fix(riscv): #655 — mask bounds the EFFECTIVE address (offset folded before the AND, final byte clamped); i64 loads/stores gain the guard

[avrabe]

Fixes #655 — the #651 class, RISC-V twin of ARM PR #654.

Sites audited (grep bounds/mask over synth-backend-riscv)

Site	Pre-fix state	Now
emit_bounds_check Mask arm	masked the operand, caller re-added the static offset in the access imm — offset escaped the bound; no final-byte clamp	the mask_effective_address semantics, in RV32 instructions
lower_load_word / lower_load_subword / lower_store	re-added offset after the mask	consume the residual offset returned by the guard (0 under Mask)
lower_i64_load / lower_i64_store	NO guard at all — in Software and Mask modes	guard the full 8-byte access like the i32 lowerings
emit_bounds_check Software arm	already correct: folds offset + access_size - 1, bgeu guard, size on the final byte (size with >= on the last byte ≡ size-1 bound on it)	unchanged
Mask value (size vs size-1)	already mem_size - 1 (build_options), non-power-of-two declines loudly at compile time — RV32 never had ARM's latent R10-is-SIZE remap	pinned by the oracle's exactness rows

The fix

emit_bounds_check now returns (reg, residual_offset). The Mask arm computes

masked = min((operand + offset) & (size-1), size - access_size)

[addi/li+add ea, addr, offset]   ; fold the static offset FIRST
 andi/li+and masked, ea, size-1  ; bound the first byte
[li limit, size-access_size      ; clamp the START so the FINAL byte
 bgeu limit, masked, Lok         ;   (start + access_size - 1) stays inside
 mv masked, limit ; Lok:]        ;   — skipped for byte accesses
 lw/sw …, 0(base+masked)         ; residual offset 0 — nothing re-added

u33 soundness of ADD-then-AND (mirrors #654): ea = operand + offset < 2^33; the RV add computes ea mod 2^32 and every set bit of size-1 < 2^32 lies below bit 32, so the u33 carry is annihilated by the AND either way. Arbitrary 32-bit static offsets are handled exactly — Mask mode now accepts offsets > 2047 that offset_to_imm previously declined.

Red → green

scripts/repro/mask_bounds_655_riscv_differential.py (+ 2 .wat) — unicorn RV32 execution vs the mask-semantics model, with a deterministic non-periodic pattern in the 64 KiB window and an 0xEE sentinel region above it (escapes are detected by value/byte checks, not by an unmapped-page fault); Software mode additionally asserts trap/no-trap.

• origin/main (22517cb): ORACLE: FAIL (10) — offset-escape load (0xeeeeeeee from the sentinel) + store (sentinel_intact=False), word final-byte overhang, halfword wrap at ea == size, i64 mask escapes (lo and hi), software-mode i64 load and store return instead of trapping, huge-offset compile decline.
• this branch: ORACLE: PASS — all red rows green, plus in-bounds exactness rows (byte load at size-1, word/halfword/i64 in-bounds) and software in-bounds no-trap rows.

Selector shape tests: rv32_mask_folds_offset_before_and_655 (access imm must be 0; the offset-add precedes the AND), rv32_mask_clamps_final_byte_for_multibyte_only_655 (word clamps, byte doesn't pay), rv32_i64_load_store_guarded_655.

Gates

• frozen anchors 10/10 (frozen_codegen_bytes, including the RV32 gate — the default RV32 bounds mode is None, which emits nothing; fixtures don't use --safety-bounds, goldens untouched)
• cargo test --workspace: 107 suites, 0 failures
• cargo fmt --check + cargo clippy --workspace --all-targets -- -D warnings clean
• rebased onto origin/main (22517cb, post-v0.34.0)

Refs #651, #654.

🤖 Generated with Claude Code