render: carry the hole-aware slot count into json and markdown

The memory-KASLR windows (direct map, vmalloc, vmemmap) exported only
min/max, so a machine consumer could see the window but not how many
candidates it holds. That number is not derivable downstream: interior
C_EXCLUDE holes are carved at read time inside quantity_slots() and never
reach the wire, so (max - min) / align yields the hole-blind figure with no
route to the real one. Emit slots and entropy_bits on each json region and
in the markdown row, matching what the text readout already prints.

The speculative sub-window gains its own slots for the same reason: json
exported likely.min and likely.max while dropping how many candidates
survive inside them.

The regression test seeds an eight-slot-wide window with a stored count of
seven, so a renderer that recomputed from the bounds emits nine and fails.

Author: bcoles

src/render/json.c

@@ -397,16 +397,22 @@ void render_json(const struct summary *s) {
     struct {
       const char *name;
       unsigned long min, max, lmin, lmax;
+      unsigned long slots, lslots;
+      int bits;
     } regions[] = {
         {"virt_page_offset_base", s->kaslr.virt_page_offset_min,
          s->kaslr.virt_page_offset_max, s->kaslr.virt_page_offset_likely_min,
-         s->kaslr.virt_page_offset_likely_max},
+         s->kaslr.virt_page_offset_likely_max, s->kaslr.virt_page_offset_slots,
+         s->kaslr.virt_page_offset_likely_slots,
+         s->kaslr.virt_page_offset_bits},
         {"virt_vmalloc_base", s->kaslr.virt_vmalloc_min,
          s->kaslr.virt_vmalloc_max, s->kaslr.virt_vmalloc_likely_min,
-         s->kaslr.virt_vmalloc_likely_max},
+         s->kaslr.virt_vmalloc_likely_max, s->kaslr.virt_vmalloc_slots,
+         s->kaslr.virt_vmalloc_likely_slots, s->kaslr.virt_vmalloc_bits},
         {"virt_vmemmap_base", s->kaslr.virt_vmemmap_min,
          s->kaslr.virt_vmemmap_max, s->kaslr.virt_vmemmap_likely_min,
-         s->kaslr.virt_vmemmap_likely_max},
+         s->kaslr.virt_vmemmap_likely_max, s->kaslr.virt_vmemmap_slots,
+         s->kaslr.virt_vmemmap_likely_slots, s->kaslr.virt_vmemmap_bits},
     };
     for (size_t i = 0; i < sizeof(regions) / sizeof(regions[0]); i++) {
       if (!regions[i].min && !regions[i].max)
@@ -422,13 +428,23 @@ void render_json(const struct summary *s) {
         printf("\"0x%016lx\"", regions[i].max);
       else
         printf("null");
+      /* The hole-aware candidate count and its residual entropy. A consumer
+       * cannot derive these from min/max: interior C_EXCLUDE holes are carved
+       * at read time inside quantity_slots() and never appear on the wire, so
+       * (max - min) / align is the hole-blind number, not this one. */
+      if (regions[i].slots > 0)
+        printf(", \"slots\": %lu, \"entropy_bits\": %d", regions[i].slots,
+               regions[i].bits);
       /* Speculative sub-window from the all-signals snapshot; subset of
        * [min, max] and may be wrong. Absent unless a sub-floor signal narrowed
        * the region. */
-      if (regions[i].lmax || regions[i].lmin)
-        printf(", \"likely\": { \"min\": \"0x%016lx\", \"max\": \"0x%016lx\", "
-               "\"speculative\": true }",
+      if (regions[i].lmax || regions[i].lmin) {
+        printf(", \"likely\": { \"min\": \"0x%016lx\", \"max\": \"0x%016lx\"",
                regions[i].lmin, regions[i].lmax);
+        if (regions[i].lslots > 0)
+          printf(", \"slots\": %lu", regions[i].lslots);
+        printf(", \"speculative\": true }");
+      }
       printf(" }");
       first = 0;
     }

src/render/markdown.c

@@ -73,7 +73,8 @@ static void print_group_sources(enum kasld_addr_type type,
  * arch-specific RANDOMIZE_MEMORY_ALIGN, which the table omits for brevity). */
 static void md_memory_kaslr_row(const char *name, unsigned long min,
                                 unsigned long max, unsigned long lmin,
-                                unsigned long lmax) {
+                                unsigned long lmax, unsigned long slots,
+                                int bits) {
   if (!min && !max)
     return;
   if (min && max && min > max)
@@ -84,6 +85,12 @@ static void md_memory_kaslr_row(const char *name, unsigned long min,
     printf("| %s | <= `0x%016lx` |\n", name, max);
   else if (min == max)
     printf("| %s | `0x%016lx` (pinned) |\n", name, min);
+  else if (slots > 0)
+    /* The hole-aware candidate count and its residual entropy, which a reader
+     * cannot derive from the bounds: interior excludes are carved at read time
+     * and never surface, so (max - min) / align is the hole-blind figure. */
+    printf("| %s | `0x%016lx` - `0x%016lx` (%lu slots, ~%d bits) |\n", name,
+           min, max, slots, bits);
   else
     printf("| %s | `0x%016lx` - `0x%016lx` |\n", name, min, max);
   /* Speculative sub-window from the all-signals snapshot (subset of the row
@@ -304,16 +311,19 @@ void render_markdown(const struct summary *s) {
       printf("| Phys/Virt coupling | %s |\n", kasld_coupling_descr());
 
     /* Memory KASLR (CONFIG_RANDOMIZE_MEMORY) region bounds. */
-    md_memory_kaslr_row("Direct map base", s->kaslr.virt_page_offset_min,
-                        s->kaslr.virt_page_offset_max,
-                        s->kaslr.virt_page_offset_likely_min,
-                        s->kaslr.virt_page_offset_likely_max);
+    md_memory_kaslr_row(
+        "Direct map base", s->kaslr.virt_page_offset_min,
+        s->kaslr.virt_page_offset_max, s->kaslr.virt_page_offset_likely_min,
+        s->kaslr.virt_page_offset_likely_max, s->kaslr.virt_page_offset_slots,
+        s->kaslr.virt_page_offset_bits);
     md_memory_kaslr_row(
         "vmalloc base", s->kaslr.virt_vmalloc_min, s->kaslr.virt_vmalloc_max,
-        s->kaslr.virt_vmalloc_likely_min, s->kaslr.virt_vmalloc_likely_max);
+        s->kaslr.virt_vmalloc_likely_min, s->kaslr.virt_vmalloc_likely_max,
+        s->kaslr.virt_vmalloc_slots, s->kaslr.virt_vmalloc_bits);
     md_memory_kaslr_row(
         "vmemmap base", s->kaslr.virt_vmemmap_min, s->kaslr.virt_vmemmap_max,
-        s->kaslr.virt_vmemmap_likely_min, s->kaslr.virt_vmemmap_likely_max);
+        s->kaslr.virt_vmemmap_likely_min, s->kaslr.virt_vmemmap_likely_max,
+        s->kaslr.virt_vmemmap_slots, s->kaslr.virt_vmemmap_bits);
 
     printf("\n");
   }

tests/test_render.c

@@ -828,6 +828,39 @@ static void test_render_memory_kaslr_uses_stored_slots(void) {
   assert(strstr(render_cap, "7 slots") != NULL);
 }
 
+/* json and markdown must carry the hole-aware candidate count for the
+ * memory-KASLR windows. A consumer cannot recompute it: interior C_EXCLUDE
+ * holes are carved at read time inside quantity_slots() and never reach the
+ * wire, so (max - min) / align is the hole-blind figure, not this one. */
+static void test_render_memory_kaslr_slots_reach_machine_formats(void) {
+#if RANDOMIZE_MEMORY_ALIGN > 0
+  struct summary s;
+  reset_results();
+  num_comp_logs = 0;
+  num_scalar_facts = 0;
+  memset(&s, 0, sizeof(s));
+  s.kaslr.vslots = 60;
+  s.kaslr.vbits = 6;
+  unsigned long align = (unsigned long)RANDOMIZE_MEMORY_ALIGN;
+  s.kaslr.virt_page_offset_min = (unsigned long)PAGE_OFFSET_BASE_L4;
+  s.kaslr.virt_page_offset_max =
+      (unsigned long)PAGE_OFFSET_BASE_L4 + 8ul * align;
+  s.kaslr.virt_page_offset_slots = 7; /* engine value; a naive width gives 9 */
+  s.kaslr.virt_page_offset_bits = 3;
+
+  set_render_mode(1, 0, 0); /* json */
+  capture_stdout(wrap_render_summary, &s);
+  assert(strstr(render_cap, "\"slots\": 7") != NULL);
+  assert(strstr(render_cap, "\"entropy_bits\": 3") != NULL);
+
+  set_render_mode(0, 0, 1); /* markdown */
+  capture_stdout(wrap_render_summary, &s);
+  assert(strstr(render_cap, "7 slots") != NULL);
+  assert(strstr(render_cap, "~3 bits") != NULL);
+  set_render_mode(0, 0, 0);
+#endif
+}
+
 /* A KASLR-disabled base is a proven pin, not a speculative "likely" value: the
  * word "Likely" must not prefix the kernel image base. */
 static void test_render_disabled_base_not_labeled_likely(void) {
@@ -2495,6 +2528,7 @@ int main(void) {
   RUN(test_render_directmap_base_promoted);
   RUN(test_render_directmap_base_promoted_unbounded);
   RUN(test_render_entropy_states_its_baseline);
+  RUN(test_render_memory_kaslr_slots_reach_machine_formats);
   RUN(test_render_window_row_always_graded);
   RUN(test_render_coupling_gated);
   RUN(test_render_markdown_text_order_caution);