Severity: low — posture/defense-in-depth; no guest-observable deviation.
-
Out-of-range host integers wrap silently on store (cabi/memory.ts:127-141
storeInt; mirrored in bulk_lists.ts:164-179) where the reference
raises a host-precondition error (definitions.py:1568-1569
int.to_bytes OverflowError). A buggy embedder value corrupts data
instead of failing loudly (e.g. {x: 300} into record{x: u8} stores
44). Add assert_ range checks on the scalar path; measure before
adding to the bulk path (bulk_lists.ts:8-11 documents wrap as
intended — if kept, align the docs instead).
-
MemInst (cabi/memory.ts:20-33) caches buffer views forever — stale
after memory.grow; production is safe only because the executor
substitutes LiveMemory (exec/boundary.ts:97-160). Add a doc comment:
must not be used with growable memory.
-
Transcoders omit wasmtime's runtime defensive checks:
utf8-to-compact-utf16 (intrinsics/transcode.ts:398-414) has no
dst-capacity guard corresponding to libcalls.rs:308-312's zip, and no
op asserts src/dst non-overlap (libcalls.rs:166-177). Unreachable under
FACT's guarantees, but if the invariant ever broke the port corrupts
guest memory or throws RangeError where wasmtime truncates/panics. Add
cheap guards that fail as Traps.
Found in the 2026-08-10 adversarial conformance review (runtime + translator vs component-model @ 73b7ad5 definitions.py; wasmtime-environ 47.0.3 treated as trusted).
Severity: low — posture/defense-in-depth; no guest-observable deviation.
Out-of-range host integers wrap silently on store (cabi/memory.ts:127-141
storeInt; mirrored in bulk_lists.ts:164-179) where the referenceraises a host-precondition error (definitions.py:1568-1569
int.to_bytesOverflowError). A buggy embedder value corrupts datainstead of failing loudly (e.g.
{x: 300}intorecord{x: u8}stores44). Add
assert_range checks on the scalar path; measure beforeadding to the bulk path (bulk_lists.ts:8-11 documents wrap as
intended — if kept, align the docs instead).
MemInst(cabi/memory.ts:20-33) caches buffer views forever — staleafter
memory.grow; production is safe only because the executorsubstitutes
LiveMemory(exec/boundary.ts:97-160). Add a doc comment:must not be used with growable memory.
Transcoders omit wasmtime's runtime defensive checks:
utf8-to-compact-utf16(intrinsics/transcode.ts:398-414) has nodst-capacity guard corresponding to libcalls.rs:308-312's zip, and no
op asserts src/dst non-overlap (libcalls.rs:166-177). Unreachable under
FACT's guarantees, but if the invariant ever broke the port corrupts
guest memory or throws RangeError where wasmtime truncates/panics. Add
cheap guards that fail as
Traps.Found in the 2026-08-10 adversarial conformance review (runtime + translator vs component-model @ 73b7ad5 definitions.py; wasmtime-environ 47.0.3 treated as trusted).