fix(#970): count a CONDITIONALLY-written parameter as a parameter — ARM + RV32 uninitialised-stack-slot leak

[avrabe]

Closes #970.

The correction first: ARM does not fail the way #970 predicted

#970 read ARM's failure off a disassembly listing and expected cw_call(0, 42)
to return param 0's value — an ordinary wrong value — because the demoted
local's str looked like it sat at the branch merge point. Executing it
says otherwise. The beq jumps past the store (capstone-verified on
cb80e60c, --target cortex-m4 --relocatable):

push.w {r4, r5, r6, r7, r8, lr}
sub.w  sp, sp, #8
cmp    r0, #0
beq    +8            ; -> the ldr, skipping the store below
movw   r1, #5
str.w  r1, [sp]      ; INSIDE the then-arm, not at the merge point
ldr.w  r2, [sp]      ; <- on the fall-through path this slot was NEVER written
mov    r0, r2

So ARM has the same uninitialised-frame-slot read as RV32 — the same
information-disclosure shape, and on the plain shape, not only the call one.
This is exactly why the lane executed ARM separately instead of generalising
RV32's evidence.

Red-first, per backend, by execution

Both harnesses poison two distinct words so the mechanism is proven rather
than inferred: every stack word below the entry SP is 0xDEADBEEF, every
argument register the signature does not use is 0xFEEDFACE. "Read an
uninitialised slot" and "read the wrong argument register" therefore cannot be
confused. Measured on cb80e60c:

backend	red	green	memory-poison leaks (red)
ARM Thumb-2	22/38	38/38	12
RV32	22/38	38/38	12

BUG cond_write_param(0x0, 0x2a):       want=0x0000002a got=0xdeadbeef  <- POISON
BUG cw_call(0x0, 0xabcdef01):          want=0xabcdef01 got=0xdeadbeef  <- POISON
BUG cw_last_of_three(0x0, 0x3, 0x4):   want=0x00000007 got=0xdeadbef2
BUG cw_high_param(0x0,...,0x1000,0x2000): want=0x00003000 got=0xdeadceef
ok  cw_loop / guard_* (all 22)         — read-first order already correct here

The failures are exactly the 16 cw_* fall-through vectors; every guard_*
case (the #457 zero-init local, both-arms writes, unconditional write, plain
params) is green in both states, so the differentials are sensitive to the
conditional-write class specifically and not to codegen churn.

The fix

With a declared param count in hand the bound is
min(referenced_locals(ops), declared) — the highest local index the body
touches, clamped by the signature — not the read-first count_params heuristic
capped by it. The old rule was exact in only one direction: the clamp stops a
read-before-write non-param local from being homed in an argument register
(#457), but taking the max over reads only demoted a param written on
one arm of an if. And because the demoted local's first access is a write,
the #457 zero-init skipped it too — hence the uninitialised slot rather than a
zero.

min (not a plain declared override) keeps the leniency for a body that only
touches the first few of many declared params.

referenced_locals moves to synth_core::wasm_op, next to
rewrite_memory_grow_zero and for the same stated reason: #851 landed a private
copy in the aarch64 backend, and shipping two more would make three copies of
one three-line rule that must agree. All three backends now share one
definition; the aarch64 copy is deleted.

Negative control — run both ways, independently

reverted line	ARM oracle	RV32 oracle
ARM only	FAIL 22/38, 12 leaks	PASS 38/38
RV32 only	PASS 38/38	FAIL 22/38, 12 leaks

Reverting one backend's bound reds only that backend's oracle. The two are
independent evidence, not one measurement reported twice.

Floors — measured, not computed

scripts/oracle_run.py reports emulations=38 for each harness, so each
declares # ci-checks: emulations >= 38 — the measured count exactly. The new
CI job closes with the #910 ledger at --min-oracles 2, so deleting or skipping
either step reds the job rather than quietly shrinking what CI asserts.

The summed --min-emulation-floor is deliberately not ratcheted: it is a
floor, the measured total rises 295,773 → 295,849 (both measured by running
oracle_wiring_check.py with and without the two new files) against a pinned
minimum of 295,726, and with several v0.57 lanes adding oracles in parallel a
single shared total is a fan-in conflict. Ratchet it once at release assembly,
together with the ORACLE_WIRING.md table (already stale at 295,621) and both
claims.yaml text pins.

Blast radius

Every scripts/repro/*.wat compiled for both backends (310 fixture ×
backend compilations), sha256 of .text diffed before/after. Exactly three
fixtures change, and no RV32 output changes at all except the new fixture:

fixture	change
cond_write_param_970.wat (arm + rv32)	the new fixture — the fix
aarch64_param_homing_851.wat (arm)	366 → 348 B; contains the same cond_write_param shapes, now smaller (demoted-local frame slots become param registers)
rv32_cmp_select_472.wat (arm)	466 → 466 B, temp renumbering only. Its clamp declares 2 params but references only $a, so the count goes 1 → 2 and temps start at r2 instead of r1. Executed vs wasmtime: identical 44/49 before and after

cond_write_param itself now lowers to 16 bytes with no frame at all
(cmp r0,#0 / beq / movw r2,#5 / mov r1,r2 / mov r0,r1) — the param stays in
its register.

The one place this change widens rather than narrows behaviour is a >4-param
ARM signature. Verified it lands where it should: cw_high_param reads indices
4 and 5 from [sp,#0x18] / [sp,#0x1c] after a push of 6 registers with
frame_size = 0, i.e. frame_size + 24 + nsaa — the caller's frame, the
AAPCS incoming-stack-argument area, not a local slot.

Named residual, deliberately NOT closed

current_func_param_count == None still uses the read-first heuristic. It is
unreachable from the CLI (which always supplies a declared count) but reachable
via the direct compile_function API. Not closed here, on purpose: with no
declared count a write-first index is genuinely ambiguous — a param whose
incoming value is dead, or a non-param local — and both readings can be wrong.
Picking one is a compile_function API-contract decision, not a bug fix, and
inventing a bound to close a gap is the recurring burn this repo has taken
three releases running. It is documented as an honest residual on
CompileConfig::current_func_param_count and on each backend's helper.

Found in passing, filed separately: #973

The byte-identity sweep compiled rv32_cmp_select_472.wat for ARM, which
nothing in CI does, and turned up an unrelated pre-existing ARM miscompile:
a select whose condition is an i64 comparison and whose arms are computed
values always returns the then-arm — the else-arm's register is spilled and
reloaded with the then-arm's value, so both it arms move the same register.
Confirmed independent of this lane: the same 44/49 vectors match wasmtime on
binaries built before and after the #970 fix, with the identical five
failures. Filed as #973 with a minimal repro; not fixed here.

Gates

Each run without a pipe, exit code captured directly:

• cargo test --workspace — rc=0, 2787 passed / 0 failed
• cargo clippy --workspace --all-targets -- -D warnings — rc=0
• cargo fmt --check — rc=0
• python3 scripts/claim_check.py claims.yaml — rc=0, 43/43 claims hold
• python3 scripts/oracle_wiring_check.py --min-emulation-floor 295726 — rc=0,
  161 wired / 7 manual / 0 unwired / 0 undeclared

🤖 Generated with Claude Code

https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!