0.7.0 — the crash a consumer could not localise, and openkal 0.9

[Sunrisepeak]

⚠️⚠️ signal(SIGABRT, …) destroyed its caller's return address

SYS_rt_sigprocmask cleared sizeof(sigset_t) — 128 bytes — into whatever the
caller passed, while a4 is the sigsetsize the caller declared, which is
eight here and is what the kernel writes.

Sixteen of musl's seventeen callers pass a 128-byte sigset_t and saw nothing.
The seventeenth is src/signal/sigaction.c, which declares one word and reaches
this only when the signal is SIGABRT; that local sits at -0x20 in a frame of
0x30, so 120 bytes past it lay the saved frame pointer and the return address,
and __sigaction returned to zero.

⭐ The whole of the reproduction is three lines:

int main(void) { signal(SIGABRT, h); return 0; }

SIGSEGV, instruction pointer at zero, stack top zero rather than a return
address. Reported in mcpplibs/openkal-linux#13 with a dozen forks and four
threads in front of it, because that is what the program that met it was doing;
none of it was necessary. Both exclusions in that report were correct.

⚠️ And it was not only installing a handler. signal(SIGABRT, SIG_IGN) and a
plain enquiry, sigaction(SIGABRT, NULL, &old), died the same way — so a program
that only read what SIGABRT was set to could not survive doing so, which a
terminal library, a test framework's death tests and any crash reporter all do
before they do anything else.

SYS_rt_sigaction had the same defect reversed: it cleared the size of a
structure declared here, three fields, where struct k_sigaction is four.

⭐ Each is the same mistake: a size taken from the type at hand rather than from
the contract being answered. examples/posix now touches every signal's
disposition in all three forms. It had thirty-six observations, three about
abort, and no call to signal anywhere: it examined whether abort ends the
program and never whether a program may ask what a signal is set to.

Four more the same consumer would have met

• getpgrp() answered −38. musl deliberately does not pass the result through
  __syscall_ret because POSIX says the call cannot fail — so a negated error was
  handed over as a process group, with no errno and nothing to check.
• st_dev and st_ino were constants, so every file was the same file:
  std::filesystem::equivalent on two separately created files answered true
  with no error.
• stat and lstat were one call. The flag was ignored while open resolved,
  so a program was told a name referred to a link when opening it would have
  reached a file — and one such node made a whole tree uncopyable for the C++
  library above.
• symlink and readlink answer, after asking kal_fs_props whether the
  volume has such nodes.
• SYS_membarrier has a case of its own so the trace does not report it: it comes
  from musl's own pthread_create and its result is assigned to nothing. One of
  the six numbers the first user of that switch reported was a false alarm.
• The started-program bound is stated in the README and raised to 256.

openkal 0.9

Transfers return one signed word — which is what every site here computed from the
two-word result by hand. Values are copied into this library's own buffers. The
page size is asked for rather than fixed at build time: it was 4096 in two places,
and is what this library reports as _SC_PAGESIZE, rounds mappings to, and
reports as st_blksize.

⭐ And the one weak reference that needed a different spelling no longer does:
kal_process_props was an object, so testing it the way every other weak
reference is tested was the null dereference the test existed to prevent.

Built and verified for x86_64-linux-musl and aarch64-linux-musl. The
std::filesystem behaviour now matches the host's own toolchain row for row.