`arc4random_buf()` error path silently swallowed on macOS

[deeprnd]

Bug Description

`ulong*` → `uint64_t*` casts on fiat-crypto function calls violate strict aliasing rules. When struct fields of type `ulong*` (defined as `typedef unsigned long` in `src/util/fd_util_base.h:325`) are cast to `uint64_t*` and passed to `fiat_` functions, the compiler assumes the `uint64_t` pointer only aliases `uint64_t` data. Under `-O3 -ffast-math`, the compiler may reorder or deduplicate loads, silently corrupting cryptographic arithmetic.

Affected Files

• `src/ballet/bn254/fd_bn254_field_inl.h` — lines 103, 110, 147, 182, 189, 226, 227
• `src/ballet/bn254/fd_bn254_scalar.h` — lines 51, 58, 66, 76, 83
• `src/ballet/ed25519/ref/fd_f25519.h` — lines 38–138

Call Sites

All call `fiat_bn254_`, `fiat_bn254_scalar_`, and `fiat_25519_` with `(uint64_t)r->limbs` or `(uint64_t*)r->el` casts:

// fd_bn254_field_inl.h:103
fiat_bn254_from_montgomery( (uint64_t *)r->limbs, (uint64_t const *)a->limbs );
// fd_f25519.h:38
fiat_25519_carry_mul( (uint64_t *)r->el, (uint64_t *)a->el, (uint64_t *)b->el );

The struct members `limbs` and `el` are `ulong*`, not `uint64_t*`.

Impact

• ed25519 signature verification/signing could produce incorrect results
• BN254 pairing math (used in zero-knowledge proofs) could silently corrupt
• Results differ between compiler versions and optimization levels
• Untestable via CI — requires macOS runtime with crypto operations to reproduce

Historical Context

This exact issue caused a regression that was reverted in PR #801 (`uint64_t*` → `ulong*` strict aliasing regression). The revert suggests the correct fix was not found — the casts remain and the underlying aliasing problem persists.

Proposed Fix Direction

Use `(void*)(uintptr_t)` cast as an intermediate step, or restructure types to use `uint64_t*` consistently, or add `attribute((may_alias))` to the type definition. The key is that the cast must not create an intermediate typed pointer that the compiler can reason about for aliasing purposes.

Source

Reviewed from `doc/execution/testing/audit-macos.md` (audit of V2.22.S1 platform port PR).

---

Migrated from deeprnd/tickoni-archive#803