fix(encoder): T3 ADD.W raw-imm packing — ADDW (T4) for static offsets 0x100..0xFFF (#681)

[avrabe]

Fixes #681.

Bug

encode_thumb32_add_imm packed a raw immediate into the T3 ADD.W i:imm3:imm8 field. That field is a ThumbExpandImm modified immediate (raw == expanded only for imm <= 0xFF): ThumbExpandImm(0x200) = 0, ThumbExpandImm(0x400) = 0x8000_0000. Every dynamic-address i32/i64/i8/i16 load/store with a static offset ∈ [0x100, 0xFFF] silently accessed the wrong address — and in --safety-bounds software the guard (correct T4 ADDW) checked the intended address while the access used the mis-encoded one: a bounds-check bypass. Exact #253/#255 ThumbExpandImm class, in a helper #255's audit didn't cover, reached via the #382 paths.

Fix

imm <= 0xFFF now delegates to encode_thumb32_add, which already implements the correct split per #253:

• imm <= 0xFF → T3 ADD.W (raw == expanded — bit-identical to before)
• 0x100..=0xFFF → ADDW (T4, 0xF200, plain imm12)
• > 0xFFF → unchanged MOVW/MOVT + ADD.W-register path (arm backend: "ADD immediate too large for single instruction" — gale_k_stack_push_decide (struct-return) fails to compile (0.11.42 + 0.11.43) #350)

Byte sizes are unchanged everywhere, so the #511 estimator↔encoder agreement oracle stays green as-is.

Class audit (no wildcard survives)

Site	Finding	Action
encode_thumb32_add_imm	the #681 bug	T3/T4 split via encode_thumb32_add
ArmOp::Rsb (Thumb T2)	raw-packed ThumbExpandImm field; no plain-imm12 form exists	gated on try_thumb_expand_imm, Err on non-representable. All emitters use #32 → byte-identical
ArmOp::Rsb (A32)	*imm & 0xFF silent masking (#378 class)	Err for imm > 0xFF
encode_thumb32_and_imm_raw	raw-packed ThumbExpandImm field	gated; only caller (POPCNT #0x3F) byte-identical
encode_thumb32_sub / adds / subs / cmp / orr / eor / cmn	already T4-split or expand-gated (#253/#255)	pinned, no change

Oracles

• Clang cross-check (feat(aarch64): milestone-1a — clang-verified A64 encoder + minimal selector (#538) #544 pattern): test_encode_add_imm_thumb_expand_681 pins 0xFF / 0x100 / 0x104 / 0x200 / 0x3FC / 0x400 / 0xFFF (+ a non-scratch rd/rn permutation) bit-for-bit against clang -target thumbv7m-none-eabi. test_encode_add_imm_large_350's 0x123 assertion upgraded from length-only (which let the mis-encoding pass CI, as the issue notes) to exact ADDW bytes.
• Red→green differential (scripts/repro/addw_offset_681_differential.py, unicorn-vs-wasmtime, symtab-based per ci(vcr-oracle): CI-gate the RV32 immediate-shift-fold execution oracle (#472, #242) #489): dynamic base + static offsets {256,512,1020,1024,4092} over i32/i8/i16/i64 load+store, --safety-bounds none and software — including the bypass pin (in-bounds base, guard passes, pre-fix access escapes 2 GiB past base) and OOB trap-to-trap.
  • RED on pre-fix main: 36/49 mismatches (gale's clobber returns 4660 instead of 111; offset-1024 access faults UC_ERR_WRITE_UNMAPPED 2 GiB away)
  • GREEN on this branch: 49/49; the OOB software case now stops at the guard's UDF
  • CI-wired into the trap-semantics oracle job next to thumb-2: i32.shl/shr_s/shr_u don't mask the shift amount mod 32 — amounts >=32 silently compile to 0 (VCR-SEL regression; Rocq ARM model masks like WASM so proof is vacuous) #682.
• Frozen anchors: frozen_codegen_bytes 10/10, .text bit-identical (fixtures never hit the dynamic-base + big-offset shape).
• Estimator agreement (test(vcr-oracle): estimator↔encoder agreement oracle for the optimized path (#498, #242) #511): green, no size deltas.
• Workspace tests green, cargo fmt --check clean, cargo clippy --workspace --all-targets -- -D warnings clean.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!