`; `signature_id_type_not_pkcs7`
complete	95	0	`present`; magic offset 67/bytes 28; info offset 55/bytes 12; payload offset 52/bytes 3
no-newline	94	0	`absent`, no reason

The full-JSON runs reported applicability: "applicable" for every ELF fixture. The complete payload's reported SHA-256 was ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad. All runs had empty stderr. Additional 28-, 32-, and 39-byte ELF-prefix/magic probes also failed the ELF range check.

Source evidence at the stated baseline:

Expected-source locator: docs/kernel-modules.md:94-99 lists the trailer reasons; lines 109-110 separately state that malformed ELF headers return no partial metadata.
Failure-source locators: src/native/elf/KernelModuleParser.ts:415-437 recognizes the complete suffix and requires its offset to be below 12 for the truncation reason. Lines 511-516 validate ELF first, and line 593 parses the signature afterward.
Header bound: src/native/metadata/ElfImage.ts:19 delegates to the shared directory reader; src/native/metadata/NativeSectionDirectory.ts:106-110 requires 52 or 64 bytes, with out-of-file requests rejected at lines 86-93.
Existing intended fallback: src/native/elf/KernelModuleParser.test.ts:388-400 expects signature_length_inconsistent for its own ELF-plus-bare-magic fixture. This report does not challenge that runtime behavior.

Evidence provenance: executed public CLI probes plus a source-derived reachability proof. Local verification: static-proof-confirmed, with executed fixture controls. Reproduction completeness: complete for the documented-reason mismatch; runtime MCP execution and real signed modules were not tested.

Analysis or suspected cause

The magic is 28 bytes. Returning the truncation reason requires a total file length from 28 through 39 bytes. Successful ELF admission requires at least 52 bytes, so any suffix recognized after admission has an offset of at least 24, already beyond the less-than-12 guard. Compression and non-relocatable ELF paths return earlier.

The sole production caller of the parser is src/native/elf/KernelModuleProvider.ts:69. CLI and MCP use that provider through src/composition/binaryDiagnostics.ts:55-56; src/server/registerKernelModuleTool.ts calls the same service. The MCP reachability conclusion is source-derived, not an executed MCP result.

Additional context

Duplicate searches covered open and closed issues, all PR states including merged PRs, and issue comments. Issue #7324 and PR #7491 address only the separate 27-versus-28 magic-length wording error. Merged PR #7010 introduced this operation. Their bodies and comments did not identify this unreachable reason. No matching report was found.

Proposed restoration check: the guide no longer presents this reason as reachable while ELF validation and the executed complete-trailer result retain their current behavior. No source changes or restoration checks were performed.

Triage assessment

Impact level: P3
Assessment status: supported
Impact basis: The established defect is a documented diagnostic that no admitted input can return; no consequential runtime failure was demonstrated.
Workaround status: available
Workaround basis: Callers can use the actual typed ELF error or signature reason returned by the unchanged CLI rather than expecting the unreachable reason.

Originally created by @coygeek on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7670 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Documentation ### Observed behavior The kernel-module guide lists `signature_trailer_truncated` as the result for an appended magic with fewer than 12 preceding bytes. Source inspection establishes that this reason cannot be returned through the supported operation: an input satisfying that condition is too short to pass the earlier ELF-header read. I ran `node scripts/rea.mjs inspect-kernel-module <fixture> --json` with synthetic local files. A minimum 52-byte ELF32 header was accepted, an ELF32 header followed immediately by the magic returned `signature_id_type_not_pkcs7`, and a complete trailer returned `present`. A magic-only file failed ELF validation. These executions corroborate the source finding; they do not establish a separate runtime parsing defect. ### Reproduction 1. Use the stated built checkout and its pinned Node runtime. Run the following from the repository root. It creates inert fixtures and isolated state, blocks package-manager execution, inspects only kernel-module metadata, and removes its temporary files. This reduced sequence was executed once after an initial independent probe of the same six fixture layouts. ```sh set -u repo="$PWD" node_bin="$(dirname "$(node -p process.execPath)")" work=$(mktemp -d) trap 'rm -rf "$work"' EXIT python3 - "$work" <<'PY' import pathlib, struct, sys work = pathlib.Path(sys.argv[1]) for name in ('home', 'config', 'data', 'cache', 'state', 'temp', 'bin'): (work / name).mkdir() for name in ('npx', 'npm', 'bun'): tool = work / 'bin' / name tool.write_text('#!/bin/sh\nexit 127\n') tool.chmod(0o755) ident = b'\x7fELF\x01\x01\x01' + bytes(9) elf = struct.pack('<16sHHIIIIIHHHHHH', ident, 1, 3, 1, 0, 0, 0, 0, 52, 0, 0, 40, 0, 0) magic = b'~Module signature appended~\n' info = bytes([0, 0, 2, 0, 0, 0, 0, 0]) + struct.pack('>I', 3) fixtures = { 'header': elf, 'magic-only': magic, 'bare-magic': elf + magic, 'partial-info': elf + info[-6:] + magic, 'complete': elf + b'abc' + info + magic, 'no-newline': elf + b'abc' + info + magic[:-1], } assert len(elf) == 52 and len(magic) == 28 for name, data in fixtures.items(): (work / (name + '.ko')).write_bytes(data) PY for name in header magic-only bare-magic partial-info complete no-newline; do printf '%s\n' "$name" env -i PATH="$work/bin:$node_bin:/usr/bin:/bin" HOME="$work/home" \ XDG_CONFIG_HOME="$work/config" XDG_DATA_HOME="$work/data" \ XDG_CACHE_HOME="$work/cache" XDG_STATE_HOME="$work/state" \ TMPDIR="$work/temp" npm_config_prefix="$work/home/npm-global" \ REA_LOG_LEVEL=silent \ node "$repo/scripts/rea.mjs" inspect-kernel-module "$work/$name.ko" \ --filter-output normalized_result.signature --json printf 'exit=%s\n' "$?" done ``` 2. Compare the returned reasons with the guide and follow the source ordering described under Evidence. None of these commands returns `signature_trailer_truncated`; the source bounds prove that no other admitted ELF can reach that branch either. ### Expected behavior The guide should describe failure reasons that the documented operation can actually produce, or qualify this reason as unreachable under current ELF admission. Correcting or removing this sentence would resolve the documentation issue without changing the parser's treatment of malformed ELF files. ### Impact and scope P3 documentation defect. The guide advertises an unavailable diagnostic, which can mislead readers interpreting malformed-trailer results. I did not demonstrate a consequential inspection failure, incorrect cryptographic validation, or execution of a module. The complete synthetic trailer is identified successfully. This report makes no claim that an ELF plus bare magic must receive a different runtime classification. ### REA version Exact `node scripts/rea.mjs --version` stdout: `6.8.0` followed by a newline. Source baseline: `65f1c447344a423fa2785847dbcea1e9a9e2454a`. ### Runtime and platform Node.js v24.22.1, Darwin arm64. Python 3 generated the fixtures. No external analysis provider was used. ### Target and artifact context Synthetic little-endian ELF32 ET_REL header with no program or section tables, plus bare, partial, complete, and newline-truncated trailer variants. The complete fixture contains the arbitrary three-byte payload `abc`; it is not a cryptographically valid PKCS#7 object, and this workflow does not validate it. ### Interface CLI ### Earliest failure stage Unknown ### Relevant output or evidence Observed CLI results, initially obtained from full JSON and repeated with the filtered reproduction above: | Fixture | Bytes | Exit | Signature result | | --- | ---: | ---: | --- | | header | 52 | 0 | `absent`, no reason | | magic-only | 28 | 1 | `invalid_request`; `invalid_format`; `Native directory range is truncated or outside the file` | | bare-magic | 80 | 0 | `unsupported`; `signature_id_type_not_pkcs7` | | partial-info | 86 | 0 | `unsupported`; `signature_id_type_not_pkcs7` | | complete | 95 | 0 | `present`; magic offset 67/bytes 28; info offset 55/bytes 12; payload offset 52/bytes 3 | | no-newline | 94 | 0 | `absent`, no reason | The full-JSON runs reported `applicability: "applicable"` for every ELF fixture. The complete payload's reported SHA-256 was `ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad`. All runs had empty stderr. Additional 28-, 32-, and 39-byte ELF-prefix/magic probes also failed the ELF range check. Source evidence at the stated baseline: - Expected-source locator: `docs/kernel-modules.md:94-99` lists the trailer reasons; lines 109-110 separately state that malformed ELF headers return no partial metadata. - Failure-source locators: `src/native/elf/KernelModuleParser.ts:415-437` recognizes the complete suffix and requires its offset to be below 12 for the truncation reason. Lines 511-516 validate ELF first, and line 593 parses the signature afterward. - Header bound: `src/native/metadata/ElfImage.ts:19` delegates to the shared directory reader; `src/native/metadata/NativeSectionDirectory.ts:106-110` requires 52 or 64 bytes, with out-of-file requests rejected at lines 86-93. - Existing intended fallback: `src/native/elf/KernelModuleParser.test.ts:388-400` expects `signature_length_inconsistent` for its own ELF-plus-bare-magic fixture. This report does not challenge that runtime behavior. Evidence provenance: executed public CLI probes plus a source-derived reachability proof. Local verification: static-proof-confirmed, with executed fixture controls. Reproduction completeness: complete for the documented-reason mismatch; runtime MCP execution and real signed modules were not tested. ### Analysis or suspected cause The magic is 28 bytes. Returning the truncation reason requires a total file length from 28 through 39 bytes. Successful ELF admission requires at least 52 bytes, so any suffix recognized after admission has an offset of at least 24, already beyond the less-than-12 guard. Compression and non-relocatable ELF paths return earlier. The sole production caller of the parser is `src/native/elf/KernelModuleProvider.ts:69`. CLI and MCP use that provider through `src/composition/binaryDiagnostics.ts:55-56`; `src/server/registerKernelModuleTool.ts` calls the same service. The MCP reachability conclusion is source-derived, not an executed MCP result. ### Additional context Duplicate searches covered open and closed issues, all PR states including merged PRs, and issue comments. [Issue #7324](https://github.com/morluto/rea/issues/7324) and [PR #7491](https://github.com/morluto/rea/pull/7491) address only the separate 27-versus-28 magic-length wording error. [Merged PR #7010](https://github.com/morluto/rea/pull/7010) introduced this operation. Their bodies and comments did not identify this unreachable reason. No matching report was found. Proposed restoration check: the guide no longer presents this reason as reachable while ELF validation and the executed complete-trailer result retain their current behavior. No source changes or restoration checks were performed. ## Triage assessment - Impact level: P3 - Assessment status: supported - Impact basis: The established defect is a documented diagnostic that no admitted input can return; no consequential runtime failure was demonstrated. - Workaround status: available - Workaround basis: Callers can use the actual typed ELF error or signature reason returned by the unchanged CLI rather than expecting the unreachable reason.

bsakaguchi referenced this issue

2026-10-31 01:13:36 +00:00

[PR #4591] feat(ghidra): select the loopback bridge transport on POSIX hosts #6326

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425