[pitboss/grind] deferred session-0008 (20260516T052512Z-20f8)

tests/dynamic_fixtures/c/free_fn/setup_fault.c

@@ -0,0 +1,24 @@
+/* Phase 08 (b) acceptance fixture — crash outside the sink.
+ *
+ * Cap: FMT_STRING.  A global constructor (`__attribute__((constructor))`)
+ * runs before `main`, so the abort fires BEFORE the harness reaches
+ * `__nyx_install_crash_guard`.  No Crash probe is written, the
+ * `Oracle::SinkCrash` predicate sees `process_crashed &&
+ * !has_sink_crash_probe`, and the verifier routes to
+ * `Inconclusive(UnrelatedCrash)` instead of `Confirmed`.
+ *
+ * The `run` body is unreachable but must compile so the entry symbol
+ * resolves at link time. */
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+__attribute__((constructor)) static void nyx_fixture_crash_in_setup(void) {
+    abort();
+}
+
+void run(const char *payload, size_t len) {
+    (void)payload;
+    (void)len;
+    printf("__NYX_SINK_HIT__\n");
+}

tests/dynamic_fixtures/c/free_fn/sink_fault.c

@@ -0,0 +1,25 @@
+/* Phase 08 (a) acceptance fixture — crash at the sink.
+ *
+ * Cap: FMT_STRING.  Prints the `__NYX_SINK_HIT__` sentinel so the runner
+ * sees the in-harness sink-hit, then NULL-dereferences when handed the
+ * vuln payload.  The harness's `__nyx_install_crash_guard` was installed
+ * earlier in `main`, so SIGSEGV writes a Crash probe to `NYX_PROBE_PATH`,
+ * which lifts the `Oracle::SinkCrash` predicate to `Confirmed`.
+ *
+ * Differential confirmation: the paired benign payload carries the
+ * `NYX_BENIGN` marker.  The short-circuit below returns cleanly on the
+ * benign run so `benign_fired = false`, satisfying the §4.1 rule. */
+#include <stddef.h>
+#include <stdio.h>
+#include <string.h>
+
+void run(const char *payload, size_t len) {
+    (void)len;
+    printf("__NYX_SINK_HIT__\n");
+    fflush(stdout);
+    if (payload && strstr(payload, "NYX_BENIGN")) {
+        return;
+    }
+    volatile char *p = NULL;
+    *p = 1;
+}