{
  "schema": "statefabric/ebpf-object-anatomy/v1",
  "artifact": "ebpf_object_anatomy",
  "what": "what the bytes of sf_gate.bpf.o are, and what a BPF verifier must therefore say, derived here from the object alone and independently of any other lane's run",
  "object": "results/data/statefabric/_ebpf_build/sf_gate.bpf.o",
  "object_sha256": "e3533620dcefca85a174f1cbd78ded86bd0a96fcae161570f7a41b08256efc6d",
  "object_bytes": 4816,
  "controls_ran_first": true,
  "controls": [
    {
      "control": "accept_w0_2_exit",
      "expected": "LOADABLE_AS_PROGRAM",
      "got": "LOADABLE_AS_PROGRAM",
      "n_insns": 2,
      "ok": true
    },
    {
      "control": "reject_r0_eq_r2",
      "expected": "READS_UNINITIALISED_REGISTER",
      "got": "READS_UNINITIALISED_REGISTER",
      "at_insn": 0,
      "reads_uninitialised": [
        2
      ],
      "ok": true
    }
  ],
  "controls_all_passed": true,
  "program_sections": {
    ".text": {
      "bytes": 0,
      "n_insns": 0,
      "verdict": "EMPTY_NO_PROGRAM",
      "detail": "the section carries no instructions",
      "disassembly": [],
      "conditional_jumps": 0,
      "first_uninitialised_read": null
    },
    "classifier": {
      "bytes": 40,
      "n_insns": 5,
      "verdict": "READS_UNINITIALISED_REGISTER",
      "detail": "instruction 0 (r0 = r2) reads R2, which a BPF program entry does not initialise (only R1=ctx and R10=fp are live)",
      "disassembly": [
        "0: (bf) r0 = r2",
        "1: (4f) r4 or= r3",
        "2: (5f) r0 and= r1",
        "3: (5f) r0 and= r4",
        "4: (95) exit"
      ],
      "conditional_jumps": 0,
      "first_uninitialised_read": {
        "insn": 0,
        "register": 2
      }
    },
    "xdp": {
      "bytes": 16,
      "n_insns": 2,
      "verdict": "LOADABLE_AS_PROGRAM",
      "detail": null,
      "disassembly": [
        "0: (b4) w0 = 2",
        "1: (95) exit"
      ],
      "conditional_jumps": 0,
      "first_uninitialised_read": null
    }
  },
  "sections_loadable_as_programs": [
    "xdp"
  ],
  "sections_not_loadable_as_programs": [
    ".text",
    "classifier"
  ],
  "gate_section": "classifier",
  "gate_conditional_jumps": 0,
  "gate_is_loadable_as_a_program": false,
  "loadable_sections_that_contain_the_gate": [],
  "finding": "The object holds one program a kernel will load and one it will not, and they are not the same program. `classifier` IS the proven combiner and is a compiled FUNCTION of four arguments: it reads R2 at instruction 0, and a BPF program entry initialises only R1 and R10, so no verifier can accept it. `xdp` is loadable and returns XDP_PASS in two instructions without consulting the combiner at all. The 200,000-point differential fuzz graded the FUNCTION's logic and is untouched by this; what it never established, and what the entry's own source comment assumed, is that the object is loadable as the gate.",
  "status": "MEASURED",
  "certified": true,
  "elapsed_s": 0.0,
  "generated_utc": "2026-09-04T19:10:02Z",
  "git_rev": "a01bbf5584fa49f2d8e80acd53f64fa3a0c621cc",
  "host_kind": "darwin",
  "producer": "scripts/gen_ebpf_object_anatomy.py"
}