engine: model PAGE_OFFSET as a per-architecture bracket

PAGE_OFFSET was treated as a constant the analysing build could
substitute for the target's. On the architectures where the split is a
build choice (x86_32, arm32, ppc32) that is the wrong number, and it
leaked into rules, components and renderers alike. Q_PAGE_OFFSET is now
resolved within a per-arch bracket, measured at runtime where possible:
mmap binary-searches TASK_SIZE to page granularity, and components floor
leaked pointers on that measurement rather than on a compile-time value.
ppc32 loses its false invariant pin, which widens its guaranteed windows
and stops excluding the in-tree 2G and 2.75G builds.

Two arch axes replace flags that were standing in for questions they do
not answer:

  LINEAR_MAP_ANCHOR  which physical address the kernel maps at
                     PAGE_OFFSET, and so where a rule may read it from.
                     arm64 places memstart_addr away from the DRAM base
                     by an amount nothing unprivileged recovers, so the
                     phys/virt synthesis declines there instead of
                     reconstructing a base that is wrong by gigabytes.
  MODULES_ANCHOR     what the module band is fixed to. Four alternatives
                     that were three booleans plus a magnitude, kept
                     exclusive by hand-written pairwise checks; the
                     checks are gone and a misspelt value no longer
                     compiles to a silent default.

Components emit facts, not derivations: the compile-time linear-map
projection no longer reaches the evidence set, where it was reconstructed
back into "corroboration" for the constant it came from. Rules read the
DRAM base through one accessor rather than four copies of a scan.

Two soundness violations, both found by live boots and neither visible to
the host suite: an s390 bound promoted to a pin kept the slack a bound
was entitled to, landing one image offset below _text; and riscv64
derived a text slot from a kaslr-seed the kernel had not consumed,
pinning a fresh wrong address on every nokaslr boot.

Guards: no rule or component substitutes the compile-time constant, no
renderer prints a layout default as an answer, the DRAM base is read only
through its accessor, and a guard whose scope comes back empty now fails
instead of reporting a clean tree it never examined.

The published matrix is regenerated. Every reader profile is now shown on
every cell, including where it changed nothing — that is a result, and
suppressing it made an untested cell indistinguishable from a tested one.

Author: bcoles

Makefile

@@ -411,6 +411,16 @@ $(TEST_ALIGN_BIN): $(TEST_DIR)/test_align.c $(HDRS) | $(TEST_OBJ_DIR)
 	$(call ccv,CCLD,$@)
 	$(Q)$(CC) $(ALL_CFLAGS) $(ALL_LDFLAGS) -I$(SRC_DIR) $(TEST_DIR)/test_align.c -o $@
 
+# TASK_SIZE probe test (header-only): drives the boundary search and gap
+# detection in task_size.h with a synthetic address space (an injected step, no
+# mmap), so the pure logic runs on any host. Covers the porous / untrusted paths
+# a normal-kernel VM boot cannot reach. No .c sources to link.
+TEST_TS_BIN := $(TEST_OBJ_DIR)/test_task_size
+
+$(TEST_TS_BIN): $(TEST_DIR)/test_task_size.c $(HDRS) | $(TEST_OBJ_DIR)
+	$(call ccv,CCLD,$@)
+	$(Q)$(CC) $(ALL_CFLAGS) $(ALL_LDFLAGS) -I$(SRC_DIR) $(TEST_DIR)/test_task_size.c -o $@
+
 # Prefetch scan edge-detection test (header-only): drives
 # prefetch_scan_find_edge() with synthetic timing profiles. The x86_64-only
 # header makes the suite inert on other hosts. No .c sources to link.
@@ -600,7 +610,7 @@ $(TEST_PARSERS_BIN): $(TEST_DIR)/test_sysfs_parsers.c $(TEST_PARSERS_SRCS) $(HDR
 	$(Q)$(CC) $(ALL_CFLAGS) $(ALL_LDFLAGS) -I$(SRC_DIR) $(TEST_DIR)/test_sysfs_parsers.c -o $@
 
 .PHONY: test
-test : $(KASLD_BIN) $(TEST_BIN) $(TEST_RENDER_BIN) $(TEST_EST_BIN) $(TEST_EV_BIN) $(TEST_ALIGN_BIN) $(TEST_PREFETCH_SCAN_BIN) $(TEST_CPU_BIN) $(TEST_OUTCOME_BIN) $(TEST_TEXT_ORDER_BIN) $(TEST_KIMG_BIN) $(TEST_ENG_BIN) $(TEST_INT_BIN) $(TEST_DMESG_BIN) $(TEST_BACKTRACE_BIN) $(TEST_BOOTCFG_BIN) $(TEST_KASLRDIS_BIN) $(TEST_DTMEM_BIN) $(TEST_SOCKPTR_BIN) $(TEST_TIMERLIST_BIN) $(TEST_BTF_BIN) $(TEST_DMESG_RESV_BIN) $(TEST_BPE820_BIN) $(TEST_PARSERS_BIN) $(TEST_KCORE_BIN)
+test : $(KASLD_BIN) $(TEST_BIN) $(TEST_RENDER_BIN) $(TEST_EST_BIN) $(TEST_EV_BIN) $(TEST_ALIGN_BIN) $(TEST_TS_BIN) $(TEST_PREFETCH_SCAN_BIN) $(TEST_CPU_BIN) $(TEST_OUTCOME_BIN) $(TEST_TEXT_ORDER_BIN) $(TEST_KIMG_BIN) $(TEST_ENG_BIN) $(TEST_INT_BIN) $(TEST_DMESG_BIN) $(TEST_BACKTRACE_BIN) $(TEST_BOOTCFG_BIN) $(TEST_KASLRDIS_BIN) $(TEST_DTMEM_BIN) $(TEST_SOCKPTR_BIN) $(TEST_TIMERLIST_BIN) $(TEST_BTF_BIN) $(TEST_DMESG_RESV_BIN) $(TEST_BPE820_BIN) $(TEST_PARSERS_BIN) $(TEST_KCORE_BIN)
 	@$(TEST_DIR)/run-all
 	@$(TEST_DIR)/check-render-width
 	@$(MAKE) --no-print-directory lint
@@ -625,7 +635,10 @@ lint :
 	@$(TEST_DIR)/check-text-region
 	@$(TEST_DIR)/check-confidence-floor
 	@$(TEST_DIR)/check-lattice-seam
+	@$(TEST_DIR)/check-page-offset-substitution
+	@$(TEST_DIR)/check-render-default
 	@$(TEST_DIR)/check-image-size
+	@$(TEST_DIR)/check-dram-base
 	@$(TEST_DIR)/check-fdt-unflatten
 	@$(TEST_DIR)/check-ksymoff
 	@$(TEST_DIR)/check-manpages

docs/bypass-techniques.md

@@ -382,7 +382,7 @@ space directly, without reading any files or exploiting vulnerabilities.
 
 The following KASLD components use brute-force probing:
 
-* [mmap_brute_vmsplit.c](../src/components/mmap_brute_vmsplit.c) — determines `PAGE_OFFSET` (vmsplit) on 32-bit systems by mapping pages across the address space until failure
+* [mmap_brute_vmsplit.c](../src/components/mmap_brute_vmsplit.c) — locates the user/kernel split (`TASK_SIZE`) on 32-bit systems by binary-searching the address space for the lowest page `mmap` refuses, which is `PAGE_OFFSET` (vmsplit) itself on x86_32 and a lower bound on it elsewhere
 
 ## Weak entropy
 

docs/kaslr.md

@@ -143,7 +143,8 @@ KERNEL_IMAGE_SIZE` with no gap, so the ceiling is hard.
 — the common one. Sub-48 configs place the image higher and randomize over a
 smaller window, since `KIMAGE_VADDR = _PAGE_END(VA_BITS_MIN) + module-region
 size` and `_PAGE_END = -(1 << (VA_BITS_MIN − 1))`: 4K 3-level (`VA_BITS = 39`,
-common on Android) → `0xffffffc080000000`, 64K 2-level (42), 16K 3-level (47).
+common on Android) → `0xffffffc080000000`, 64K 2-level (42), 16K 3-level (47),
+and 16K 2-level (36, `EXPERT`-gated).
 KASLD detects the running `VA_BITS` with an mmap boundary probe
 (`mmap_arm64_va_bits`) and resolves the per-config text band and entropy
 accordingly.

docs/reproducibility.md

@@ -89,8 +89,12 @@ when available (`HAVE_PTHREAD`), matching the normal build.
 
 ### Static guards (`make lint`)
 
-`make test` finishes by running `make lint` — static-analysis guards that assert
-source invariants the unit tests can't, with no compiled test binary. Run them
+`make test` finishes by running `make lint` — guards that assert source
+invariants the unit tests can't. Most are pure text over `src/`, so they need no
+build and run in a second; three are not, and it matters when the tree must stay
+frozen: `check-truncation` compiles a translation unit for i686,
+`check-hash-parity` builds `tests/check_hash_parity.c`, and `check-render-width`
+and `check-baseline` execute already-built binaries. Run them
 alone with `make lint` (fast; no driver build). Each exits non-zero on failure,
 and `make` halts on the first.
 
@@ -108,9 +112,12 @@ and `make` halts on the first.
 | `check-text-floor` | no component rolls its own text-base floor — they must use the `api.h` helper |
 | `check-shellcheck` | shellcheck over the `extra/` helper scripts |
 | `check-confidence-floor` | no engine rule pins the *guaranteed* window from a guess — a sub-floor signal may shape `likely` only, outside the reviewed allowlist |
-| `check-lattice-seam` | quantities whose lattice varies by architecture (`Q_PAGE_OFFSET`, `Q_VA_BITS`) are read through `quantity_pinned/window/admits/narrowed`, never through `.lo` / `.hi`. `struct estimate` means different things per lattice — on a finite set `lo` is a live-candidate bitmask and `hi` is unused — so a direct read is correct only for the lattice it was written against, which is not a property of the source when the same file compiles both ways. Nothing would fail loudly: a bitmask read as an address is a small integer, so the result is a plausible wrong answer rather than a crash. The pointer alias is discovered from its binding rather than assumed to be named `po`, so renaming it cannot slip a read past |
+| `check-lattice-seam` | the quantities held to the estimate accessors (`Q_PAGE_OFFSET`, `Q_VA_BITS`) are read through `quantity_pinned/window/admits/narrowed`, never through `.lo` / `.hi`. `struct estimate` means different things per lattice — on a finite set `lo` is a live-candidate bitmask and `hi` is unused — and which lattice a quantity uses is declared once in the quantity table, so a direct read hard-codes an answer the reader never asked for. Nothing would fail loudly: a bitmask read as an address is a small integer, so the result is a plausible wrong answer rather than a crash. The pointer alias is discovered from its binding rather than assumed to be named `po`, so renaming it cannot slip a read past |
+| `check-page-offset-substitution` | no engine rule or leak component substitutes the compile-time `PAGE_OFFSET` for the target's linear-map base. That constant describes the analysing build, not the kernel under examination, and on the VMSPLIT arches the two differ routinely — code that reaches for it is asserting the split it was compiled with. The failure is invisible: it compiles everywhere, passes on the whole default-split corpus, and is off by exactly the gap between two build configurations, which is zero on every machine anyone tests. In a rule, an equality must read the resolved `Q_PAGE_OFFSET` via `quantity_pinned()`, and a bound may instead use `PAGE_OFFSET_MAX` (upper) or `PAGE_OFFSET_MIN` (lower), which hold against every target and need no resolution. A component runs before inference and can never see an estimate, so it measures the boundary instead — `kasld_kernel_pointer_floor()` for the user/kernel split, `kasld_page_offset_floor()` for a region-tagged bound. Comments and string literals are stripped first, and `#if` / `#elif` lines are exempt by construction (a constant expression cannot call an accessor, which is why the band assertions keep `PAGE_OFFSET` a plain scalar), so only C code counts |
+| `check-render-default` | no output format names a compile-time layout default (`PAGE_OFFSET`, `KERNEL_VIRT_TEXT_DEFAULT`) in code. A renderer printing an address asserts it, and these are link-time constants of the analysing build rather than measurements of the target — presenting one as the answer states a wrong address at full confidence on any kernel built differently, which has happened twice in two different renderers. Showing a default *as* a default is fine via the published layout field; using the linear-map base as an answer goes through `kasld_page_offset_if_known()`, which yields the constant only where a single base is admissible. No exceptions — a new one means that accessor needs extending |
 | `check-text-region` | the `KERNEL_TEXT` vs `KERNEL_IMAGE` base contract holds — only reviewed emitters may publish a `_stext` base |
 | `check-image-size` | the kernel image size is read only through the evidence accessors, never re-derived in a component |
+| `check-dram-base` | where physical RAM begins is read only through `evidence_lowest_dram_base()`, never re-scanned in a rule. Four rules need it, and on the architectures whose kernel sets its physical offset from the base of DRAM that value *is* the address mapped at `PAGE_OFFSET` — so two rules disagreeing about it anchor the linear map differently and shift a guaranteed window rather than widening one. The filter is the substance: `REGION_RAM` with `POS_BASE` and nothing else, which is the kernel's account of its own memory rather than firmware's account of the board, and a bank the kernel rejected would drag the anchor below the real one — the dangerous direction, since one consumer emits `C_EQUALS`. Before the accessor existed the same loop was copied into every caller and the comments promised an agreement nothing enforced |
 | `check-hash-parity` | every hashed offset-table row's key recomputes to the stored value under the shipped `kasld_fnv1a64()`, so the runtime hash and the offline generator's cannot drift apart |
 | `check-manpages` | the set of long options in each program's `--help` exactly matches the set its man page documents, so a new or removed flag cannot skip its manual entry |
 | `check-version` | the version-carrying files stay in step, so a release cannot ship a binary claiming one version while the man pages claim another |
@@ -122,6 +129,8 @@ and `make` halts on the first.
 | `check-render-parity` | the text readout, the markdown report and JSON name the same set of resolved quantities for a given run. The Layout row model exists so no two formats can describe one resolved state differently, but it only binds a format that consults it: the no-randomization postures once returned before the model was built and then hardcoded the kernel image base, so a quantity the engine had pinned reached JSON while both readouts omitted it. Compares names, never values — formats may present the same bound differently (the text block snaps a window to the alignment grid, markdown prints the raw edges) — and requires every quantity to have a name mapping, so adding one forces stating how each format names it |
 | `check-guard-docs` | this table lists exactly the guards `make lint` runs — the same parity check `check-manpages` applies to flags, applied to the guard list itself |
 | `check-readout-docs` | documented sample output uses the renderer's current vocabulary and fits 100 columns (live output is measured separately by `check-render-width`) — the README and `docs/` carry hand-maintained copies of rendered output with nothing tying them to the renderer, so a rename or column change silently leaves them describing a version of the tool that no longer exists |
+| `hardening-fixtures` | the `-H` hardening advisor holds its structural invariants when driven over the captured x86_64 sysroots. `test_render.c` covers the meta → gate → suggestion logic by seeding component logs synthetically; this drives the REAL binary over real captures, which is the path that regressed before. Not named `check-*`: it exercises behaviour over fixtures rather than asserting a source invariant, but `make lint` runs it and it is part of that contract |
+| `cli-flags` | the argument parser, chiefly short-flag bundling (`-fq` == `-f -q`), which `main()`'s option loop cannot be unit-tested for (`main` is compiled out under `-DKASLD_TESTING`). Same note on the name as above |
 
 `check-truncation` needs `i686-linux-gnu-gcc` and `check-shellcheck` needs
 `shellcheck`; both **skip cleanly** (exit 0) when their tool is absent, so
@@ -339,7 +348,7 @@ inferred range contains the kernel's true text base. Where
 `extra/validate-bundle` validates a single captured system offline, this
 validates live kernels
 across architectures and reader-privilege profiles
-(`default` / `kptr-hidden` / `perf-open` / `dmesg-open` / `hardened` / `nokaslr`).
+(`default` / `kptr-hidden` / `perf-open` / `dmesg-open` / `bpf-open` / `hardened` / `nokaslr`).
 
 Unlike replay (layer 2) — which runs offline over captured fixtures and
 only checks that KASLD parses and runs — this boots a real kernel, so it

docs/testing.md

@@ -121,13 +121,6 @@ int main(void) {
     kasld_result_sample(KASLD_TYPE_PHYS, REGION_RAM, (unsigned long)addr, label,
                         CONF_PARSED);
     count++;
-
-#ifdef phys_to_directmap_virt
-    unsigned long virt = phys_to_directmap_virt((unsigned long)addr);
-    kasld_found("acpi_mrrm %s: directmap va = 0x%016lx", label, virt);
-    kasld_result_sample(KASLD_TYPE_VIRT, REGION_DIRECTMAP, virt, label,
-                        CONF_PARSED);
-#endif
   }
   closedir(d);
 

src/components/acpi_mrrm.c

@@ -65,9 +65,10 @@ int main(void) {
 
 #if PAGE_OFFSET_FROM_CONFIG
   /* Detect PAGE_OFFSET (32-bit vmsplit). CONFIG_PAGE_OFFSET equals the runtime
-   * page_offset only on PAGE_OFFSET_FROM_CONFIG arches (x86_32, arm32); pinning
-   * Q_PAGE_OFFSET to it via page_offset_from_landmark's C_EQUALS would exclude
-   * the truth on arches whose CONFIG_PAGE_OFFSET differs from the running base.
+   * page_offset only on PAGE_OFFSET_FROM_CONFIG arches (x86_32, arm32, ppc32);
+   * pinning Q_PAGE_OFFSET to it via page_offset_from_landmark's C_EQUALS would
+   * exclude the truth on arches whose CONFIG_PAGE_OFFSET differs from the
+   * running base.
    * (The properly gated scalar path is bootconfig_facts ->
    * page_offset_from_config.) */
   unsigned long virt_page_offset = get_kconfig_page_offset(fp);

src/components/boot_config.c

@@ -272,27 +272,6 @@ int main(void) {
                               CONF_PARSED);
         }
       }
-
-#ifdef phys_to_directmap_virt
-      if (lo != ~0ul) {
-        unsigned long virt = phys_to_directmap_virt(lo);
-        kasld_info("possible direct-map virtual address (low):  0x%016lx",
-                   virt);
-        kasld_result_base(KASLD_TYPE_VIRT, REGION_DIRECTMAP, virt, NULL,
-                          CONF_PARSED);
-      }
-      if (hi) {
-        unsigned long virt = phys_to_directmap_virt(hi);
-        kasld_info("possible direct-map virtual address (high): 0x%016lx",
-                   virt);
-        kasld_result_top(KASLD_TYPE_VIRT, REGION_DIRECTMAP, virt, NULL,
-                         CONF_PARSED);
-      }
-#else
-      kasld_info(
-          "note: phys and virt KASLR are decoupled on this arch; "
-          "cannot derive kernel text virtual address from physical leak");
-#endif
     }
   }
 
@@ -329,11 +308,5 @@ int main(void) {
                      (unsigned long)initrd_start, (unsigned long)initrd_end,
                      NULL, CONF_PARSED);
 
-#ifdef phys_to_directmap_virt
-  unsigned long virt = phys_to_directmap_virt((unsigned long)initrd_start);
-  kasld_info("possible direct-map virtual address: 0x%016lx", virt);
-  kasld_result_base(KASLD_TYPE_VIRT, REGION_DIRECTMAP, virt, NULL, CONF_PARSED);
-#endif
-
   return 0;
 }

src/components/boot_params_e820.c

@@ -167,14 +167,6 @@ int main(void) {
    * instance name so the table reads "acpi_table:Cpu0Ist". */
   kasld_result_sample(KASLD_TYPE_VIRT, REGION_ACPI_TABLE, s.addr, s.label,
                       CONF_PARSED);
-#ifdef directmap_virt_to_phys
-  {
-    unsigned long phys = directmap_virt_to_phys(s.addr);
-    kasld_info("  possible physical address: 0x%016lx", phys);
-    kasld_result_sample(KASLD_TYPE_PHYS, REGION_ACPI_TABLE, phys, s.label,
-                        CONF_PARSED);
-  }
-#endif
 
   return 0;
 }

src/components/dmesg_acpi_dynamic_ssdt.c

@@ -418,19 +418,6 @@ int main(void) {
       kasld_result_sample(KASLD_TYPE_PHYS, REGION_RAM, ctx.cr3, "cr3",
                           CONF_PARSED);
     }
-#if defined(phys_to_directmap_virt) && TEXT_TRACKS_DIRECTMAP
-    /* Coupled arches: project the CR3 phys to its direct-map virtual address.
-     * Defensive — CR3 is x86-only and x86 is decoupled, so this is unreached in
-     * practice — but kept correct: swapper → .bss virt, otherwise a generic
-     * direct-map landmark. */
-    {
-      unsigned long virt = phys_to_directmap_virt(ctx.cr3);
-      enum kasld_region r =
-          ctx.cr3_swapper ? REGION_KERNEL_BSS : REGION_DIRECTMAP;
-      kasld_info("possible direct-map virtual address: %lx", virt);
-      kasld_result_sample(KASLD_TYPE_VIRT, r, virt, "cr3", CONF_PARSED);
-    }
-#endif
   }
 
   if (ctx.directmap) {