Close PVM2 interpreter↔recompiler conformance forks (B1/B2/B3/B5)

[sorpaas]

What

The PVM2 interpreter (the consensus oracle) under-enforced what the spec requires and the x86 recompiler already enforced. On a blob both engines admit, the oracle and executor could then compute different state — a consensus fork that a sandbox cannot catch. This closes four such forks and pins the classifier pair that could create a fifth. Each fix makes the interpreter match the recompiler's observable behavior, verified by reading both engines (interp javm-exec + recompiler nub-arch-x86/codegen.rs).

Re-audited each finding against current source before fixing (a prior research pass had fabricated an artifact, so nothing was taken on trust).

Fixes

B1 — static jal/branch to a non-block-start. The Jal and six branch arms resolved targets with bare find_idx_for_pc and lacked the is_gas_block_start gate the Jalr arm already had, so a mid-block static target ran a partial block having charged zero gas. Added the gate to all seven arms; a non-block-start target now Panics at execution, matching the recompiler's emit_static_branch panic stub and closing the gas hole.

B2 — guest read of its own code. The interpreter based its data buffer at DATA_BASE, so a code-region load (the auipc+load PIC idiom the spec blesses) page-faulted, while the recompiler RO-maps code and allows it. Threaded the code bytes into Interpreter::run; loads fall back to a read-only code-region read. Stores into code still fault.

B3 — store to a pinned/read-only page wrote silently. The interp store fast path never consulted per-page perms and build_entry laid every overlay ReadWrite. Now the store arms gate on a per-page store_writable check (guest stores only; trusted kernel writes bypass), and pinned-sourced mappings are laid read-only via the new shared ImageCap::mapping_is_pinned, used by both interp drivers (Vm::build_entry and nub-arch-local — the latter had the same bug). Derived from img.pinned at lay time, so RwOverlay's cap hash is unchanged. Matches the recompiler, whose flat RW buffer is mapped before the RO direct_maps, so RO wins for pinned pages.

B5 — drifting terminator classifiers. The two engine-side classifiers (predecode::is_terminator and the gas-LUT RVF_TERM) are hand-coded independently and must agree or the engines disagree on basic-block starts. Added a generated test sweeping the full RVC halfword space and a 4-byte opcode×funct matrix. (The linker's third classifier is deferred — a 3-way test needs a cross-crate harness, and it is low-risk post-B1.)

B4 — re-audited and found to be a misframing, not a missing check. The original "PVM2 dropped PolkaVM's up-front O(n) validation" premise is PolkaVM-inherited: jar's recompiler never rejects at load (compile always returns a CompileResult; bad targets/reserved → runtime panic stubs), and the interpreter deliberately mirrors that. A load-time admission gate in the interpreter alone would create a new fork. B1 is the real fix — both engines now validate target ∈ bb_starts at execution, so bb_start soundness no longer rests on the linker's producer assumption even for untrusted Images. No admission gate added.

Tests

8 directed adversarial vectors added (bench guests can't trigger these by construction):

• B1: branch_to_non_block_start_panics, jal_to_non_block_start_panics, branch_to_real_block_start_is_allowed
• B2: auipc_load_reads_own_code_region, store_into_code_region_faults
• B3: store_writable_respects_per_page_perms, guest_store_to_ro_page_faults, mapping_is_pinned_classifies_by_source_slot
• B5: predecode_and_gas_lut_terminator_agree

cargo build --workspace clean, clippy --all-targets -D warnings clean, fmt clean, 393 tests pass (incl. javm-guest-tests interp↔recomp conformance/sub_vm). javm-bench shows no regression (changes are off the recompiler's measured path).

🤖 Generated with Claude Code

[github-actions]

Genesis Review

Comparison targets:

• e3778125 (e377812)
• 2bc664b9 (2bc664b)
• 8e7129c8 (8e7129c)
• 7f3c6c03 (7f3c6c0)
• d18aa4fb (d18aa4f)
• b0ac1bb8 (b0ac1bb)
• 927ff866 (927ff86)

How to review

Post a comment with the following format (rank from best to worst):

/review
difficulty: <commit1>, <commit2>, ..., <commitN>, currentPR
novelty: <commit1>, <commit2>, ..., <commitN>, currentPR
design: <commit1>, <commit2>, ..., <commitN>, currentPR
verdict: merge

Use the short commit hashes above and currentPR for this PR.
Each line ranks all comparison targets + this PR from best to worst.

To meta-review another reviewer's comment, react with 👍 or 👎.

[sorpaas]

/review
difficulty: currentPR, e377812, 2bc664b, 7f3c6c0, b0ac1bb, d18aa4f, 8e7129c, 927ff86
novelty: currentPR, 927ff86, e377812, 2bc664b, 7f3c6c0, b0ac1bb, d18aa4f, 8e7129c
design: currentPR, e377812, 2bc664b, 7f3c6c0, b0ac1bb, d18aa4f, 8e7129c, 927ff86
verdict: merge

Consensus-fork closure across PVM2's interpreter↔recompiler boundary — four real forks closed (B1 zero-gas mid-block static target, B2 guest read of own code, B3 silent store to pinned/RO page, B5 drifting terminator classifier pair) plus B4 re-audited and reframed as a misframing rather than a missing check. Each fork was a potential validator-level state split: the interpreter under-enforced what the spec requires and the recompiler already enforced, so on a blob both engines admit, they could compute different state — the kind of bug a sandbox cannot catch. The fix framework is "make the interpreter match the recompiler's observable behavior, verified by reading both engines" — the right shape for closing this class of fork because the recompiler is the production executor.

Two design signals stand above the rest. First, the B4 reframing: the obvious "add the missing up-front O(n) admission gate" fix would have created a new fork because the recompiler also doesn't reject at load (compile always returns a CompileResult; bad targets/reserved → runtime panic stubs). The interpreter deliberately mirrors that. B1's execution-time target ∈ bb_starts check is the right answer and now both engines agree even on adversarial Images. Second, the shared mapping_is_pinned helper used by both interp drivers — fixing the B3 store-perm gate in one place surfaced that nub-arch-local had the same bug; fixing in javm-cap repairs both. The re-audit discipline ("a prior research pass had fabricated an artifact, so nothing was taken on trust") is the strongest epistemics signal — verifying findings against current source before fixing is what prevents the audit from compounding its own errors.

8 directed adversarial vectors (bench guests can't trigger these by construction); 393 tests pass including the interp↔recomp conformance/sub_vm gate; no recompiler regression. All CI green.

[github-actions]

JAR Bot: Quorum reached — triggering merge.
Reviews: 1, meta-reviews: 0.
Merge weight: 35836/39812 (>50%).

[sorpaas]

JAR Bot: Merged (quorum reached).
Score: {"designQuality":100,"difficulty":100,"novelty":100}
Weight delta: 100