sigil-kernel 8be7ad3 closes a 1.0-security gate in the SRDX transport layer and fixes a silent constant error in the Pi 4B board HAL. Two changes: ① xport_uptr_ok in core/srdx_xport.sg now enforces both a lower bound (XPORT_EL0_BASE = 0x100000) and the upper bound (XPORT_USER_MAX = 0xFFC000) that was previously defined but never checked — closing a path where EL0 code could pass kernel-space pointers to DMA. ② hal/aarch64/board_pi4.sg fixes all BCM2711 peripheral base constants, which were returning Pi 3 (BCM2835) values due to unsigned addresses exceeding signed-32-bit max in Sigil.
EL0→EL1 bounds gate
The bug
xport_uptr_ok(ptr, len) is the gate that validates every user-supplied pointer before the SRDX transport layer passes it to DMA (syscalls 113–116). Before this patch: only a null-pointer check existed. XPORT_USER_MAX = 0xFFC000 was defined in the file but never referenced in xport_uptr_ok. This meant an EL0 process could supply a pointer such as 0xFF0000 (in kernel address space above 0xFFC000) and the transport layer would pass it directly to DMA — a classic kernel DMA aliasing bug. This is a 1.0-security gate: all EL0→EL1 pointer paths must be range-checked.The fix
XPORT_EL0_BASE = 0x100000 added: the lower bound of the EL0 user address space. xport_uptr_ok(ptr, len) now enforces: ptr >= XPORT_EL0_BASE (catches null and all sub-base pointers) AND ptr + len <= XPORT_USER_MAX (upper bound; catches both ptr > USER_MAX and straddling ranges where ptr is OK but ptr+len crosses into kernel space). xport_outbuf_ok(ptr) (for the 6-byte MAC output buffer in the link syscall) applies the same upper-bound gate. Test additions: 2 new cases — (a) ptr = 0xFFD000 (above USER_MAX): rejected ✅; (b) ptr = 0xFFB000, len = 0x2000 (straddles USER_MAX): rejected ✅. All 7 checks pass: SRT send=1 recv=1 lnk=1 bnd=1 K.Pi 4B PBASE fix
The bug
The BCM2711 SoC (Pi 4B) has peripheral base
0xFE000000. In a 32-bit signed integer, 0xFE000000 = -33554432 (two's complement). Sigil integer literals must be written as two's-complement negatives when the value exceeds 0x7FFFFFFF. Before this patch, board_pi4.sg used the unsigned hex form (0xFE000000), which Sigil silently truncated or re-interpreted — producing 0x3F000000 (the BCM2835/Pi 3B value) at runtime. Every derived constant (UART0, GPIO, MBOX, GIC) inherited the wrong base, making all Pi 4B peripheral access point at Pi 3 addresses.The fix
PI4_PBASE = -33554432 (= 0xFE000000). UART0 = PI4_PBASE + 0x201000, GPIO = PI4_PBASE + 0x200000, MBOX = PI4_PBASE + 0xB880, etc. The GIC (Generic Interrupt Controller) base at 0xFF840000 is also negative (-8126464). New pi4_const_test.sg verifies: (a) derived offsets are consistent (UART0 - PI4_PBASE = 0x201000), (b) GIC is positive relative to PI4_PBASE check, (c) sign bit is set on all peripheral-base addresses (confirming two's-complement encoding). P4C base=1 gic=1 sgn=1 K. Pi 4B peripheral access now points at the correct BCM2711 registers.