Openheimer, split: land the boundary fixes, drop the hot-path guards, write OH-11

[Ttimmahlax]

What this is

The Openheimer campaign left ~1,400 uncommitted lines and a log of 202 findings against this crate. This PR is that tree split: every check on a value a caller can choose is kept; every guard on a contract this crate's own callers already uphold is dropped; and the one fix the log claimed but never wrote (OH-11) is written.

Landed

• Checked arithmetic on sizes / alignments / offsets / option values that wrapped or debug-panicked, all on cold paths (huge_alloc, the aligned malloc/realloc family, guarded alloc, os::page_align_up / alloc_aligned, bin_size, page_under_utilized, option scaling and clamping, reserve_huge_os_pages, prim::fixed sizing, the segment-map window walk, subprocess ids, is_aligned_to(x, 0)).
• manage_os_memory refuses null / wrapped / unmapped / already-registered ranges (prim::range_is_reserved asks the OS); arena_register claims its slot with a CAS and frees on refuse.
• Hook re-entry guards; debug_checks guard is an assert! (it was compiled out of the build the feature exists for).
• Thread exit abandons every heap the dying thread owns, and create_heap bootstraps the thread first.
• C ABI: out-pointers refuse null / misaligned, dupenv clears outs on EINVAL, realpath bounded by PATH_MAX, heap handles shape-checked once in heap_ptr, mi_heap_set_default refuses a bad handle.

Withdrawn (139 of the 202 IDs)

Null / 0x1 / floor+8 probes against internal unsafe fns, chased up a ladder of six address floors and closed with a segment-map membership lookup on every internal handle plus a heap-registry walk under a global lock on the free path. At the campaign's stopping point that cost free +27, realloc +164, page_extend +68 instructions, never measured. page.rs is reverted whole; segment.rs, heap.rs, alloc.rs, segment_map.rs, lib.rs are rebuilt from main plus only the boundary hunks. Finding-by-finding: docs/plans/openheimer-run.md §4.

OH-11, written for real

A remote double free links the block onto xthread_free twice, so the chain is cyclic, and the pre-existing "n > used" check after the collect walk was unreachable: the walk never returned. remote_free now refuses a block that is already the chain head, and the collect walk is bounded by used. Getting the push-time check onto free at zero cost took three tries (a diverging callee pins a frame to free on Windows x64); the shape that works and why is documented at page::remote_double_free.

Cost, measured

Release assembly per symbol, main → branch, Windows / Linux x86-64:

symbol	Windows	Linux
alloc::free	62 → 66	63 → 67
alloc::malloc, malloc_aligned_at, page_extend, usable_size	0	0
alloc::realloc	+7	+6
alloc::realloc_aligned_at	+1	+1

The free delta is two cmp; je pairs on the cross-thread arm; the local path is byte-identical and the function keeps no frame.

Verification

• tests/double_free.rs +4 child-process regressions, green under default / secure / blockmap / both.
• tests/openheimer.rs keeps 37 of the campaign's 95; the FFI pack keeps 8 of 16.
• Full suite green at default and ra_small_profile; gate-selftest 11/11 (one anchor re-based); wasm-size 20169 → 20321 gzipped (baseline updated); unsafe census 909 → 928, every site rowed in UNSAFE.md; fmt and clippy -D warnings clean.

Second commit banks the fuzz corpus the campaign's local runs produced (tracked by precedent).

🤖 Generated with Claude Code