@harsshdotnerd.bsky.social
Setup: two adjacent pages, first one RX, second one PROT_NONE, instruction placed so its first two bytes are the last two bytes of the mapped page. Fork per case, read the signal from waitpid.
Control maps the second page executable so the same bytes run fully resident.
Control maps the second page executable so the same bytes run fully resident.
September 15, 2026 at 3:59 AM
Setup: two adjacent pages, first one RX, second one PROT_NONE, instruction placed so its first two bytes are the last two bytes of the mapped page. Fork per case, read the signal from waitpid.
Control maps the second page executable so the same bytes run fully resident.
Control maps the second page executable so the same bytes run fully resident.
Raymond Chen's post on why x86's undefined opcode is called ud2 notes that ud0/ud1 still decode their operand bytes. I measured that: at a page boundary, an 8-byte ud0 gives SIGSEGV, not SIGILL, from 7 of the last 8 positions.
September 15, 2026 at 3:58 AM
Raymond Chen's post on why x86's undefined opcode is called ud2 notes that ud0/ud1 still decode their operand bytes. I measured that: at a page boundary, an 8-byte ud0 gives SIGSEGV, not SIGILL, from 7 of the last 8 positions.