# Bytecode feedback vector mismatch

Compiler emits bytecode inconsistent with feedback vectors, jump offsets, or opcode dispatch; reparse diverges from first parse

_Area: Memory corruption and native code. Seen in 4 disclosed reports; 3 confirmed bounties, median $10,000, range $100-$10,000; latest 2022-12-02. Updated 2026-10-23._

## How it works
A compiler or VM assumes that the bytecode it emits and the metadata attached to it (feedback vectors, jump offsets, opcode class ranges, register slots) stay consistent across passes. When a second pass (reparse, recompile, peephole rewrite, or a special-cased construct) produces different bytecode but reuses metadata from the first pass, or when an optimization elides a value the calling convention still reads, the runtime consumes stale or mismatched state. The result is a type confusion, out-of-bounds jump, or null dereference.

## Where it shows up
- Peephole rules that drop a MOVE whose destination register is later read implicitly (block slot, calling convention) [E1](https://bugbountylibrary.com/r/h1%3A181828.md)
- Initial parse vs. reparse handling the same syntax with different strictness or context [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-4262.md)
- Opcode dispatch tables passing a sibling instruction's CLASS_OFFSET [E3](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.19.md)
- Synthetic loop/exception contexts pushed but not popped before an enclosing jump patch [E4](https://bugbountylibrary.com/r/h1%3A183356.md)
- Backward jumps into setup opcodes (OP_ONERR) that reallocate per iteration [E5](https://bugbountylibrary.com/r/h1%3A200387.md)
- Constructs valid in one implementation but a syntax error in the reference [E4](https://bugbountylibrary.com/r/h1%3A183356.md)[E5](https://bugbountylibrary.com/r/h1%3A200387.md)

## How to review
The invariant: every bytecode stream must be paired with metadata generated for that exact stream, and every register read implicitly by the calling convention must be written on all paths. Check that reparse/recompile regenerates feedback vectors rather than reusing them [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-4262.md); that each core chip's opcode offset matches its own enum [E3](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.19.md); that synthetic contexts are popped before enclosing patches [E4](https://bugbountylibrary.com/r/h1%3A183356.md); and that peephole rules preserve implicitly-consumed registers [E1](https://bugbountylibrary.com/r/h1%3A181828.md). Diff bytecode between passes and between implementations for odd-but-valid syntax.

## Variants seen
- Peephole eliding a MOVE feeding an implicit block slot [E1](https://bugbountylibrary.com/r/h1%3A181828.md)
- Parse/reparse strictness divergence with reused feedback vectors [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-4262.md)
- Wrong opcode CLASS_OFFSET in a zkVM branch chip [E3](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.19.md)
- Unpopped LOOP_RESCUE context corrupting jump offsets [E4](https://bugbountylibrary.com/r/h1%3A183356.md)
- `redo` in rescue emitting a self-loop into OP_ONERR [E5](https://bugbountylibrary.com/r/h1%3A200387.md)

## Impact and severity
Range from segfault/DoS [E1](https://bugbountylibrary.com/r/h1%3A181828.md)[E4](https://bugbountylibrary.com/r/h1%3A183356.md)[E5](https://bugbountylibrary.com/r/h1%3A200387.md) to renderer RCE via type confusion [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-4262.md) and corrupted branch/PC evaluation [E3](https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.19.md). Severity rises when the mismatch is reachable from untrusted input and yields type confusion rather than a crash.

## Why fixes fail
Fuzzing that only exercises the lazy path misses reparse divergence; forcing double compilation (`--no-lazy --stress-lazy-source-positions`) is needed to surface it [E2](https://bugbountylibrary.com/r/p0%3ACVE-2022-4262.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A181828.md
- E2: https://bugbountylibrary.com/r/p0%3ACVE-2022-4262.md
- E3: https://bugbountylibrary.com/r/cantina%3Aopenvm_january2025%3A3.1.19.md
- E4: https://bugbountylibrary.com/r/h1%3A183356.md
- E5: https://bugbountylibrary.com/r/h1%3A200387.md