{ "schema_version": 2, "kind": "pruner-pilot-findings", "status": "published", "drafted_on": "2026-11-11", "published_on": "2026-11-13", "product_version": "0.5.1-pilot", "scope": "one public Cortex-M3 image and one controlled fixture; pilot stage; no customer has run this", "claim_boundary": "The recorded result is a reachability review of one public image under small, stated budgets, and a no-rewrite disposition from a bounded function model. It does not prove whole-machine unreachability, semantic equivalence, or that any code can be safely removed.", "authorization": "none; this snapshot is descriptive", "target": { "name": "ARDUINO-F103-PWM", "description": "P2IM unit-test firmware, STM32F103, Cortex-M3", "repository": "https://github.com/fuzzware-fuzzer/fuzzware-experiments.git", "revision": "1b03b728ea660b777571bf2a6c1ecfa9072f0bf5", "path": "01-access-modeling-for-fuzzing/p2im-unittests/F103/ARDUINO-F103-PWM", "license": "Apache-2.0", "base_address": "0x08000000", "firmware_size_bytes": 25460, "firmware_sha256": "64477d5f6e18f2b1a7af1c7e5997520c8553b9ca14b7cc6e48a7e5d4fcfd1dd6", "elf_sha256": "28126ad04b14d35b5624f8b843900e6e6bb6b18f6fe1fd2a1bc7de778cfb7fe7", "vector_table_bytes": 268, "text_offset": 268, "text_bytes": 23700 }, "observation": { "source": "built-in smoke emulator", "peripheral_model": "a fresh random value on every read at or above 0x40000000", "interrupts_injected": false, "max_instructions": 100000, "timeout_s": 3, "seed": 0, "stop_reason": "count/timeout", "trace_addresses": 84, "imported_traces": 0, "symbolic_budget_s": 1.0, "symbolic_status": "budget", "symbolic_reached_blocks": 6, "symbolic_rescued_blocks": 0, "budget_sweep": [ { "max_instructions": 100000, "timeout_s": 3, "seed": 0, "executed_block_addresses": 84, "stop_reason": "count/timeout", "highest_address": "0x8005d88", "wall_clock_s": 0.1 }, { "max_instructions": 1000000, "timeout_s": 10, "seed": 0, "executed_block_addresses": 84, "stop_reason": "count/timeout", "highest_address": "0x8005d88", "wall_clock_s": 0.5 }, { "max_instructions": 10000000, "timeout_s": 30, "seed": 0, "executed_block_addresses": 84, "stop_reason": "count/timeout", "highest_address": "0x8005d88", "wall_clock_s": 5.2 }, { "max_instructions": 100000, "timeout_s": 3, "seed": 1, "executed_block_addresses": 85, "stop_reason": "count/timeout", "highest_address": "0x8005d88", "wall_clock_s": 0.1 }, { "max_instructions": 100000, "timeout_s": 3, "seed": 2, "executed_block_addresses": 55, "stop_reason": "count/timeout", "highest_address": "0x8005d88", "wall_clock_s": 0.1 }, { "max_instructions": 100000, "timeout_s": 3, "seed": 3, "executed_block_addresses": 53, "stop_reason": "count/timeout", "highest_address": "0x8005d88", "wall_clock_s": 0.1 }, { "max_instructions": 1000000, "timeout_s": 10, "seed": 1, "executed_block_addresses": 85, "stop_reason": "count/timeout", "highest_address": "0x8005d88", "wall_clock_s": 0.5 }, { "max_instructions": 1000000, "timeout_s": 10, "seed": 2, "executed_block_addresses": 55, "stop_reason": "count/timeout", "highest_address": "0x8005d88", "wall_clock_s": 0.5 } ] }, "blocks": { "code_blocks": 2469, "observed": 83, "kept_by_control_flow_only": 1777, "kept": 1860, "unknown": 609, "proved_unreachable": 0, "conflict": 0, "authorized_blocks": 0, "authorized_functions": 0, "bytes_changed": 0, "executed_block_starts_labelled_unknown": 0 }, "functions": { "in_model": 273, "with_keep_evidence": 205, "without_keep_evidence": 68 }, "unknown_inventory": [ { "id": "reachable_only_through_a_stored_address", "label": "Functions reachable only through a stored address", "blocks": 311, "functions": 61, "function_bytes": 3498, "examples": [ "HAL_NVIC_EnableIRQ", "HAL_RCCEx_PeriphCLKConfig", "HAL_RCC_GetSysClockFreq", "HAL_UART_GetState", "HAL_UART_Transmit", "I2C_DMAAbort", "RCC_Delay", "UART_DMAAbortOnError" ] }, { "id": "fragments_inside_functions_that_are_otherwise_kept", "label": "Fragments inside functions that are otherwise kept", "blocks": 198, "functions": 58, "function_bytes": null, "examples": [] }, { "id": "reached_by_direct_flow_in_the_function_model", "label": "Functions the function model reaches by direct calls but the block walk does not", "blocks": 91, "functions": 6, "function_bytes": 1658, "examples": [ "HAL_SYSTICK_CLKSourceConfig", "HAL_UART_Init", "HAL_UART_MspInit", "UART_SetConfig", "pinmap_merge_peripheral", "uart_init" ] }, { "id": "outside_any_function", "label": "Blocks outside any function", "blocks": 8, "functions": null, "function_bytes": null, "examples": [] }, { "id": "unreferenced_in_the_function_model", "label": "Functions nothing refers to", "blocks": 1, "functions": 1, "function_bytes": 12, "examples": [ "_fini" ] } ], "function_model": { "functions": 273, "roots": 54, "vector_and_entry_roots": 22, "edges": 12980, "edges_by_kind": { "direct-branch": 18, "direct-call": 404, "indirect-conservative": 12558 }, "reachable": 273, "excluded": 0, "checker": { "certificate_emitted": false, "disposition": "no-rewrite", "pruner_retry_permitted": false, "status": "verified" }, "assumptions_sha256": "5bd934652281d0871efa70420ce669bb4186dbf48b79d382223d99d61adeccca", "model_sha256": "bbd67ac6d4bd8c9e02f3ebf78425fbb8f80445d7ec91ebda752ec139d73950ca", "closure_proof_sha256": "9c3411406bc6f897b72e0dfcbafbe7576706574854c232697fd43f8c600e4c75", "closure_ladder": [ { "outside": 75, "reachable": 198, "rule": "vector handlers and entry, direct calls and branches only" }, { "outside": 1, "outside_functions": [ { "bytes": 12, "name": "_fini" } ], "reachable": 272, "rule": "plus every function whose address appears anywhere in the image" }, { "outside": 0, "reachable": 273, "rule": "plus all-function successors for each unbounded site (the checked model)" } ], "sites": { "unbounded": 46, "by_class": { "direct_target_outside_model": 1, "other_pc_write": 0, "register_indirect_branch": 2, "register_indirect_call": 29, "table_branch": 6, "undecodable_bytes": 8, "unrecognized_return": 0 }, "genuine_register_indirect_transfers": 31, "functions_holding_sites": 35, "of_those_reachable_by_direct_edges_alone": 35, "roots_holding_a_site": [ "_ZN5Print5writeEPKhj", "__tcf_0", "frame_dummy", "uart_init" ], "conservative_edges": 12558 } }, "ground_truth": { "note": "Upstream states that a trace covering these locations is what passing this unit test means. They are known-live code.", "requirements": [ { "comment": "TIM_PWM || TIMEx_PWMN channel command callback", "line": "27", "requirement": "TIM_CCxNChannelCmd || TIM_CCxChannelCmd", "testcase": "Write" } ], "source": "groundtruth.csv", "source_sha256": "9133d790d384bd7c176418388cdeb259af35522cfa809a610d65e2ecdc1f9983", "symbols": [ { "address": "0x8002ae8", "blocks": 1, "bytes": 28, "found_in_model": true, "function": "TIM_CCxNChannelCmd", "kept": true, "observed_in_the_recorded_mission": false, "requirement": "TIM_CCxNChannelCmd", "verdicts": { "reachable": 1 } }, { "address": "0x8002a3c", "blocks": 1, "bytes": 28, "found_in_model": true, "function": "TIM_CCxChannelCmd", "kept": true, "observed_in_the_recorded_mission": false, "requirement": "TIM_CCxChannelCmd", "verdicts": { "reachable": 1 } } ], "target": "F103/ARDUINO-F103-PWM.elf" }, "fixture": { "external_firmware_result": false, "firmware_size_bytes": 248, "functions": 13, "roots": 4, "edges": 9, "reachable": 8, "excluded": 5, "excluded_names": [ "dead_1", "dead_2", "dead_3", "dead_4", "dead_5" ], "certified_function": "dead_1", "planned_functions": 1, "planned_bytes": 4, "bytes_changed": 4, "changed_offsets": [ "0x42", "0x43", "0x44", "0x45" ], "replay_seeds": 3, "replay_passed": true, "replay_trap_hits": 0, "dispositions": { "dry_run": "REWRITE_APPROVAL_REQUIRED", "applied": "REWRITE_VALIDATED_FOR_TESTED_MISSIONS", "conflict": "BLOCKED_CONFLICT" }, "conflict_count": 1, "conflict_exit_code": 3, "blocks_without_a_certificate": { "code_blocks": 27, "observed": 15, "kept": 17, "unknown": 10, "authorized_blocks": 0 } }, "corrections": { "from_version": "0.5.0-pilot", "to_version": "0.5.1-pilot", "first_reported": { "code_blocks": 2464, "observed": 70, "kept": 459, "unknown": 2005, "executed_block_starts_labelled_unknown": 37, "functions_without_keep_evidence": 192, "functions_dropped_from_the_analysis": [ "__do_global_dtors_aux" ], "vector_table_words": 76, "sites": 66, "returns_listed_as_sites": 20, "edges": 18440, "statically_live_blocks": 396, "statically_live_blocks_note": "recomputed from the unchanged 0.5.0 code; equal to the July record" }, "comparison": { "baseline_bundle_id": "d4a7662a1554cea452ba42cbcab9b29e9690f88987e511aabd512b5c7facd7f1", "current_bundle_id": "7765e6ab1f3dd5382265c93c07c1c4562e19272a83c685e964a8c61c3feb3e91", "same_firmware": true, "changed_verdicts": 1443, "unknown_to_reachable": 1422, "reachable_to_unknown": 21, "blocks_new_to_the_analysis": 5 } }, "july_withdrawn": { "status": "withdrawn", "period": "July 2026", "code_blocks": 2464, "statically_live_blocks": 396, "functions_rewritten": 258, "blocks_rewritten": 1719, "bytes_overwritten_logged": 16814, "bytes_differing": 16395, "image_bytes": 25460, "validation": { "recorded_safe": true, "seeds": 3, "patched_trap_hits": 0, "original_stop_reasons": [ "count/timeout" ], "patched_stop_reasons": [ "UcError@0x0: Invalid instruction (UC_ERR_INSN_INVALID)" ], "patched_runs_ending_in_a_fault": 3 }, "gadget_reduction_claim_percent": 71.9, "marked_functions": [ { "name": "Reset_Handler", "address": "0x8000270", "offset": 624, "bytes": 52, "bytes_differing_in_withdrawn_image": 1 }, { "name": "main", "address": "0x8004a2c", "offset": 18988, "bytes": 32, "bytes_differing_in_withdrawn_image": 26 }, { "name": "setup", "address": "0x8000188", "offset": 392, "bytes": 20, "bytes_differing_in_withdrawn_image": 17 }, { "name": "loop", "address": "0x800019c", "offset": 412, "bytes": 52, "bytes_differing_in_withdrawn_image": 40 }, { "name": "analogWrite", "address": "0x800455c", "offset": 17756, "bytes": 176, "bytes_differing_in_withdrawn_image": 152 }, { "name": "TIM_CCxChannelCmd", "address": "0x8002a3c", "offset": 10812, "bytes": 28, "bytes_differing_in_withdrawn_image": 28 }, { "name": "TIM_CCxNChannelCmd", "address": "0x8002ae8", "offset": 10984, "bytes": 28, "bytes_differing_in_withdrawn_image": 27 } ], "overwritten_ranges": [ [ 309, 40 ], [ 353, 8 ], [ 377, 32 ], [ 413, 40 ], [ 605, 2 ], [ 615, 2 ], [ 675, 2 ], [ 771, 2 ], [ 835, 2 ], [ 851, 2 ], [ 857, 348 ], [ 1225, 308 ], [ 1545, 122 ], [ 1677, 228 ], [ 1913, 340 ], [ 2261, 244 ], [ 2513, 292 ], [ 2945, 24 ], [ 3007, 2 ], [ 3043, 2 ], [ 3049, 28 ], [ 3081, 10 ], [ 3235, 2 ], [ 3245, 468 ], [ 3737, 12 ], [ 3771, 2 ], [ 4465, 342 ], [ 7035, 2 ], [ 7285, 132 ], [ 8127, 2 ], [ 8407, 2 ], [ 8417, 92 ], [ 8875, 2 ], [ 8893, 8 ], [ 8905, 24 ], [ 8937, 24 ], [ 8969, 52 ], [ 9029, 264 ], [ 9305, 232 ], [ 9607, 2 ], [ 9613, 88 ], [ 9705, 96 ], [ 9805, 68 ], [ 9877, 62 ], [ 10321, 116 ], [ 10441, 148 ], [ 10593, 34 ], [ 10641, 244 ], [ 10889, 92 ], [ 10985, 140 ], [ 11129, 560 ], [ 11697, 964 ], [ 12665, 120 ], [ 12791, 26 ], [ 12837, 10 ], [ 12853, 128 ], [ 13005, 24 ], [ 13033, 40 ], [ 13077, 108 ], [ 13201, 80 ], [ 13293, 224 ], [ 13525, 84 ], [ 13681, 508 ], [ 14205, 204 ], [ 14417, 84 ], [ 14505, 2 ], [ 14525, 120 ], [ 14689, 186 ], [ 14911, 2 ], [ 14917, 2 ], [ 14997, 152 ], [ 15165, 84 ], [ 15265, 60 ], [ 15337, 104 ], [ 15503, 2 ], [ 15523, 2 ], [ 15543, 2 ], [ 15563, 2 ], [ 15789, 176 ], [ 16037, 448 ], [ 16525, 340 ], [ 16869, 64 ], [ 16949, 168 ], [ 17133, 32 ], [ 17169, 72 ], [ 17253, 32 ], [ 17289, 28 ], [ 17325, 64 ], [ 17401, 64 ], [ 17483, 2 ], [ 17507, 2 ], [ 17537, 48 ], [ 17597, 56 ], [ 17657, 92 ], [ 17757, 156 ], [ 17933, 36 ], [ 17973, 92 ], [ 18081, 64 ], [ 18153, 236 ], [ 18393, 36 ], [ 18437, 56 ], [ 18497, 20 ], [ 18521, 76 ], [ 18613, 28 ], [ 18649, 96 ], [ 18749, 40 ], [ 18793, 180 ], [ 18989, 26 ], [ 19041, 32 ], [ 19081, 160 ], [ 19349, 16 ], [ 19397, 48 ], [ 19521, 164 ], [ 19689, 180 ], [ 19877, 604 ], [ 20513, 808 ], [ 21329, 44 ], [ 21377, 28 ], [ 21409, 152 ], [ 21573, 204 ], [ 21793, 284 ], [ 22081, 72 ], [ 22171, 62 ], [ 22249, 132 ], [ 22389, 116 ], [ 22509, 256 ], [ 22769, 124 ], [ 22897, 32 ], [ 22933, 172 ], [ 23109, 28 ], [ 23141, 32 ], [ 23177, 28 ], [ 23209, 32 ], [ 23245, 32 ], [ 23281, 156 ], [ 23485, 148 ], [ 23681, 100 ], [ 23813, 100 ], [ 23957, 12 ], [ 24015, 654 ], [ 24763, 82 ], [ 25222, 197 ] ], "overwritten_ranges_note": "offset and length of runs where the withdrawn image differs from the original; runs closer than four bytes are joined" }, "tests": { "python_passing": 192 }, "timing": { "note": "measured once on one workstation; indicative only", "analysis_s": 27.6, "producer_s": 2.2, "checker_s": 2.2 }, "evidence": { "bundle_id": "7765e6ab1f3dd5382265c93c07c1c4562e19272a83c685e964a8c61c3feb3e91", "disposition": "ANALYSIS_ONLY_REVIEW", "signed": false, "assurance_specification_used": true, "exit_policy": { "name": "analysis-only", "passed": true, "reasons": [] }, "toolchain": { "python": "3.12.14", "angr": "10.0.5", "egglog": "14.0.0", "unicorn": "2.1.4", "capstone": "5.0.9", "cryptography": "50.0.2" } }, "source_artifacts": [ { "path": "output/reachability-pilot-20261111/run_summary.json", "sha256": "724c475bc3a25799403ce6a35d2628dfb71735158a20874f5417e1e1aa46f380" }, { "path": "output/reachability-pilot-20261111/gate_results.json", "sha256": "886a77587ea074f0004fcd660b98e396dfbf0f64c0aa31734c4484e9ca8537d9" }, { "path": "output/reachability-pilot-20261111/inventory.json", "sha256": "3340133b3380748383d558b5585696d15aaf4b7b43cd1b243e8364942d9e2609" }, { "path": "output/reachability-pilot-20261111/comparison-0.5.0-to-0.5.1.json", "sha256": "d56e7829e9560e47503e907d1b413d146e94472bfbe70f71159be10e74ff4439" }, { "path": "output/reachability-pilot-20261111/observation-budget-sweep.json", "sha256": "7406741b8d89ff2ae6f6becf5e50fc5412c961a9dd6ce4a70d30a81ecfabe753" }, { "path": "output/finite-model-proof-pilot-20261111/assumptions.json", "sha256": "5bd934652281d0871efa70420ce669bb4186dbf48b79d382223d99d61adeccca" }, { "path": "output/finite-model-proof-pilot-20261111/finite_model.json", "sha256": "bbd67ac6d4bd8c9e02f3ebf78425fbb8f80445d7ec91ebda752ec139d73950ca" }, { "path": "output/finite-model-proof-pilot-20261111/closure_proof.json", "sha256": "9c3411406bc6f897b72e0dfcbafbe7576706574854c232697fd43f8c600e4c75" }, { "path": "output/finite-model-proof-pilot-20261111/checker_report.json", "sha256": "c81115d9b24d8c386e848375fe38fa226800d213a91de19036a83e9527fce17b" }, { "path": "output/proof-gate-fixture-20261111/dry_run/rewrite_plan.json", "sha256": "53739391c29ead6f9dc46e42e61dfe9726ffd3875c36aed5e41ddb649843b92e" }, { "path": "output/proof-gate-fixture-20261111/applied/rewrite_evidence.json", "sha256": "b6eef51ec279b7fb0ce0e74e2e1f32e24e9dfa7f6c4221bd7ee83653ac01b77c" }, { "path": "prototype/example_run/ARDUINO-F103-PWM.evidence_log.json", "sha256": "f3cc15fbb59adfdf36ef4d44aa23b1d0f341e0d95127713484da2e590ef8d852" }, { "path": "output/debloat-eval-20261111/evaluation.json", "sha256": "089c162495014180edf8e86076976156cab098e1e64cbf31f980bc15d84e5e74" }, { "path": "output/debloat-eval-20261111/ARDUINO-F103-PWM/debloat_summary.json", "sha256": "1e6b5d13e6739b7a4240cdf8e560befb6d669723244221291c018e397d0e2edd" }, { "path": "output/debloat-eval-20261111/NUTTX-F103-GPIO/debloat_summary.json", "sha256": "7d37ea8a78fd235f058e2921240498ff340e6e5c277bdd6e2a92884c174ff51d" } ], "debloat": { "status": "experimental", "product_version": "0.6.0-pilot", "proposer": "built-in baseline pattern matcher; no language model was used", "language_model_run_recorded": false, "samples": { "available": 47, "loaded": 11, "completed": 11, "rewritten": 10, "bytes_rewritten": 9456, "replay_failures": 0, "gate_conflicts": 0 }, "pinned_image": { "sample": "ARDUINO-F103-PWM", "image_bytes": 25460, "firmware_sha256": "64477d5f6e18f2b1a7af1c7e5997520c8553b9ca14b7cc6e48a7e5d4fcfd1dd6", "functions": 273, "structured_functions": 273, "claims_accepted": 6, "claims_rejected": 0, "reachable_functions": 272, "excluded_functions": 1, "excluded_bytes": 12, "excluded_names": [ "_fini" ], "gate_conflicts": 0, "decision": "apply", "decision_mode": "automatic, by registered policy", "bytes_rewritten": 12, "first_changed_address": "0x8005d94", "last_changed_address": "0x8005d9f", "replay_seeds": 3, "replay_passed": true, "replay_trap_hits": 0, "replay_blocks_per_seed": { "0": 84, "1": 85, "2": 55 }, "disposition": "REWRITE_VALIDATED_FOR_TESTED_MISSIONS", "seconds": 69.2 }, "largest_rewrite": { "sample": "NUTTX-F103-GPIO", "image_bytes": 46857, "firmware_sha256": "de74406a6dd0c7dc2ad61a8d570d7493387366a030a5b94ec52752c2428558bd", "functions": 446, "structured_functions": 446, "claims_accepted": 5, "claims_rejected": 0, "reachable_functions": 415, "excluded_functions": 31, "excluded_bytes": 2628, "excluded_names": [ "stm32_serial_get_uart", "task_create", "pthread_schedsetup", "sched_have_kugarbage", "sched_have_garbage", "sigprocmask", "sem_destroy", "sem_post", "sigpending", "sigtimedwait", "nxsig_alloc_action", "nxsig_action", "sigaction", "kill", "clock_nanosleep", "clock_gettime", "clock_systimespec", "clock_timespec_subtract", "syslog_write", "sem_init", "sem_setprotocol", "setlogmask", "file_close_detached", "write", "mq_close", "sem_wait", "sem_trywait", "gpio_pin_unregister", "unregister_driver", "inode_unlink", "inode_remove" ], "gate_conflicts": 0, "decision": "apply", "decision_mode": "automatic, by registered policy", "bytes_rewritten": 2562, "first_changed_address": "0x8000fb8", "last_changed_address": "0x800b0d9", "replay_seeds": 3, "replay_passed": true, "replay_trap_hits": 0, "replay_blocks_per_seed": { "0": 336, "1": 337, "2": 334 }, "disposition": "REWRITE_VALIDATED_FOR_TESTED_MISSIONS", "seconds": 123.9 }, "rows": [ { "sample": "ARDUINO-F103-GPIO", "image_bytes": 13952, "functions": 190, "claims_accepted": 3, "excluded_functions": 1, "excluded_bytes": 12, "bytes_rewritten": 12, "replay_passed": true }, { "sample": "ARDUINO-F103-GPIO_INT", "image_bytes": 14500, "functions": 195, "claims_accepted": 4, "excluded_functions": 1, "excluded_bytes": 12, "bytes_rewritten": 12, "replay_passed": true }, { "sample": "ARDUINO-F103-I2C", "image_bytes": 23296, "functions": 259, "claims_accepted": 4, "excluded_functions": 1, "excluded_bytes": 12, "bytes_rewritten": 12, "replay_passed": true }, { "sample": "ARDUINO-F103-PWM", "image_bytes": 25460, "functions": 273, "claims_accepted": 6, "excluded_functions": 1, "excluded_bytes": 12, "bytes_rewritten": 12, "replay_passed": true }, { "sample": "ARDUINO-F103-Serial", "image_bytes": 19924, "functions": 236, "claims_accepted": 3, "excluded_functions": 1, "excluded_bytes": 12, "bytes_rewritten": 12, "replay_passed": true }, { "sample": "ARDUINO-F103-SPI", "image_bytes": 25676, "functions": 259, "claims_accepted": 8, "excluded_functions": 1, "excluded_bytes": 12, "bytes_rewritten": 12, "replay_passed": true }, { "sample": "NUTTX-F103-ADC", "image_bytes": 26672, "functions": 383, "claims_accepted": 2, "excluded_functions": 0, "excluded_bytes": 0, "bytes_rewritten": 0, "replay_passed": null }, { "sample": "NUTTX-F103-GPIO", "image_bytes": 46857, "functions": 446, "claims_accepted": 5, "excluded_functions": 31, "excluded_bytes": 2628, "bytes_rewritten": 2562, "replay_passed": true }, { "sample": "NUTTX-F103-GPIO_INT", "image_bytes": 47393, "functions": 448, "claims_accepted": 5, "excluded_functions": 30, "excluded_bytes": 2570, "bytes_rewritten": 2504, "replay_passed": true }, { "sample": "NUTTX-PWM", "image_bytes": 46576, "functions": 437, "claims_accepted": 6, "excluded_functions": 28, "excluded_bytes": 2380, "bytes_rewritten": 2326, "replay_passed": true }, { "sample": "NUTTX-USART", "image_bytes": 45392, "functions": 426, "claims_accepted": 2, "excluded_functions": 22, "excluded_bytes": 2042, "bytes_rewritten": 1992, "replay_passed": true } ], "assumptions": { "A1-function-inventory": "every address that control can transfer to from outside a function body is the start of an ELF function symbol, and each symbol's extent is the function's body", "A2-stored-code-pointers": "a register-indirect call or branch transfers only to the entry of a function whose address occurs as a four-byte value somewhere in the image, or back to a caller; no code pointer is built by arithmetic, received at run time from outside the image, or read from memory that the image did not initialize", "A3-returns": "a return instruction returns to its caller; the saved return address is intact", "A4-closed-image": "the image is the whole program: nothing executes from memory outside it, no code is modified or generated at run time, and no other program calls into it except through its vector table" }, "claim_boundary": "Changed bytes lie only in functions that a checked closure excludes under the recorded assumptions. Replay covers the tested missions only. This is not a statement about attack surface, and it is not semantic equivalence." } }