20260817-2 Beads Fuzz Campaign

Post-hoc durable evidence reconstruction

Generated: 2026-08-28

Source: Promoted regression tests at commit 12cfef8

FAIL

Summary

The original campaign report was not committed. This durable reconstruction preserves the two promoted execution findings and their minimized reproducers without claiming to reproduce missing worker transcripts.

Fuzz run descriptionIterationsPassResult
Embedded NUL in Beads variable value is attributed to an unavailable executable 1 0/1 FAIL
Output limit terminates a descendant holding the inherited pipe open 1 0/1 FAIL

Adversarial fuzz worker

path-encoding-probe

Session sc-compose-fuzz-20260817-2 · Worker path-encoding-probe

FAIL

Fuzz run descriptionIterationsPassResult
Embedded NUL in Beads variable value is attributed to an unavailable executable 1 0/1 FAIL

Inputs exercised

CaseTemplate / inputOutcome
FUZZ-4177-ENC-01Run Validate with `/bin/echo` and bead variable `payload=legit\u0000withnul`.FAIL: OS argv construction rejects the NUL, but the receipt code is BEADS_BD_UNAVAILABLE.

Findings

FUZZ-4177-ENC-01

Minimal template / frontmatter
valid formula template; no template defect required
Input
payload=legit\u0000withnul; bd_executable=/bin/echo
Expected
An invalid Beads variable value is rejected before spawn or receives a cause-specific argv-construction diagnostic.
Observed
`Command::spawn` returns InvalidInput for an interior NUL and the stage maps it to BEADS_BD_UNAVAILABLE.
Requirement / ADR
ADR-0021 defines BEADS_BD_UNAVAILABLE as inability to start the configured executable.
Requirement / ADR follow-up
No new ADR is needed; validate variable values before spawn or add a distinct stable argv-construction code.
Root cause
Only Beads variable keys are validated; values reach `Command::args` unchecked and the generic I/O mapping erases the cause.
Recommended fix
Reject control bytes in Beads variable values before process creation, or map argv construction errors separately.

Adversarial fuzz worker

output-bound-probe

Session sc-compose-fuzz-20260817-2 · Worker output-bound-probe

FAIL

Fuzz run descriptionIterationsPassResult
Output limit terminates a descendant holding the inherited pipe open 1 0/1 FAIL

Inputs exercised

CaseTemplate / inputOutcome
FUZZ-4177-OUT-01A shell starts `( sleep 1 ) &` then floods stdout past the cap, leaving the descendant with the inherited stdout descriptor.FAIL: killing only the direct child leaves the reader blocked until the descendant exits.

Findings

FUZZ-4177-OUT-01

Minimal template / frontmatter
not applicable; subprocess runner probe
Input
background descendant inherits stdout, direct child floods past the 64 KiB cap
Expected
An over-limit command terminates every descendant holding captured output pipes and returns promptly.
Observed
The original runner killed only the direct PID, so the pipe remained open until the orphaned descendant exited.
Requirement / ADR
ADR-0021 requires bounded captured stdout/stderr and termination after an output cap breach.
Requirement / ADR follow-up
No new ADR is needed; the production fix must retain process-tree termination on Unix and Job Object containment on Windows.
Root cause
Direct-child-only termination did not close inherited pipe descriptors held by descendants.
Recommended fix
Terminate the process group on Unix and the assigned Job Object on Windows, with a regression proving prompt return.

Metadata

Sessionsc-compose-fuzz-20260817-2
Seed4177
Provenancepost_hoc_reconstruction
Promoted testscrates/sc-composer-beads/src/execute.rs::nul_byte_poisoned_bead_variable_value_is_misreported_as_bd_unavailable; crates/sc-composer-beads/src/runner.rs::orphaned_descendant_holding_the_output_pipe_open_hangs_the_runner