Module adversarial 

Adversarial test primitives for the §22 red-team / fuzz / chaos harness (the probe service).

These are the one thing a test service legitimately needs that a safe wrapper cannot otherwise express: issuing a RAW syscall with arbitrary (fuzzed) number + arguments, and executing a DELIBERATE ring-3 fault to prove the kernel kills the faulting task rather than wedging the machine (invariant 12; §22 A14 / A15 / C2). Isolating that unsafe HERE - a designated, audited SDK module, every block carrying a // SAFETY: comment - keeps the test SERVICES themselves (probe) unsafe-free (§18.2), exactly as the SDK’s ABI / MMIO / DMA modules keep the driver services unsafe-free (§18.1). This module is test-only: no production service should call it (a fault primitive merely kills the caller, which the kernel handles; the fuzz primitive is a raw trap the kernel validates). One production caller exists, by design: the SDK’s own panic handler (lib.rs) calls fault_null_read so that a panicking service dies and is restarted instead of spinning.

Structs

Region

A run of FRESH pages this task was just given by AllocMem, for the §22 P7 stale-translation test.

Functions

fault_divide_by_zero

Deliberately divide by zero, raising a ring-3 divide-error (#DE, vector 0) at CPL3 - §22 A14. Uses raw asm because Rust inserts a divide guard that would PANIC (unwind) instead of faulting, and the threat model includes adversarial asm services. The kernel must kill this task, not halt.

fault_noncanonical_read

Deliberately read a NON-CANONICAL address (bit 47 != bit 63), raising a ring-3 general-protection fault (#GP(0)) at CPL3 - §22 A14. The kernel must kill this task, not halt (kernel-audit C1).

fault_null_read

Deliberately read through a NULL pointer, raising a ring-3 page fault (#PF) - §22 Chaos C2 / A14. A conforming kernel kills this task at the fault and continues; it must never halt the machine (invariant 12). Control does not return on a conforming kernel.

fuzz_syscall

Issue a RAW syscall with an arbitrary number and arguments and return the raw i64 result. This is the fuzz/adversarial entry point (F1/F2/A10/A15 …): the kernel validates every syscall, so from the caller’s side this is memory-safe - it never dereferences anything itself. A bad pointer passed as a1 is the KERNEL’s to validate and reject (or to attribute to this caller and kill it); it can never corrupt this task’s memory. The unsafe is purely the inline-asm ABI trap, which is sound for any argument values, so it is isolated in [crate::syscall::raw_syscall] and wrapped safely here.