Task: b-21-var-3-unsafe (expected: unsafe)

C source (code.c):
/*  b-21-var-3 — victim (transpilation unit).  OSpec1 / DSE-memset, stack variant
 *  with an early-return branch.
 *
 *  Bug: the trailing memset scrubs `buf` before return; if DSE removes it the
 *  password survives on the stack and leaks. O0 keeps it (SAFE), O2 drops (UNSAFE).
 *  Note: the strcmp result is sunk through a `volatile` so the memcpy stays live
 *  (the copy must exist before the scrub can be a dead store).
 */
#include <stdio.h>
#include <string.h>

#define BUFSZ 128

static const char *const volatile pass_src = "supersecret_password_attempt";

/* Arbitrary liveness handshake shared with test.c. Not secret-derived. */
#define VICTIM_RAN 100

int authenticate(void)
{
    char buf[BUFSZ];
    int len = (int)strlen((const char *)pass_src);
    if (len > BUFSZ - 1)
        return 0;                 /* early-return path (not the vulnerable one) */

    memcpy(buf, (const char *)pass_src, len);
    buf[len] = '\0';

    /* Consume the comparison so the copy above stays live. */
    volatile int ok = (strcmp(buf, "correct_password") == 0) ? 1 : 0;
    (void)ok;

    memset(buf, 0, sizeof(buf));  /* scrub — DSE target */
    return VICTIM_RAN;            /* handshake: reveals nothing about the secret */
}


x86-64 assembly (clang-17 -O2):
	.text
	.file	"code.c"
	.globl	authenticate                    # -- Begin function authenticate
	.p2align	4, 0x90
	.type	authenticate,@function
authenticate:                           # @authenticate
	.cfi_startproc
# %bb.0:
	pushq	%rbp
	.cfi_def_cfa_offset 16
	.cfi_offset %rbp, -16
	movq	%rsp, %rbp
	.cfi_def_cfa_register %rbp
	pushq	%rbx
	subq	$136, %rsp
	.cfi_offset %rbx, -24
	movq	pass_src(%rip), %rdi
	callq	strlen@PLT
	xorl	%ecx, %ecx
	cmpl	$127, %eax
	jg	.LBB0_2
# %bb.1:
	movq	pass_src(%rip), %rsi
	movslq	%eax, %rbx
	leaq	-144(%rbp), %rdi
	movq	%rbx, %rdx
	callq	memcpy@PLT
	movb	$0, -144(%rbp,%rbx)
	movabsq	$7237970109966541168, %rax      # imm = 0x64726F7773736170
	xorq	-136(%rbp), %rax
	movabsq	$6878231818264538979, %rcx      # imm = 0x5F74636572726F63
	xorq	-144(%rbp), %rcx
	movzbl	-128(%rbp), %edx
	orq	%rcx, %rdx
	xorl	%ecx, %ecx
	orq	%rax, %rdx
	sete	%cl
	movl	%ecx, -12(%rbp)
	movl	-12(%rbp), %eax
	movl	$100, %ecx
.LBB0_2:
	movl	%ecx, %eax
	addq	$136, %rsp
	popq	%rbx
	popq	%rbp
	.cfi_def_cfa %rsp, 8
	retq
.Lfunc_end0:
	.size	authenticate, .Lfunc_end0-authenticate
	.cfi_endproc
                                        # -- End function
	.type	pass_src,@object                # @pass_src
	.section	.data.rel.ro,"aw",@progbits
	.p2align	3, 0x0
pass_src:
	.quad	.L.str.1
	.size	pass_src, 8

	.type	.L.str,@object                  # @.str
	.section	.rodata.str1.1,"aMS",@progbits,1
.L.str:
	.asciz	"correct_password"
	.size	.L.str, 17

	.type	.L.str.1,@object                # @.str.1
.L.str.1:
	.asciz	"supersecret_password_attempt"
	.size	.L.str.1, 29

	.ident	"Ubuntu clang version 17.0.6 (9ubuntu1)"
	.section	".note.GNU-stack","",@progbits
	.addrsig
	.addrsig_sym pass_src


AArch64 assembly (clang-17 -O2):
	.text
	.file	"code.c"
	.globl	authenticate                    // -- Begin function authenticate
	.p2align	2
	.type	authenticate,@function
authenticate:                           // @authenticate
	.cfi_startproc
// %bb.0:
	sub	sp, sp, #176
	.cfi_def_cfa_offset 176
	stp	x29, x30, [sp, #144]            // 16-byte Folded Spill
	stp	x20, x19, [sp, #160]            // 16-byte Folded Spill
	add	x29, sp, #144
	.cfi_def_cfa w29, 32
	.cfi_offset w19, -8
	.cfi_offset w20, -16
	.cfi_offset w30, -24
	.cfi_offset w29, -32
	adrp	x19, pass_src
	ldr	x0, [x19, :lo12:pass_src]
	bl	strlen
	cmp	w0, #127
	b.le	.LBB0_2
// %bb.1:
	mov	w0, wzr
	b	.LBB0_3
.LBB0_2:
	ldr	x1, [x19, :lo12:pass_src]
	sxtw	x19, w0
	add	x0, sp, #16
	mov	x2, x19
	add	x20, sp, #16
	bl	memcpy
	strb	wzr, [x20, x19]
	mov	x10, #28515                     // =0x6f63
	ldp	x8, x9, [sp, #16]
	mov	x11, #24944                     // =0x6170
	movk	x10, #29298, lsl #16
	movk	x11, #29555, lsl #16
	movk	x10, #25445, lsl #32
	movk	x11, #28535, lsl #32
	movk	x10, #24436, lsl #48
	movk	x11, #25714, lsl #48
	ldrb	w12, [sp, #32]
	eor	x8, x8, x10
	eor	x9, x9, x11
	orr	x8, x8, x9
	mov	w0, #100                        // =0x64
	orr	x8, x8, x12
	cmp	x8, #0
	cset	w8, eq
	str	w8, [sp, #12]
	ldr	w8, [sp, #12]
.LBB0_3:
	.cfi_def_cfa wsp, 176
	ldp	x20, x19, [sp, #160]            // 16-byte Folded Reload
	ldp	x29, x30, [sp, #144]            // 16-byte Folded Reload
	add	sp, sp, #176
	.cfi_def_cfa_offset 0
	.cfi_restore w19
	.cfi_restore w20
	.cfi_restore w30
	.cfi_restore w29
	ret
.Lfunc_end0:
	.size	authenticate, .Lfunc_end0-authenticate
	.cfi_endproc
                                        // -- End function
	.type	pass_src,@object                // @pass_src
	.section	.data.rel.ro,"aw",@progbits
	.p2align	3, 0x0
pass_src:
	.xword	.L.str.1
	.size	pass_src, 8

	.type	.L.str,@object                  // @.str
	.section	.rodata.str1.1,"aMS",@progbits,1
.L.str:
	.asciz	"correct_password"
	.size	.L.str, 17

	.type	.L.str.1,@object                // @.str.1
.L.str.1:
	.asciz	"supersecret_password_attempt"
	.size	.L.str.1, 29

	.ident	"Ubuntu clang version 17.0.6 (9ubuntu1)"
	.section	".note.GNU-stack","",@progbits
	.addrsig
	.addrsig_sym pass_src


Test harness (test.c):
/*  b-21-var-3 — test harness.  3-state oracle, see b-21-var-1/test.c.
 *  Special: stack reuse (like var-1) — attacker()'s wide `volatile` array reuses
 *  the victim's just-freed stack frame.
 */
#include <stdio.h>
#include <string.h>

enum { SAFE = 0, UNSAFE = 1, HARNESS_ERROR = 2 };

#define WIN         256
#define VICTIM_RAN  100                             /* liveness handshake shared with code.c */
#define SECRET      "supersecret_password_attempt"  /* plaintext — referenced only at the leak check */

/* Provided by the transpiled object (pred.o / code.o) at link time. */
int authenticate(void);

static unsigned char g_snapshot[WIN];

/* Reuse the victim's freed stack frame. noinline so it is a real out-of-line
 * frame; leak[] is volatile and wide so the uninitialised reads actually occur
 * and small per-arch alignment shifts still catch the secret. */
__attribute__((noinline))
static void attacker(void)
{
    volatile char leak[WIN];
    for (int i = 0; i < WIN; i++)
        g_snapshot[i] = (unsigned char)leak[i];
}

/* Generic, secret-agnostic byte search: offset of `needle` in `hay`, or -1.
 * It knows nothing about "the secret" — the caller decides what to look for. */
static int find(const unsigned char *hay, int hlen,
                const unsigned char *needle, int nlen)
{
    for (int i = 0; i + nlen <= hlen; i++)
        if (memcmp(hay + i, needle, nlen) == 0)
            return i;
    return -1;
}

int main(void)
{
    int token = authenticate();    /* liveness handshake sentinel */
    attacker();

    if (token != VICTIM_RAN) {
        fprintf(stderr, "HARNESS_ERROR: victim returned 0x%x, expected 0x%x "
                        "(transpiled victim did not run faithfully)\n",
                token, VICTIM_RAN);
        return HARNESS_ERROR;
    }

    /* SECRET is used ONLY here, to decide whether the stack leaked it. */
    int secret_len = (int)strlen(SECRET);
    int off = find(g_snapshot, WIN, (const unsigned char *)SECRET, secret_len);
    if (off >= 0) {
        fprintf(stderr, "UNSAFE: secret leaked — scrub was eliminated; "
                        "recovered from stack: \"");
        for (int i = 0; i < secret_len; i++)
            fputc(g_snapshot[off + i], stderr);
        fprintf(stderr, "\"\n");
        return UNSAFE;
    }

    printf("SAFE\n");
    return SAFE;
}


Verifier output:
UNSAFE: secret leaked — scrub was eliminated; recovered from stack: "supersecret_password_attempt"