Symex hardening: z3 simplify pipeline, IRGen parent_function, NULL guards

[pgoodman]

Summary

Bundle of correctness and ergonomics fixes for the symbolic-execution stack and IRGen.

z3 expression hygiene

• New _z3_resize and _z3_byte_at helpers — both no-op when the operand is already the right width.
• _z3_binary / _z3_unary width-coerce both operands to the opcode's declared width via a new _dispatch_op_sized. Fixes integer binary ops (e.g. BIT_OR_16) crashing z3 with sort mismatches when an upstream cast left the rhs at a different width.
• _z3_compare widens to the larger BitVec when widths differ.
• Cast handlers all go through _z3_resize — same-width cast is identity instead of a redundant Extract(N-1, 0, BitVec(N)).
• Every binary / unary / cast / ptr-add result is z3.simplify'd before storage; _shadow_write simplifies before per-byte decomposition. Load/modify/store cycles collapse instead of compounding into deep Concat(Extract, …) trees.

Path API

• path.write_memory(addr, value, size, byte_order=Endian.BIG) now actually handles int (the docstring claimed it did but the code fell through), accepts byte_order= / endian= overrides (both spellings work), defaults to path.byte_order.
• path.write_symbolic gains the same kwarg.
• Endian moved out of events.py into the leaf _types.py. events.py re-exports for back-compat.

PythonPolicy NULL boundary guards

or_none(p) helper substitutes Py_None for a real C NULL at every PyObject_CallFunction(... "O" ...) site (mem_read/mem_write, exec_symbolic_load/store, binary_op, unary_op, compare, cast, ptr_add/diff/offset, is_true, resolve_branch, resolve_call args). A default-constructed SharedPyPtr carries a real null (vs default_value() which carries Py_None); without the guard, a substrate path that bypassed make_default() would crash the step with SystemError: NULL object passed to Py_BuildValue. The bad value now surfaces as Python None and is handleable.

IRGen — IRBlock::parent_function() always resolves

• Implicit switch default now creates its own SWITCH_DEFAULT block and associates it with the implicit-default SWITCH_CASE structure. Without this, target_block() returned {} (entity id 0) and decide_switch skipped past the default — leaving an orphaned callee frame on the call stack while the caller's work items executed. Re-indexing fixes traces showing [default -> %0].
• SwitchToDeadBlock's synthetic UNREACHABLE block now associates with the surrounding scope. Same for the Duff's-device LOOP_CONDITION / LOOP_EXIT blocks (the only loop blocks not being associated).
• COMPENSATION blocks created during the InsertGotoCompensationBlocks post-emit pass anchor explicitly to the goto's common-ancestor scope via a new AssociateBlockWithStructure(block, struct) overload, with func_.body_scope_index as fallback.
• Safety-net pass at the end of Generate() / GenerateGlobalInit() attaches any remaining orphan block (e.g. a LABEL forward-referenced by a goto whose label was never defined) to the function body scope.

Interpreter

Reverted decide_switch's temporary UNREACHABLE termination for [default -> %0] with a non-matching concrete selector — the right fix lives in IRGen above; decide_switch once again just returns and lets the (now valid) default block be entered.

Per-byte symbolic shadow

Detection switched from sentinel-byte scan in ConcreteMemory to a dict in check, removing the cross-path poisoning where one path's 0xCD stamp leaked into a sibling's read.

Test plan

• python3 -m pytest tests/symex/ — 222 pass
• Debug build clean

🤖 Generated with Claude Code