DF-5597 — ioapic_irqinfo stride invariant (sizeof == 1<<IOAPIC_IRQI_SZSHIFT) is enforced only by a comment

What

genassym.c:276-277 emits BOTH stride facts into assym.s:

ASSYM(IOAPIC_IRQI_SIZE, sizeof(struct ioapic_irqinfo));   /* compiler truth */
ASSYM(IOAPIC_IRQI_SZSHIFT, IOAPIC_IRQI_SZSHIFT);          /* hand constant  */

but nothing at build time relates them. The hand constant (sys/platform/pc64/apic/ioapic_abi.h:58, #define IOAPIC_IRQI_SZSHIFT 4) is guarded only by a comment (ioapic_abi.h:50-51: "Keep size of ioapic_irqinfo power of 2 / Update IOAPIC_IRQI_SZSHIFT after changing ioapic_irqinfo size"). There is no CTASSERT/_Static_assert anywhere in the apic subsystem (verified by grep).

The two consumers use different facts of the same contract:

• sys/platform/pc64/apic/ioapic_ipl.s:80,97 — shll $IOAPIC_IRQI_SZSHIFT, %eax (indexes ioapic_irqs[] with the hand constant)
• sys/platform/pc64/apic/apic_vector.s:55-59 — `IOAPIC_IRQI_SIZE * (irq_num)
• IOAPIC_IRQI_{ADDR,IDX,FLAGS}` (indexes with sizeof)

If a field is ever added to struct ioapic_irqinfo (the plausible future edit: an owner-cpumask for IRQ balancing) and SZSHIFT is not bumped, ioapic_ipl.s computes wrong element addresses for ioapic_irqs[] — mask/unmask IMCR writes land on the wrong IOAPIC redirection entries — while apic_vector.s stays correct. The build stays green; the divergence is silent. (Today the invariant holds: live assym.s shows IOAPIC_IRQI_SIZE 0x10 == 1 << IOAPIC_IRQI_SZSHIFT 0x4.)

Reproduce

• ./run.sh (after cc): ioapic_drift.c without -D → invariant HOLDS (16 == 16, matching the shipped kernel's assym.s); with -DDRIFT (one added uint32_t field) → 24 != 16, and the two assembly consumers would index the array differently (IRQ 100: offset 1600 vs 2400) — with no build error today.
• guard_ok.c / guard_drift.c: the proposed _Static_assert compiles clean on the current layout and fails the build on the drifted layout (guard_drift.log: error: static assertion failed).

Fix

One _Static_assert in ioapic_abi.h right under the SZSHIFT define — see fix.diff.

DF-5597 VERDICT

Status: reproduced (hardening-gap demonstration, build-diff evidence class). Impact: none today — the invariant currently holds; this finding documents the unenforced invariant whose future drift is silent and interrupt-routing-corrupting. Confidence: certain.

Facts established on the guest

1. Current state is consistent. The shipped kernel's generated assym.s contains IOAPIC_IRQI_SIZE 0x10 and IOAPIC_IRQI_SZSHIFT 0x4; ioapic_drift.c (compiled from a verbatim copy of the struct) confirms sizeof(struct ioapic_irqinfo) == 16 == 1 << 4 (drift_now.log). The independent TU cross-check (findings/poc/DF-5596/out.kernelview.raw.txt) reproduces both values from the real headers.
2. Enforcement is comment-only. grep over ioapic_abi.h and the apic directory finds no CTASSERT/_Static_assert/static_assert tying IOAPIC_IRQI_SZSHIFT to the struct size. genassym.c emits both numbers side by side (lines 276-277) but nothing compares them.
3. Drift is silent today. ioapic_drift.c -DDRIFT (one added uint32_t io_owner_cpumask) → sizeof = 24, stride stays 16 (drift_sim.log): ioapic_ipl.s:80,97 (shll $IOAPIC_IRQI_SZSHIFT) and apic_vector.s:55-59 (IOAPIC_IRQI_SIZE * irq) would index ioapic_irqs[] differently — under-walked elements, wrong io_addr/io_idx/io_flags — and the kernel still builds and boots with no diagnostic.
4. The proposed guard works. With _Static_assert added (fix.diff): guard_ok.log — clean compile on the current layout (rc=0); guard_drift.log — error: static assertion failed: "ioapic_irqinfo size drifted from IOAPIC_IRQI_SZSHIFT" (rc≠0). The failure mode converts from silent runtime divergence to a loud build break.

Why this is filed against genassym.c

genassym.c is the file that publishes both halves of this contract to the assembly world; it is the natural place the audit asks "do the sizes emitted match what consumers assume?" (checklist item d). The struct and the hand constant live in ioapic_abi.h, which is where the one-line fix belongs (fix.diff included).

Classification

No runtime defect exists today (hence impact=none); this is a verified hardening finding with a tested one-line fix. Severity Info.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.