Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/image.c">

<violation number="1" location="src/image.c:1067">
P3: `munmap(elf_buf, elf_buf_len)` is called when `kbox_read_elf_header_window_fd` failed. At that point `elf_buf` is still `NULL` (never assigned by the failing function). The `munmap(NULL, 0)` call is a no-op on Linux but is dead/incorrect code — remove it or guard with `if (elf_buf)`.</violation>
</file>

<file name="src/loader-image.c">

<violation number="1" location="src/loader-image.c:61">
P2: `fail:` path discards the specific `rc` error code and always returns `-1`. Since `rc` is set to meaningful negative errno values at each failure site, this should be `return rc;` to preserve diagnostic information for callers.</violation>
</file>

<file name="src/fd-table.c">

<violation number="1" location="src/fd-table.c:151">
P3: `kbox_fd_table_insert_hostonly` is newly added but has no call sites, so it is dead code and can drift from the real host-only allocation path.</violation>
</file>

<file name="src/probe.c">

<violation number="1" location="src/probe.c:181">
P2: Check `waitpid` return status in the seccomp filter probe; failures/interruption can currently be misclassified as success.</violation>
</file>

<file name="tests/unit/test-syscall-trap.c">

<violation number="1" location="tests/unit/test-syscall-trap.c:451">
P2: Avoid an unbounded blocking `read()` in the test; add a bounded wait so failures don't hang CI.</violation>

<violation number="2" location="tests/unit/test-syscall-trap.c:478">
P2: Poll `has_pending_dispatch` with an atomic load; plain reads race the service thread.</violation>
</file>

<file name="tests/guest/trap-bench.S">

<violation number="1" location="tests/guest/trap-bench.S:18">
P2: The benchmark loop adds per-iteration `push/pop` overhead inside the timed section, which skews the reported getpid latency.</violation>
</file>

<file name="src/procmem.c">

<violation number="1" location="src/procmem.c:141">
P2: `close(fd)` between a failed `pwrite` and the `errno` read can clobber the original error code. Save `errno` before calling `close()`.</violation>
</file>

<file name="src/syscall-trap.c">

<violation number="1" location="src/syscall-trap.c:165">
P0: Incorrect argument register assignment in `rt_sigprocmask` assembly: `sigset_size` is placed in `%rdx` (oldset) instead of `%r10` (sigsetsize), and `%ecx` is zeroed instead of `%r10`. The kernel's 4th syscall argument is `%r10`, not `%rcx`. This will either EINVAL (stale `%r10`) or crash by writing the old sigmask to address `sigset_size`.</violation>

<violation number="2" location="src/syscall-trap.c:438">
P0: Same argument-shuffle bug on aarch64: `sigset_size` is placed in `x2` (oldset) instead of `x3` (sigsetsize), and `x3` is zeroed. This will crash or EINVAL.</violation>

<violation number="3" location="src/syscall-trap.c:998">
P2: When `service_running` is true, `trap_host_write` returns raw kernel error codes (e.g., `-EAGAIN`) without setting the C `errno`. The subsequent `errno == EAGAIN` check is only correct for the libc `write()` path; the raw-syscall path will incorrectly return -1 on a benign `EAGAIN`.</violation>
</file>

<file name="tests/unit/test-rewrite.c">

<violation number="1" location="tests/unit/test-rewrite.c:930">
P2: The classification test is ineffective because it expects the same result for known and unknown syscall numbers, so it cannot catch a broken implementation.</violation>
</file>

<file name="docs/gdb-workflow.md">

<violation number="1" location="docs/gdb-workflow.md:210">
P3: The new dispatch breakpoint description is inaccurate: `kbox-syscall-trace` currently breaks on `kbox_dispatch_syscall` only, not `kbox_dispatch_request`.</violation>
</file>

<file name="src/rewrite.c">

<violation number="1" location="src/rewrite.c:1">
P1: `current[4]` is too small for x86_64 wrapper patches (width 8). The `width > sizeof(current)` guard will reject every x86_64 site, making this function silently fail for x86_64 binaries. Other memfd patching functions in this file use `KBOX_REWRITE_MAX_PATCH_BYTES` for this buffer.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/loader-image.c">

<violation number="1" location="src/loader-image.c:150">
P2: Memory leak: if `record_region` fails, the mapping from `map_region_exact` is never recorded and the `fail` cleanup path (`unmap_recorded_regions`) won't unmap it. Add `munmap(mapped, mapping->size)` before the `goto fail`.</violation>
</file>

<file name="src/elf.c">

<violation number="1" location="src/elf.c:328">
P3: Redundant `memcpy` — `pread_full` on the next line re-reads from offset 0 into the same buffer, overwriting everything that was just copied. Remove the `memcpy` to avoid up to 256 KB of unnecessary work (especially relevant since the comment notes this path can execute inside a SIGSYS handler).</violation>
</file>

<file name="tests/unit/test-syscall-trap.c">

<violation number="1" location="tests/unit/test-syscall-trap.c:447">
P2: Initialize ctx.host_nrs before starting the service thread; the dispatch path dereferences ctx->host_nrs and will crash with the zeroed ctx.</violation>
</file>

<file name="src/procmem.c">

<violation number="1" location="src/procmem.c:97">
P2: Stale `errno` when `pread` returns 0: `errno` is not cleared on success/EOF, so `errno ? -errno : -EIO` may return a stale error code from a prior failed call instead of the intended `-EIO`. Split the check into `n < 0` (use errno) and `n == 0` (return -EIO directly).</violation>
</file>

<file name="src/rewrite.c">

<violation number="1" location="src/rewrite.c:1">
P2: Unsigned underflow in bounds check: `image_len - 8` wraps to `SIZE_MAX - 7` when `image_len < 8`, silently bypassing the guard. Replace with an addition-based comparison to avoid the wraparound.</violation>
</file>

<file name="src/syscall-trap.c">

<violation number="1" location="src/syscall-trap.c:1113">
P2: `service_stop` is read/written across threads without atomics, unlike the other shared flags in this struct (`has_pending_request`, `has_pending_dispatch`) which use `__atomic_load_n`/`__atomic_store_n`. The compiler may hoist the non-atomic load out of the service-thread loop, preventing the thread from seeing the stop flag.</violation>
</file>

<file name="tests/guest/bench-test.c">

<violation number="1" location="tests/guest/bench-test.c:31">
P2: The benchmark silently measures the error path if stat() fails.</violation>

<violation number="2" location="tests/guest/bench-test.c:46">
P2: The benchmark silently ignores open() failures, which can result in measuring the error path and outputting deceptively fast numbers.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/loader-layout.c">

<violation number="1" location="src/loader-layout.c:76">
P2: Missing overflow checks for `load_bias + seg->map_start` (and similar `load_bias +` additions at lines 99, 103, 113). The function uses `__builtin_add_overflow` for `seg->vaddr` arithmetic but performs these bias additions unchecked, which could wrap around with a large load bias. Consider adding overflow checks for consistency with the existing pattern.</violation>
</file>

<file name="src/seccomp-bpf.c">

<violation number="1" location="src/seccomp-bpf.c:672">
P1: Bounds check on `filter[]` runs after all writes complete — if `idx` ever exceeds `MAX_PROG_LEN` during emission, the stack is already corrupted. Move the overflow check into the emit helpers or add a guard before each `filter[idx++]` write, or at minimum assert `idx < MAX_PROG_LEN` at the start of each emit loop iteration.</violation>
</file>

<file name="src/syscall-trap.c">

<violation number="1" location="src/syscall-trap.c:1232">
P0: On x86_64, `host_syscall` reads the syscall number from `REG_RAX` in the ucontext, but the kernel has already overwritten RAX with `-ENOSYS` before delivering SIGSYS for `SECCOMP_RET_TRAP`. This means every CONTINUE-dispatched syscall in trap mode will execute `syscall(-ENOSYS)` instead of the intended syscall. The request struct built earlier by `kbox_syscall_regs_from_sigsys` has the correct number (from `si_syscall`), but `host_syscall` doesn't use it.</violation>
</file>

<file name="tests/unit/test-syscall-trap.c">

<violation number="1" location="tests/unit/test-syscall-trap.c:358">
P2: Initialize `ctx.host_nrs` before calling `kbox_syscall_dispatch_sigsys`; the dispatch path dereferences it unconditionally, so leaving it NULL will crash this test.</violation>
</file>