safety security
The Specification Hid 125 Processor Bugs
A differential-testing system generated instruction cases from SLEIGH definitions, then checked emulator behavior against hardware references across five architectures.
Summary
A differential-testing system generated instruction cases from SLEIGH definitions, then checked emulator behavior against hardware references across five architectures.
InSPECtor treats processor specifications as security-critical software rather than unquestioned ground truth. It enumerates decodable instruction forms from open SLEIGH specifications, generates targeted machine states and compares decoding and emulation with physical hardware references. Across x86-64, AArch64, ARM/Thumb, RISC-V and MSP430, the authors report more than 38,920 discrepancies that resolved into 125 unique bugs with proposed fixes, including decoding, semantic and cross-vendor inconsistencies. The results concern the tested open specifications and reference systems; they do not mean that every discrepancy is a hardware defect.
Why it matters
A differential-testing system generated instruction cases from SLEIGH definitions, then checked emulator behavior against hardware references across five architectures.
Limits and context
- The results concern the tested open specifications and reference systems; they do not mean that every discrepancy is a hardware defect.
Key claims
A differential-testing system generated instruction cases from SLEIGH definitions, then checked emulator behavior against hardware references across five architectures.
Qualification: The results concern the tested open specifications and reference systems; they do not mean that every discrepancy is a hardware defect.
Evidence: source-2026-08-14-002
Sources
- arXiv preprint 2608.13042arXiv · primary research
Corrections
No corrections have been recorded for this story.