From 600483ca892460305a7bc07bb4f91da03949defc Mon Sep 17 00:00:00 2001 From: Derek Barbosa Date: Wed, 15 Jul 2026 21:22:08 -0400 Subject: [PATCH] prompts/repro: add kverify structural_evidence guidance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When kverify has enriched a finding's metadata.yaml with a validation_result.structural_evidence block, the repro agent can use the structural analysis to make better reproduction decisions: - bug_class flags (unsafe_copy, untrusted_input, unchecked_return, dead_code) guide trigger strategy selection - reachability.callers provides entry points for the trigger path - suggested_sanitizers avoids blanket KASAN when a more specific sanitizer applies - staleness.status and upstream.fix_commits_found prevent wasted reproduction attempts on already-fixed or deleted code - conflicts.contradicting highlights disputed evidence that the reproducer should settle empirically The section is informational and backward-compatible — absence of the block means kverify hasn't run, and the existing workflow proceeds unchanged. Assisted-by: Claude Opus 4 (claude-opus-4-6) Signed-off-by: Derek Barbosa --- prompts/repro.md | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/prompts/repro.md b/prompts/repro.md index 9fc27f2..abcafa8 100644 --- a/prompts/repro.md +++ b/prompts/repro.md @@ -17,6 +17,47 @@ distinguishing output for both. under test (HEAD usually contains it). - `findings//FINDING.md` only if summary is insufficient. +## kverify structural analysis (if available) + +If `metadata.yaml` contains a `validation_result.structural_evidence` +block, read it before writing the reproducer. It contains: + +- `bug_class` — what kind of memory safety issue kverify's static + analysis detected. Use this to pick your trigger strategy: + - `unsafe_copy: true` → force a boundary-crossing copy (zero-length, + negative, or oversized) + - `untrusted_input: true` → craft input that reaches the function + without sanitization + - `unchecked_return: true` → force the error path (fault injection, + resource exhaustion) + - `dead_code: true` → function may be unreachable; check + `reachability` before investing time + +- `reachability.callers` — which functions call the buggy function. + Start your trigger path from these callers. If `caller_count` is 0 + but the finding has smatch evidence, the function may be reachable + via function pointer — check smatch caller_info. + +- `suggested_sanitizers` — enable these CONFIG_ options. kverify + derived them from the bug class; they're more specific than + blanket KASAN. + +- `staleness.status` — if `function_modified` or `deleted`, the code + has changed since KRES analyzed it. Verify the mechanism still + applies before building the reproducer. If `deleted`, skip — the + function no longer exists. + +- `upstream.fix_commits_found` — if > 0, a fix may already be in + the tree. Check before reproducing. + +- `conflicts` — if `present: true`, kverify's static stages disagreed. + The `contradicting` list tells you what evidence pushed against the + finding. Your reproducer should settle the dispute empirically. + +This block is informational. Absence of `structural_evidence` means +kverify hasn't run on this finding — proceed with the existing +workflow. + ## Build the reproducer - Keep it under ~250 lines. Save to `/_repro.c`,