PARTIAL FIX: Add sentinel detection at 3 critical push points to prevent
sentinel-poisoned nodes from entering TLS caches. These guards provide
defense-in-depth against remote free sentinel leaks.
Sentinel Attack Vector (from Task agent analysis):
1. Remote free writes SENTINEL (0xBADA55BADA55BADA) to node->next
2. Node propagates through: freelist → TLS list → fast cache
3. Fast cache pop tries to dereference sentinel → SEGV
Fixes Applied:
1. **tls_sll_pop()** (core/box/tls_sll_box.h:235-252)
- Check if TLS SLL head == SENTINEL before dereferencing
- Reset TLS state and log detection
- Trigger refill path instead of crash
2. **tiny_fast_push()** (core/hakmem_tiny_fastcache.inc.h:105-130)
- Check both `ptr` and `ptr->next` for sentinel before pushing to fast cache
- Reject sentinel-poisoned nodes with logging
- Prevents sentinel from reaching the critical pop path
3. **tls_list_push()** (core/hakmem_tiny_tls_list.h:69-91)
- Check both `node` and `node->next` for sentinel before pushing to TLS list
- Defense-in-depth layer to catch sentinel earlier in the pipeline
- Prevents propagation to downstream caches
Logging Strategy:
- Limited to 5 occurrences per thread (prevents log spam)
- Identifies which class and pointer triggered detection
- Helps trace sentinel leak source
Current Status:
⚠️ Sentinel checks added but NOT yet effective
- bench_random_mixed 100K: Still crashes at iteration 66152
- NO sentinel detection logs appear
- Suggests either:
1. Sentinel is not the root cause
2. Crash happens before checks are reached
3. Different code path is active
Further Investigation Needed:
- Disassemble crash location to identify exact code path
- Check if HAKMEM_TINY_AGGRESSIVE_INLINE uses different code
- Investigate alternative crash causes (buffer overflow, use-after-free, etc.)
Testing:
- bench_random_mixed_hakmem 1K-66K: PASS (8M ops/s)
- bench_random_mixed_hakmem 67K+: FAIL (crashes at 66152)
- Sentinel logs: NONE (checks not triggered)
Related: Previous commit fixed 8 USER/BASE conversion bugs (14K→66K stability)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- core/hakmem_tiny_fastcache.inc.h: make tiny_fast_pop/push read/write next at base+1 for C0–C6; clear C7 next on pop
- core/hakmem_tiny_hot_pop.inc.h: header-aware next reads for g_fast_head pops (classes 0–3)
- core/tiny_free_magazine.inc.h: header-aware chain linking for BG spill chain (base+1 for C0–C6)
- core/box/front_gate_classifier.c: registry fallback classifies headerless only for class 7; others as headered
Build OK; bench_fixed_size_hakmem still SIGBUS right after init. FREE_ROUTE trace shows invalid frees (ptr=0xa0, etc.). Next steps: instrument early frees and audit remaining header-aware writes in any front caches not yet patched.
