Classify jump tables to de-noise the raw-BR PAC audit

The raw-BR/BLR audit flagged every plain indirect branch uniformly,
and on arm64e the overwhelming majority are compiler switch dispatch,
not JOP hazards. Recognize the clang jump-table idiom and dismiss it:

  adrp xB,#pg ; add xB,xB,#off ; ldrsw xE,[xB,xI,lsl #2] ;
  adr xA,#. ; add xT,xA,xE ; br xT

The target is a PC-relative base plus a signed offset read from a
table at a statically materialized (read-only) address -- not a value
loaded from a corruptible pointer -- so a BR to exactly that xT is
benign. jt_advance walks the five producers under strict adjacency
(a fresh ADRP restarts, anything else resets), and check_pac_raw_-
indirect consults it before the BR advances the machine past stage 5.

This inverts armlint's usual bias. Everywhere else a false negative
(missed fold) is the safe error; here the audit's dangerous error is
hiding a real hazard, so the classifier is deliberately narrow. Only
this exact five-producer shape suppresses, and only a BR: a BLR has no
jump-table form and is never dismissed, nor is a BR whose register the
idiom did not just compute. Linker veneers (adr+br, no table load),
the compact ldrb-scaled table variant, and any unclassified branch
stay on the worklist. The surviving-BR detail now reads "verify: not a
recognized jump table" rather than the old blanket "jump tables are
benign".

Recon: the idiom is 100% uniform across the arm64e system binaries.
Every raw BR in ls (1), ssh (3), sshd (3), zsh (22), and bash (18) is
this exact shape -- all 47 byte-verified against the disassembly by an
independent decoder, zero mismatches -- so the classifier empties
their raw-BR worklists completely while leaving every LR-spill and
BLR finding untouched. (This corrects the prior calibration note,
which mislabeled ssh's three as veneers.) On plain-arm64 libcapstone
run with -a pac, nothing is suppressed: its 151 tail-call BRs and 198
BLRs all survive, since none match the ldrsw idiom -- the conservative
result.

Forward-declared decode_add_imm_x/decode_add_x_shifted_lsl for the
recognizer, which sits far above their definitions. Unit test
test_pac_jump_table: the canonical idiom and its commuted final add
suppress; a bare BR, a BLR after the full idiom, a BR to the wrong
register, a one-instruction gap, a missing ADRP, and a mismatched ADD
base all stay flagged. Fixture pac_jump_table (plain arm64 + -a pac
sidecar, so it runs on Linux CI too) holds the dismissed table beside
a surviving BR and BLR. Two existing PAC snapshots absorb the detail
wording change, findings unchanged. Capstone 5.0.9.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gaul

README.md

@@ -307,8 +307,9 @@ arms automatically on arm64e slices, whose ABI mandates FEAT_PAuth
 hardening rather than missed folds; `pac` audits the binary against
 the arm64e-style full pointer-authentication contract (return
 addresses spilled unsigned, unauthenticated `br`/`blr`). Audit
-findings are review items: jump tables and linker veneers
-legitimately appear as raw `br`. The PAC audit arms automatically on
+findings are review items; the raw-`br` check recognizes and
+auto-dismisses the clang jump-table idiom, so what remains is BLRs,
+linker veneers, and genuinely unclassified branches. The PAC audit arms automatically on
 arm64e slices (whose ABI already assumes full signing), so macOS
 system binaries surface their worklist with no flag; a plain arm64
 slice never opted in, so it stays silent unless you pass `-a pac`

TODO.md

@@ -75,7 +75,7 @@ The largest untouched family; none of these need liveness machinery.
 | Split fusion pairs (cmp+b.cond, aese+aesmc same-dest, adrp+add) | Informational: "these should be adjacent"; per-core tables from the SOGs |
 | Render `mov xd, #0` (not `mov xd, xzr`) and `movi v0.2d, #0` (not `movi d0, #0`) | Apple eliminates only those spellings at rename; rendering tweaks to existing checks |
 | Loaded value as base not offset (`[x9, x8]` → `[x8, x9]` when x8 was just loaded) | Apple guide §4.6.7: 1 cycle of address-generation latency |
-| PAC audit v2: jump-table classification to auto-dismiss benign raw `br` (the clang `adrp`/`add __const` + `ldrsw` + `add` + `br` idiom), non-SP LR stores (jmp_buf/context saves; rare -- 0 in bash/dyld, lives in libsystem_c), zero-discriminator forward-edge worklist (`braaz`/`blraaz`; dyld 169, bash 85, ssh 109) | v1 (`-a pac`) covers SP-based spills and flags every raw BR/BLR uniformly. Auto-arm on arm64e slices: **done** for both `-a pac` and `-m pauth` (one cpusubtype gate in scan_macho) |
+| PAC audit v2: non-SP LR stores (jmp_buf/context saves; rare -- 0 in bash/dyld, lives in libsystem_c), zero-discriminator forward-edge worklist (`braaz`/`blraaz`; dyld 169, bash 85, ssh 109), the compact `ldrb`-scaled jump-table variant (`adr` + `ldrb` + `add …, lsl #2` + `br`; seen in Homebrew arm64 libcapstone, unmatched by the ldrsw classifier) | Auto-arm on arm64e slices: **done** for both `-a pac` and `-m pauth`. Jump-table classification for the dominant `ldrsw` idiom: **done** (jt_advance in check_pac_raw_indirect empties the arm64e raw-BR worklist) |
 | LDP/STP synthesized through a scratch ADD (`add x27, xN, #big ; ldp x3, x4, [x27]`) → two plain `ldr`/`str` with the offset folded in | Size-neutral 2-for-2 that drops the ADD from the address dependency chain and frees the scratch; gc emits it whenever a pair offset exceeds ±504 or is 8-misaligned (~13k in go), LLVM for big Q-register spill offsets (~9k in librustc_driver); requires the split offsets to encode (scaled imm12, or LDUR/STUR range) |
 
 ## Window candidates (2026-07 corpus sweep)

analyses.md

@@ -1665,27 +1665,37 @@ Throughout, `datasize` is the operand width in bits: 32 for the W-form,
 * "unauthenticated BR/BLR (PAC audit)": in fully signed code,
   function-pointer transfers go through BRAA(Z)/BLRAA(Z), which
   authenticate the target register before branching; each raw BR/BLR
-  is a JOP hazard. Two benign shapes survive in honest arm64e
-  binaries and a peephole cannot tell them apart, so they appear in
-  the output for human review: jump tables (the target is computed
-  from a bounded index into read-only offsets, not a corruptible
-  pointer -- clang leaves these raw even on arm64e) and linker
-  long-branch veneers (static target, `br x16`). A raw BLR has no
-  benign class and deserves the closest look. The authenticated
+  is a JOP hazard. The dominant benign shape is compiler switch
+  dispatch, and a jump-table classifier keeps it off the worklist:
+  the clang idiom `adrp xB ; add xB,xB,#off ; ldrsw xE,[xB,xI,lsl #2]
+  ; adr xA,#. ; add xT,xA,xE ; br xT` computes its target as a
+  PC-relative base plus a signed offset read from a statically
+  addressed (read-only) table -- not a corruptible pointer -- so a BR
+  to exactly that `xT` is dismissed. The match is strict-adjacency and
+  deliberately narrow: for an audit the dangerous error is hiding a
+  real hazard, so only this exact five-producer shape is recognized.
+  What still surfaces: every BLR (a call has no jump-table form),
+  linker long-branch veneers (`adr`+`br`, no table load), the compact
+  `ldrb`-scaled table variant (a different idiom, left for a future
+  pass), and any genuinely unclassified branch. The authenticated
   variants and RET differ in encoding and never match.
 * Calibration on macOS 26 (Apple's arm64e system binaries): zero
   unsigned LR spills across ls, zsh, ssh, and sshd -- Apple's signing
   is complete, and the window produces no false positives over
-  thousands of signed prologues -- with tiny indirect worklists (ssh:
-  exactly its 3 `br x16` veneer-class branches, address-verified
-  against the disassembly; zsh: 22, the interpreter's computed
-  jumps). Over a binary that never opted into pac-ret the flag
-  reports every function by design -- the assertion is simply false
-  there (Homebrew's plain-arm64 gh: 31109 spills and 20129 raw
-  BLRs, Go emitting neither signing nor authenticated calls). That
-  gap is exactly why the auto-arm gates on cpusubtype rather than
-  firing everywhere: the four system binaries above are arm64e and
-  now surface their worklists with no flag, while gh and the other
+  thousands of signed prologues. Every raw BR in these four is the
+  clang jump-table idiom (ls 1, ssh 3, sshd 3, zsh 22, bash 18 --
+  each of the 47 byte-verified against the disassembly, zero
+  mismatches), so the classifier empties the raw-BR worklist
+  entirely; what would remain on other binaries is veneers, the
+  `ldrb` variant, or real hazards. Over a binary that never opted
+  into pac-ret the LR-spill flag reports every function by design --
+  the assertion is simply false there (Homebrew's plain-arm64 gh:
+  31109 spills and 20129 raw BLRs, Go emitting neither signing nor
+  authenticated calls; its jump-table BRs use a different idiom and
+  stay flagged too). That gap is exactly why the auto-arm gates on
+  cpusubtype rather than firing everywhere: the four system binaries
+  above are arm64e and now surface their worklists with no flag,
+  while gh and the other
   Homebrew arm64 binaries stay silent unless `-a pac` is asked for
   explicitly.
 

armlint.c

@@ -468,6 +468,22 @@ struct armlint_state {
     // x30 (check_pac_lr_spill; reset by any control transfer).
     unsigned pac_sign_recent;
 
+    // Jump-table recognizer for the PAC raw-BR audit
+    // (check_pac_raw_indirect). The clang switch idiom
+    //   adrp xB,#pg ; add xB,xB,#off ; ldrsw xE,[xB,xI,lsl #2] ;
+    //   adr xA,#. ; add xT,xA,xE ; br xT
+    // computes the branch target from a PC-relative base plus a
+    // signed offset read from a statically-addressed table, so it is
+    // not a corruptible-pointer transfer and is auto-dismissed.
+    // jt_stage counts matched producers (1..5) under strict
+    // adjacency; the *_reg fields carry the live registers between
+    // stages. jt_page_reg serves the adrp/add/ldrsw base.
+    unsigned jt_stage;
+    unsigned jt_page_reg;
+    unsigned jt_offset_reg;
+    unsigned jt_adr_reg;
+    unsigned jt_target_reg;
+
     // LDXR/STXR retry-loop progress for the LSE fold (-m lse):
     // stage 1 after the exclusive load, stage 2 after the middle ALU
     // op, stage 3 after the store-exclusive (lse_is_swp marks the
@@ -1353,6 +1369,7 @@ bool armlint_flush(armlint_state *state, armlint_finding *out)
     state->pending_sgn_active = false;
     state->aut_active = false;
     state->pac_sign_recent = 0;
+    state->jt_stage = 0;
     state->lse_stage = 0;
     state->pending_lse_active = false;
     state->pending_fp_active = false;
@@ -5788,21 +5805,107 @@ bool check_pac_lr_spill(armlint_state *state, const cs_insn *insn,
     return found;
 }
 
+// Defined below, near the addressing-mode folds; forward-declared for
+// the jump-table recognizer.
+static bool decode_add_imm_x(uint32_t op, unsigned *out_rd,
+                             unsigned *out_rn, uint32_t *out_imm);
+static bool decode_add_x_shifted_lsl(uint32_t op, unsigned *out_rd,
+                                     unsigned *out_rn, unsigned *out_rm,
+                                     unsigned *out_shift);
+
+// Advance the jump-table recognizer by one instruction. Each producer
+// of the clang switch idiom moves jt_stage forward under strict
+// adjacency; a fresh ADRP always restarts the match, and anything else
+// resets it. After the fifth producer (stage 5) jt_target_reg names
+// the register the BR will read. The BR is consulted before this runs,
+// so reaching stage 5 here and then seeing the branch is what closes
+// the match.
+static void jt_advance(armlint_state *state, uint32_t op)
+{
+    unsigned rd, rn, rm, shift;
+    uint32_t imm;
+    switch (state->jt_stage) {
+    case 1:
+        // add xB, xB, #off -- the table base, same register as the ADRP.
+        if (decode_add_imm_x(op, &rd, &rn, &imm)
+                && rd == state->jt_page_reg && rn == state->jt_page_reg) {
+            state->jt_stage = 2;
+            return;
+        }
+        break;
+    case 2:
+        // ldrsw xE, [xB, xI, lsl #2] off the table base: register
+        // offset (bit 21), option:S == 0b0111 (LSL #2, sign-extended
+        // word), base == jt_page_reg.
+        if ((op & 0xFFE00C00u) == 0xB8A00800u
+                && ((op >> 12) & 0xFu) == 0x7u
+                && ((op >> 5) & 0x1Fu) == state->jt_page_reg) {
+            state->jt_offset_reg = op & 0x1Fu;
+            state->jt_stage = 3;
+            return;
+        }
+        break;
+    case 3:
+        // adr xA, #. -- the PC-relative base the offsets are added to.
+        if ((op & 0x9F000000u) == 0x10000000u) {
+            state->jt_adr_reg = op & 0x1Fu;
+            state->jt_stage = 4;
+            return;
+        }
+        break;
+    case 4:
+        // add xT, xA, xE (either operand order): target = base + offset.
+        if (decode_add_x_shifted_lsl(op, &rd, &rn, &rm, &shift)
+                && shift == 0
+                && ((rn == state->jt_adr_reg && rm == state->jt_offset_reg)
+                 || (rn == state->jt_offset_reg && rm == state->jt_adr_reg))) {
+            state->jt_target_reg = rd;
+            state->jt_stage = 5;
+            return;
+        }
+        break;
+    default:
+        break;
+    }
+    // No advance from the current stage: a fresh ADRP starts a new
+    // candidate table, anything else (including the closing BR) resets.
+    if ((op & 0x9F000000u) == 0x90000000u) {
+        state->jt_page_reg = op & 0x1Fu;
+        state->jt_stage = 1;
+    } else {
+        state->jt_stage = 0;
+    }
+}
+
 bool check_pac_raw_indirect(armlint_state *state, const cs_insn *insn,
                             size_t offset, armlint_finding *out)
 {
     if (insn->size != 4 || !(state->features & ARMLINT_AUDIT_PAC)) {
+        state->jt_stage = 0;
         return false;
     }
 
     uint32_t op = insn_word(insn);
     bool is_br = (op & 0xFFFFFC1Fu) == 0xD61F0000u;
     bool is_blr = (op & 0xFFFFFC1Fu) == 0xD63F0000u;
+    unsigned rn = (op >> 5) & 0x1Fu;
+
+    // A BR to exactly the register the jump-table idiom just computed
+    // is a read-only-table dispatch, not a corruptible-pointer
+    // transfer -- dismiss it. Consult the recognizer before advancing
+    // it past this instruction. Only BR is ever a jump table: a BLR is
+    // a call and has no benign class, so it is never suppressed.
+    bool benign_jt = is_br && state->jt_stage == 5u
+        && rn == state->jt_target_reg;
+    jt_advance(state, op);
+
     if (!is_br && !is_blr) {
         return false;
     }
+    if (benign_jt) {
+        return false;
+    }
 
-    unsigned rn = (op >> 5) & 0x1Fu;
     out->name = "unauthenticated BR/BLR (PAC audit)";
     out->start_offset = offset;
     out->insn_count = 1;
@@ -5812,7 +5915,7 @@ bool check_pac_raw_indirect(armlint_state *state, const cs_insn *insn,
             "-> blraaz x%u (verify the discriminator)", rn);
     } else {
         snprintf(out->detail, sizeof(out->detail),
-            "-> braaz x%u (jump tables are benign)", rn);
+            "-> braaz x%u (verify: not a recognized jump table)", rn);
     }
     snprintf(out->lines[0], sizeof(out->lines[0]),
         "%s %s", insn->mnemonic, insn->op_str);

armlint.h

@@ -539,14 +539,22 @@ bool check_pac_lr_spill(armlint_state *state, const cs_insn *insn,
 // BLR. In fully signed code, function-pointer transfers go through
 // BRAA(Z)/BLRAA(Z), which authenticate the target register before
 // branching; each raw BR/BLR is a JOP hazard. The output is an
-// auditor's worklist, not an error list: two benign shapes survive
-// in honest arm64e binaries and a peephole cannot tell them apart --
-// jump tables (the target is computed from a bounded index into
-// read-only offsets, not a corruptible pointer; clang leaves these
-// raw even on arm64e) and linker long-branch veneers. A raw BLR has
-// no benign class and deserves the closest look. The authenticated
-// variants and RET differ in encoding and never match. Reported as
-// "unauthenticated BR/BLR (PAC audit)".
+// auditor's worklist, not an error list, and a jump-table classifier
+// keeps compiler switch dispatch off it: the clang idiom
+//   adrp xB,#pg ; add xB,xB,#off ; ldrsw xE,[xB,xI,lsl #2] ;
+//   adr xA,#. ; add xT,xA,xE ; br xT
+// computes its target as a PC-relative base plus a signed offset read
+// from a table at a statically materialized (read-only) address --
+// not a corruptible pointer -- so a BR to exactly that xT is
+// dismissed. The match is strict-adjacency and conservative: the
+// dangerous direction for an audit is hiding a real hazard, so only
+// this exact five-producer shape is recognized. A BLR is never
+// dismissed (a call has no jump-table form), nor is any BR whose
+// register was not just computed by the idiom -- so linker veneers
+// (adr+br, no table load) and the compact ldrb-scaled table variant
+// stay flagged, as does any genuinely unclassified branch. The
+// authenticated variants and RET differ in encoding and never match.
+// Reported as "unauthenticated BR/BLR (PAC audit)".
 bool check_pac_raw_indirect(armlint_state *state, const cs_insn *insn,
                             size_t offset, armlint_finding *out);
 

armlint_test.c

@@ -10377,6 +10377,19 @@ static void blraaz_(uint8_t out[4], unsigned rn)
     write_le32(out, 0xD63F081Fu | ((rn & 0x1Fu) << 5));
 }
 
+// LDRSW Xt, [Xn, Xm, lsl #2] -- register offset, sign-extended word.
+// Base 0xB8A00800 with option=011 (UXTX/LSL), S=1: bits 15:12 = 0b0111.
+static void ldrsw_reg_lsl2(uint8_t out[4], unsigned rt, unsigned rn,
+                           unsigned rm)
+{
+    uint32_t op = 0xB8A00800u
+        | ((rm & 0x1Fu) << 16)
+        | (0x7u << 12)
+        | ((rn & 0x1Fu) << 5)
+        | (rt & 0x1Fu);
+    write_le32(out, op);
+}
+
 static void test_cssc_minmax(void)
 {
     uint8_t code[12];
@@ -11526,6 +11539,88 @@ static void test_pac_audit(void)
     assert(run_pac_audit_check(code, 12) == 2);
 }
 
+// The raw-BR audit dismisses the clang jump-table idiom: adrp/add of a
+// table base, an ldrsw of a signed offset indexed off it, an adr for
+// the PC-relative base, an add combining them, then br. The target is
+// a read-only-table dispatch, not a corruptible pointer.
+static void test_pac_jump_table(void)
+{
+    uint8_t code[28];
+
+    // The canonical idiom -- suppressed, no finding.
+    adrp_x(&code[0], 17, 1);
+    add_x_imm(&code[4], 17, 17, 0x100);
+    ldrsw_reg_lsl2(&code[8], 16, 17, 16);   // ldrsw x16, [x17, x16, lsl #2]
+    adr_(&code[12], 17, 0);
+    add_x(&code[16], 16, 17, 16);           // add x16, x17, x16
+    br_(&code[20], 16);
+    assert(run_pac_audit_check(code, 24) == 0);
+
+    // The final add's operands commute: add x16, x16, x17 also folds.
+    adrp_x(&code[0], 17, 1);
+    add_x_imm(&code[4], 17, 17, 0x100);
+    ldrsw_reg_lsl2(&code[8], 16, 17, 16);
+    adr_(&code[12], 17, 0);
+    add_x(&code[16], 16, 16, 17);
+    br_(&code[20], 16);
+    assert(run_pac_audit_check(code, 24) == 0);
+
+    // Negative: a bare BR with no preceding idiom stays flagged.
+    br_(&code[0], 9);
+    assert(run_pac_audit_check(code, 4) == 1);
+
+    // Negative: a BLR after the full idiom is never a jump table --
+    // a call has no benign class, so it is still flagged.
+    adrp_x(&code[0], 17, 1);
+    add_x_imm(&code[4], 17, 17, 0x100);
+    ldrsw_reg_lsl2(&code[8], 16, 17, 16);
+    adr_(&code[12], 17, 0);
+    add_x(&code[16], 16, 17, 16);
+    blr_(&code[20], 16);
+    ret_(&code[24]);
+    assert(run_pac_audit_check(code, 28) == 1);
+
+    // Negative: the branch reads a register the idiom did not compute
+    // (the target is x16; branching x17 is a different value).
+    adrp_x(&code[0], 17, 1);
+    add_x_imm(&code[4], 17, 17, 0x100);
+    ldrsw_reg_lsl2(&code[8], 16, 17, 16);
+    adr_(&code[12], 17, 0);
+    add_x(&code[16], 16, 17, 16);
+    br_(&code[20], 17);
+    assert(run_pac_audit_check(code, 24) == 1);
+
+    // Negative: a gap breaks the strict adjacency the idiom requires.
+    adrp_x(&code[0], 17, 1);
+    add_x_imm(&code[4], 17, 17, 0x100);
+    ldrsw_reg_lsl2(&code[8], 16, 17, 16);
+    adr_(&code[12], 17, 0);
+    add_x(&code[16], 16, 17, 16);
+    nop_insn(&code[20]);
+    br_(&code[24], 16);
+    assert(run_pac_audit_check(code, 28) == 1);
+
+    // Negative: no ADRP anchoring the table base -- the sequence could
+    // load its offset off an attacker-controlled register, so it is
+    // not recognized and stays flagged.
+    add_x_imm(&code[0], 17, 17, 0x100);
+    ldrsw_reg_lsl2(&code[4], 16, 17, 16);
+    adr_(&code[8], 17, 0);
+    add_x(&code[12], 16, 17, 16);
+    br_(&code[16], 16);
+    assert(run_pac_audit_check(code, 20) == 1);
+
+    // Negative: the ADD base register is not the ADRP's, so the table
+    // base is unproven.
+    adrp_x(&code[0], 17, 1);
+    add_x_imm(&code[4], 17, 18, 0x100);     // add x17, x18, #.. (Rn != adrp)
+    ldrsw_reg_lsl2(&code[8], 16, 17, 16);
+    adr_(&code[12], 17, 0);
+    add_x(&code[16], 16, 17, 16);
+    br_(&code[20], 16);
+    assert(run_pac_audit_check(code, 24) == 1);
+}
+
 // check_br_x30: an indirect branch through the link register is a
 // spelled-out RET.
 static void test_br_x30(void)
@@ -13023,6 +13118,7 @@ int main(void)
     test_add_stlr_fold();
     test_aut_ret();
     test_pac_audit();
+    test_pac_jump_table();
     test_br_x30();
     test_branch_to_next();
     test_lse_rmw();

fixtures/pac_audit.expected

@@ -10,7 +10,7 @@ LR spill without PACIASP/PACIBSP (PAC audit) at offset: 0x44: -> pacibsp before
 unauthenticated BR/BLR (PAC audit) at offset: 0x58: -> blraaz x8 (verify the discriminator) (1 instructions)
   blr x8
 
-unauthenticated BR/BLR (PAC audit) at offset: 0x5c: -> braaz x9 (jump tables are benign) (1 instructions)
+unauthenticated BR/BLR (PAC audit) at offset: 0x5c: -> braaz x9 (verify: not a recognized jump table) (1 instructions)
   br x9
 
 Optimization opportunities by type:

fixtures/pac_autoarm_arm64e.expected

@@ -4,7 +4,7 @@ LR spill without PACIASP/PACIBSP (PAC audit) at offset: 0x10: -> pacibsp before
 unauthenticated BR/BLR (PAC audit) at offset: 0x1c: -> blraaz x9 (verify the discriminator) (1 instructions)
   blr x9
 
-unauthenticated BR/BLR (PAC audit) at offset: 0x20: -> braaz x8 (jump tables are benign) (1 instructions)
+unauthenticated BR/BLR (PAC audit) at offset: 0x20: -> braaz x8 (verify: not a recognized jump table) (1 instructions)
   br x8
 
 Optimization opportunities by type: