TZUTC: -0800
MSGID: 59109.sync_sys@1:103/705 2dbd73be
PID: Synchronet 3.21a-Linux master/48922a15c Dec 17 2025 GCC 12.2.0
TID: SBBSecho 3.34-Linux master/8bb133aa7 Dec 30 2025 GCC 12.2.0
BBSID: VERT
CHRS: ASCII 1
FORMAT: flowed
https://gitlab.synchro.net/main/sbbs/-/issues/685#note_8067

@Deuce here's an update from my further debugging...

# Synchronet ARM64 Crash Report - SpiderMonkey js_GetClassPrototype Segfault

## Summary
Synchronet BBS crashes with a segmentation fault on ARM64 (aarch64) when
JavaScript initializes during the events thread startup. The crash occurs in
`js_GetClassPrototype()` within SpiderMonkey.

## ROOT CAUSE IDENTIFIED: 47-bit Pointer Limitation in SpiderMonkey NaN-boxing

**The crash is caused by SpiderMonkey 1.8.5's NaN-boxing scheme only
supporting 47-bit pointers, but ARM64 Linux allocates memory at addresses
requiring 48+ bits.**

### Evidence from GDB:

```
(gdb) print /x 0xffffd2c04100 >> 47
$2 = 0x1
```

The address `0xffffd2c04100` has bit 47 set. When SpiderMonkey masks it to 47
bits:
- Original: `0xffffd2c04100`
- After 47-bit mask: `0x7fffd2c04100` (WRONG - high bit lost!)

Register dump showing the problem:
```
x0             0x7fffd2c04100      (invalid - masked to 47 bits)
x1             0xfffbffffd2c04100  (NaN-boxed value containing original
pointer)
```

## SOLUTION FOUND

**Run sbbs with `setarch --addr-compat-layout` to force memory allocations
into the lower 47-bit address space:**

```bash
setarch $(uname -m) --addr-compat-layout /sbbs/exec/sbbs
```

This works because `--addr-compat-layout` tells the kernel to use the legacy
memory layout which keeps allocations in the lower address range where
SpiderMonkey's 47-bit pointers work correctly.

### For Docker deployment, update the entrypoint:

```bash
#!/bin/bash
exec setarch $(uname -m) --addr-compat-layout /sbbs/exec/sbbs "$@"
```

## Environment

**System:**
- OS: Kali GNU/Linux Rolling 2025.2
- Kernel: 6.12.33+kali-arm64 #1 SMP
- Architecture: aarch64 (ARM64)
- Hardware: Parallels VM on Apple Silicon Mac
- Page Size: 4096 bytes

**Synchronet:**
- Version: 3.21b Debug
- Build: master/4089fb4 Jan 02 2026 02:23 with GCC 12.2.0
- Built from: Native ARM64 build (not QEMU emulated)

## Why Developer's RPi 500 Works

The Raspberry Pi 500 likely works because:
1. Raspberry Pi OS may use a memory layout that keeps allocations below the
47-bit boundary
2. Different kernel configuration for virtual address space
3. Possibly running 32-bit userspace (armhf) instead of 64-bit (aarch64)

## Technical Details

SpiderMonkey 1.8.5 uses NaN-boxing to store JavaScript values. In this scheme,
64-bit values are encoded as NaN floats, with pointers stored in the lower 47
bits of the mantissa. This works on x86_64 because Linux traditionally kept
user-space addresses below 0x7fffffffffff (47 bits).

However, ARM64 Linux can use a larger virtual address space, allocating memory
at addresses like `0xffffd2c04100` which requires 48 bits. When SpiderMonkey
extracts the pointer using a 47-bit mask, it corrupts the address.

## Debug Backtrace

```
Thread 12 "sbbs/events" received signal SIGSEGV, Segmentation fault.
0x0000fffff6d06060 in JSObject::getClass (this=0x7fffd2c04100) at jsobj.h:427

#0  JSObject::getClass (this=0x7fffd2c04100)  <- INVALID pointer (should be
0xffffd2c04100)
#1  JSObject::isFunction (this=0x7fffd2c04100)
#2  js::IsFunctionObject (v=...)
#3  js::FindClassPrototype (...)
    v = {data = {debugView = {payload47 = 140736796311808, tag =
JSVAL_TAG_OBJECT}}}
...
#14 js_InitFunctionClass (...)
#15 js_InitFunctionAndObjectClasses (...)
#16 JS_InitStandardClasses (...)
#17 js_CreateGlobalObject (...)
#18 js_CreateCommonObjects (...)
#19 sbbs_t::js_init (...)
#20 event_thread (...)
```

## Alternative Solutions

1. **Use `setarch --addr-compat-layout`** (RECOMMENDED - works now)
2. **Update to newer SpiderMonkey** - Newer versions handle 48+ bit pointers
correctly
3. **Patch SpiderMonkey** - Modify the NaN-boxing code to use proper 48-bit
pointer handling for ARM64
4. **Use 32-bit build** - armhf build would avoid the issue entirely

## Previous Theories (Ruled Out)

- **Pointer Authentication Code (PAC)**: Tested with `arm64.nopauth` kernel
parameter - crash still occurred
- **Docker networking**: Crash occurs both inside and outside Docker
- **Library path issues**: RPATH verified correct, all libraries loading
properly


Dockerfile used for debug build:
```
FROM debian:bookworm-slim

ENV DEBIAN_FRONTEND=noninteractive
ENV SBBSCTRL=/sbbs/ctrl
ENV SBBSEXEC=/sbbs/exec
ENV TERM=xterm

RUN apt-get update && apt-get install -y \
    build-essential \
    git \
    libncurses-dev \
    libnspr4-dev \
    libcap-dev \
    libarchive-dev \
    pkg-config \
    zip \
    unzip \
    perl \
    python3 \
    && rm -rf /var/lib/apt/lists/*

# Clone Synchronet
RUN git clone --depth 1 https://gitlab.synchro.net/main/sbbs.git /sbbs

# Build main Synchronet (DEBUG build for better backtraces)
WORKDIR /sbbs/src/sbbs3
ENV SBBSDIR=/sbbs
RUN make SBBSDIR=/sbbs 2>&1 && \
    echo "=== Main build completed (DEBUG) ===" && \
    echo "=== Finding build directories ===" && \
    ls -la /sbbs/src/sbbs3/ | grep gcc

# Copy executables from the MAIN build directory (not subdirectories)
# Debug builds may use different suffix - find the actual directory
RUN ARCH=$(uname -m | sed 's/x86_64/x64/' | sed 's/aarch64/aarch64/') && \
    echo "Architecture: $ARCH" && \
    echo "Looking for exe directories:" && \
    find /sbbs/src/sbbs3 -maxdepth 1 -type d -name "gcc.linux.${ARCH}.*" && \
    MAIN_EXE_DIR=$(find /sbbs/src/sbbs3 -maxdepth 1 -type d -name
"gcc.linux.${ARCH}.exe.*" | head -1) && \
    MAIN_LIB_DIR=$(find /sbbs/src/sbbs3 -maxdepth 1 -type d -name
"gcc.linux.${ARCH}.lib.*" | head -1) && \
    echo "Main exe dir: $MAIN_EXE_DIR" && \
    echo "Main lib dir: $MAIN_LIB_DIR" && \
    if [ -d "$MAIN_EXE_DIR" ]; then \
        echo "Copying from main exe dir:" && \
        ls -la "$MAIN_EXE_DIR" && \
        cp -v "$MAIN_EXE_DIR"/* /sbbs/exec/; \
    fi && \
    if [ -d "$MAIN_LIB_DIR" ]; then \
        echo "Copying from main lib dir:" && \
        ls -la "$MAIN_LIB_DIR" && \
        cp -v "$MAIN_LIB_DIR"/*.so /sbbs/exec/; \
    fi

# Copy executables from subdirectory builds (scfg, uedit, umonitor, etc.)
RUN ARCH=$(uname -m | sed 's/x86_64/x64/' | sed 's/aarch64/aarch64/') && \
    for subdir in scfg uedit umonitor; do \
        EXE_DIR=$(find /sbbs/src/sbbs3/${subdir} -maxdepth 1 -type d -name
"gcc.linux.${ARCH}.exe.*" 2>/dev/null | head -1); \
        if [ -d "$EXE_DIR" ]; then \
            echo "Copying from $EXE_DIR:" && \
            cp -v "$EXE_DIR"/* /sbbs/exec/ 2>/dev/null || true; \
        fi; \
    done

# Verify key files exist
RUN echo "=== Contents of /sbbs/exec ===" && \
    ls -la /sbbs/exec/sbbs /sbbs/exec/scfg /sbbs/exec/baja && \
    echo "=== Checking rpath ===" && \
    objdump -x /sbbs/exec/sbbs | grep -E 'R.*PATH' || echo "No RPATH found" &&
\
    echo "=== Checking ldd ===" && \
    ldd /sbbs/exec/sbbs

# Build doors/external programs (DEBUG)
WORKDIR /sbbs/src/doors
RUN for dir in */; do \
        if [ -f "$dir/Makefile" ] || [ -f "$dir/GNUmakefile" ]; then \
            echo "Building door: $dir"; \
            make -C "$dir" 2>&1 || true; \
        fi; \
    done && \
    echo "=== Doors build completed ==="

# Copy built door executables
RUN find /sbbs/src/doors -type f -executable -newer /sbbs/src/doors -exec file
{} \; 2>/dev/null | \
    grep "ELF" | cut -d: -f1 | while read f; do \
        name=$(basename "$f"); \
        dest_dir="/sbbs/xtrn/$name"; \
        mkdir -p "$dest_dir" 2>/dev/null || true; \
        cp "$f" "$dest_dir/" 2>/dev/null || cp "$f" /sbbs/xtrn/ 2>/dev/null ||
true; \
    done

# Copy default config files
RUN cp -r /sbbs/ctrl.new/* /sbbs/ctrl/ 2>/dev/null || true
RUN cp -r /sbbs/text.new/* /sbbs/text/ 2>/dev/null || true

# Create required directories
RUN mkdir -p /sbbs/data /sbbs/ctrl /sbbs/text \
    /sbbs/node1 /sbbs/node2 /sbbs/node3 /sbbs/node4 \
    /sbbs/xtrn /sbbs/mods

# Add entrypoint
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 513 23 22 80 443 21

WORKDIR /sbbs
ENTRYPOINT ["/entrypoint.sh"]
CMD ["/sbbs/exec/sbbs"]
```
--- SBBSecho 3.34-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
SEEN-BY: 103/13 705 105/81 106/201 124/5016 128/187 129/14 153/757
SEEN-BY: 153/7715 154/10 30 110 203/0 218/700 221/0 226/30 227/114
SEEN-BY: 229/110 112 134 206 275 317 400 426 428 470 700 705 240/1120
SEEN-BY: 240/5832 263/1 266/512 280/464 5003 5006 291/111 292/8125
SEEN-BY: 301/1 320/219 322/757 341/66 234 342/200 396/45 423/120 460/58
SEEN-BY: 460/256 1124 633/280 712/848 770/1 902/26 5020/400 8912 5054/30
SEEN-BY: 5075/35
PATH: 103/705 280/464 460/58 229/426