Gap analysis of IOCX data directory coverage

[malx-labs]

Coverage by data directory as-of v0.7.6.2

#	Directory	Placement (rva_graph)	Deep semantic validator
0	EXPORT	✓	✓ exports
1	IMPORT	✓	✓ v0.7.6.2
2	RESOURCE	✓	✓ resources + version_info
3	EXCEPTION (.pdata)	✓	✓ v0.7.6.1
4	SECURITY	(excluded - file offset)	✓ signature/pe_certificates
5	BASERELOC	✓	✓ relocations
6	DEBUG	✓	✓ debug
7	ARCHITECTURE	✓	✗ (reserved/rare)
8	GLOBALPTR	✓	✗ (rare)
9	TLS	✓	✓ tls
10	LOAD_CONFIG	✓	✓ load_config
11	BOUND_IMPORT	✓	✗ (parser exists, no validator)
12	IAT	✓	✗ (bounds only)
13	DELAY_IMPORT	✓	✓ delay_imports
14	COM/.NET	✓	✗ (deferred to later

Where we are now

• Directory-pointed structures — now near-complete for the forensically dense directories.
• Loader-facing geometry — entrypoint mapping, section flags/alignment/overlap/RWX, RVA↔raw consistency, overlay detection, entropy. This is the "does it even load, and does the layout lie" axis, and it's well-covered.
• Adversarial-input robustness — The tombstone-not-exception design means the malformed input space (truncated, looping, contradictory, past-EOF) is handled with structured determinism rather than crashes or version-dependent divergence.
• Single-owner discipline — the architecture actively resists double-counting, which matters for precision, not just recall.

The gaps

1. Regular IMPORT table (dir 1) has no dedicated structural validator. We have deep coverage of exports and delay-load imports but not the ordinary import directory (INT/IAT RVA validity, IMAGE_IMPORT_BY_NAME sanity, ordinal/name consistency).
2. Bound imports (dir 11) — parser exists (_parse_bound_imports), no validator.
3. Header-field cross-consistency — no deep COFF-header contradiction checks (NumberOfSections vs actual, SizeOfOptionalHeader, Characteristics/Machine contradictions) or DOS/e_lfanew pathologies beyond what parse failure catches incidentally.
4. .NET/COM (dir 14) — explicitly deferred;