From 5459dd4ec8dd0209598ef3e309c18b67f47a716a Mon Sep 17 00:00:00 2001 From: alice Date: Sun, 13 Sep 2026 19:42:17 +0000 Subject: [PATCH 1/2] vms-387: fix bg-recv-length-zeroed dead anchor -- targets path drifted kernel/ -> kernel-core/ The bg-recv-length-zeroed negctl was an active selftest FAIL ("its sed anchor no longer matches the source tree"). Root cause: NOT the sed text -- the file src/kernel/vms_bg.c moved to src/kernel-core/vms_bg.c, so cmd_apply built a non-existent path from the stale `targets` field and found no target. The sed text (`a->len = (uint32_t)n;` inside vms_ioctl_bg_recv, range-anchored ^long vms_ioctl_bg_recv..^}$ to exclude the identical line in vms_ioctl_bg_send), its suites_red (test_syssvc_bg_echo test_syssvc_ssh_kex), and the /* negctl: bg-recv-length-zeroed */ source markers are all still valid -- the target text is present at src/kernel-core/vms_bg.c and the selftest source-copy set already includes kernel-core. Only the targets path string was stale. Fix: targets kernel/vms_bg.c -> kernel-core/vms_bg.c. The injection is the minimal NON-fatal one (success branch a->len = (uint32_t)n; -> = 0; a 0-byte recv returns SS$_NORMAL, the guest boots, only the byte-exact echo assertion reddens). selftest: bg-recv-length-zeroed now injects + no-op-reapply has teeth. Runtime exact-red set proven separately via negctl-adhoc before flagging for reap. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01HMDFjHCqxDuXgbyxNU572h --- tests/qemu/facility_defects.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/qemu/facility_defects.sh b/tests/qemu/facility_defects.sh index c97df209f..f181c2e32 100755 --- a/tests/qemu/facility_defects.sh +++ b/tests/qemu/facility_defects.sh @@ -6271,7 +6271,7 @@ EOF bg-recv-length-zeroed) case "$_f" in facility) echo "INET pseudo-device BGn: -- the IO\$_READVBLK (recv) handler of the executive-resident BGn: driver (vms_ioctl_bg_recv, src/kernel/vms_bg.c, vms-527). The first network facility: a VMS program \$ASSIGNs TCPIP\$DEVICE:, \$QIOs connect/send/recv/close to a TCP peer, and the socket lives IN the executive (host in-kernel socket API), not in userspace.";; - targets) echo "kernel/vms_bg.c";; + targets) echo "kernel-core/vms_bg.c";; suites_red) echo "test_syssvc_bg_echo test_syssvc_ssh_kex";; blind_suites) echo "";; blind_why) echo "";; From c37b300277ba341335f8c80f88d0e9562df4a09b Mon Sep 17 00:00:00 2001 From: alice Date: Mon, 14 Sep 2026 16:55:55 +0000 Subject: [PATCH 2/2] vms-387: scope out test_syssvc_ssh_kex (fake gate) alongside the bg-recv targets fix The bg-recv targets-path fix (kernel/ -> kernel-core/) revived the anchor, and the runtime proof then exposed a pre-existing FAKE GATE: bg-recv-length-zeroed named test_syssvc_ssh_kex in suites_red (+ a source marker), but ssh_kex does NOT redden under recv-length-zero. Measured on the rail: ssh_kex stays green under bg-recv-length-zeroed AND under bgsock-recv-length-zeroed. Root cause: ssh_kex is a full OpenSSH E2E acceptance test whose data path rides the BSD-sockets veneer (ovmx_socket -> BGn: -> $QIO), not the classic vms_ioctl_bg_recv this defect patches, and OpenSSH's own framing/retries absorb a single recv-length fault. ssh_kex was anchored ONLY here, so removing the stale claim would orphan it. Per the never-orphan invariant's preference order, re-anchor was attempted and measured impossible (no single-facility injection reddens it), so it is honestly SCOPED OUT: - SCOPE_OUT_SUITES="test_syssvc_ssh_kex" + scope_out_why documenting it's a full OpenSSH acceptance test, not a per-facility negctl target (kept + run, just not a coverage-gate anchor -- INV-6, no fake anchors). - bg-recv-length-zeroed suites_red -> test_syssvc_bg_echo ONLY; the ssh_kex knock_on_fail + knock_on_why removed; why-note records the measurement. - the /* negctl: bg-recv-length-zeroed */ marker removed from ssh_kex.c. bg_echo (the real can-fail anchor) is unaffected -- it reddens exactly as before. Runtime exact-red set proven separately via negctl-adhoc on the 2700 wall. Co-Authored-By: Claude Opus 4.8 (1M context) --- tests/qemu/facility_defects.sh | 31 +++++++++++++++++++------------ tests/qemu/test_syssvc_ssh_kex.c | 1 - 2 files changed, 19 insertions(+), 13 deletions(-) diff --git a/tests/qemu/facility_defects.sh b/tests/qemu/facility_defects.sh index f181c2e32..31a93b74a 100755 --- a/tests/qemu/facility_defects.sh +++ b/tests/qemu/facility_defects.sh @@ -579,14 +579,24 @@ rms-dirfind-exact-version-ignored" # scoping out. # --------------------------------------------------------------------------- SCOPE_OUT_UNIT_DIRS="" -SCOPE_OUT_SUITES="" +SCOPE_OUT_SUITES="test_syssvc_ssh_kex" scope_out_why() { cat <<'EOF' -(none) -- vms-165 retired the vmsfs.ko VFS driver, which owned the only -executive-independent suites this gate scoped out. Every derived suite now -exercises an executive facility (the vms.ko lock manager / ASTs / event flags / -access modes / Files-11 ACP), so there is nothing to declare out of scope. +test_syssvc_ssh_kex -- a full OpenSSH end-to-end ACCEPTANCE test (its own header: +"THE Rule-9 acceptance for the OpenSSH-on-veneer arc", vms-22a), not a +single-facility negative control. A veneer-linked `ssh` runs a REAL SSH key +exchange + pubkey auth + remote command against a stock in-guest `sshd` over the +BSD-sockets veneer (ovmx_socket/ovmx_connect -> BGn: -> $QIO -> host loopback), +and can EXIT_SKIP when no executive is present. It has NO isolatable single-site +injection: runtime-MEASURED, it does not redden under bg-recv-length-zeroed (it +does not use the classic vms_ioctl_bg_recv path) NOR under bgsock-recv-length- +zeroed (both reddened exactly their own suites, ssh_kex stayed green) -- OpenSSH's +own framing + retries absorb a single recv-length fault, so no per-facility defect +turns it red honestly. Its value is as an integration acceptance test, kept and +run; it is simply not a per-facility negctl target, so it is declared out of the +coverage gate rather than carried as a fake anchor (INV-6). Prior state: it was +named ONLY by bg-recv-length-zeroed, whose claim over it was stale/non-reddening. EOF } @@ -6272,20 +6282,17 @@ EOF case "$_f" in facility) echo "INET pseudo-device BGn: -- the IO\$_READVBLK (recv) handler of the executive-resident BGn: driver (vms_ioctl_bg_recv, src/kernel/vms_bg.c, vms-527). The first network facility: a VMS program \$ASSIGNs TCPIP\$DEVICE:, \$QIOs connect/send/recv/close to a TCP peer, and the socket lives IN the executive (host in-kernel socket API), not in userspace.";; targets) echo "kernel-core/vms_bg.c";; - suites_red) echo "test_syssvc_bg_echo test_syssvc_ssh_kex";; + suites_red) echo "test_syssvc_bg_echo";; blind_suites) echo "";; blind_why) echo "";; isolation) echo "isolated";; - why) echo "vms_ioctl_bg_recv() reports the received byte count as 0 instead of the count the host kernel's kernel_recvmsg returned, so the echo comes back with a zero IOSB byte count (and the userspace wrapper then copies 0 bytes out). The read still returns SS\$_NORMAL -- a completed recv of nothing is not an error to the driver -- so only the byte-exact echo assertion sees it. One assignment zeroed.";; + why) echo "vms_ioctl_bg_recv() reports the received byte count as 0 instead of the count the host kernel's kernel_recvmsg returned, so the echo comes back with a zero IOSB byte count (and the userspace wrapper then copies 0 bytes out). The read still returns SS\$_NORMAL -- a completed recv of nothing is not an error to the driver -- so only the byte-exact echo assertion sees it. One assignment zeroed. NOTE (vms-387): test_syssvc_ssh_kex was previously named here as a knock-on, but runtime measurement shows it does NOT redden under this defect -- its OpenSSH veneer rides ovmx_socket, not this classic vms_ioctl_bg_recv path, and OpenSSH's own framing absorbs a single recv-length fault. That stale/fake claim is removed; ssh_kex is a full E2E acceptance test declared in SCOPE_OUT_SUITES rather than carried as a fake anchor.";; require_fail) cat <<'EOF' BG $QIO IO$_READVBLK returns the exact bytes the echo peer sent back EOF ;; - knock_on_fail) cat <<'EOF' -the remote command output came back BYTE-EXACT over the veneer (real KEX proven) -EOF - ;; - knock_on_why) echo "test_syssvc_ssh_kex drives the veneer-linked OpenSSH ssh through a REAL SSH KEX + session over BGn:; ssh's packet reads bottom out in this same vms_ioctl_bg_recv. Zeroing the recv count makes ssh read EOF mid-handshake, so the session never completes and OVMX_SSH_OK never returns -- the one-assignment fault reddens the KEX proof as a knock-on of the byte-count echo assertion.";; + knock_on_fail) echo "";; + knock_on_why) echo "";; esac;; tcpip-ftp-get-length-dropped) diff --git a/tests/qemu/test_syssvc_ssh_kex.c b/tests/qemu/test_syssvc_ssh_kex.c index 592b4816b..1624dd29d 100644 --- a/tests/qemu/test_syssvc_ssh_kex.c +++ b/tests/qemu/test_syssvc_ssh_kex.c @@ -266,7 +266,6 @@ int main(void) "veneer-linked ssh completed the SSH handshake + session (exit 0)"); CHECK(!saw_afunix, "NO AF_UNIX socket fd in the ssh process during the handshake -- the socketpair pump is EXCISED; bytes ride the executive seam, not a fabricated Unix socket (vms-9ac)"); - /* negctl: bg-recv-length-zeroed */ CHECK(strstr(buf, "OVMX_SSH_OK") != NULL, "the remote command output came back BYTE-EXACT over the veneer (real KEX proven)"); if (strstr(buf, "OVMX_SSH_OK") == NULL) {