defect_class: A

proves: every violating input is eliminated by the corrected guard

form: index - size + 1 <= 0

label: corrected: index < size

form: - index + size <= 0

label: not safety: index >= size

contradiction: the combination has no variable terms and asserts 1 <= 0, which is false

kind: farkas-elimination

out_of_model: Witnesses wider than the modelled fields (e.g. ~96-bit composite offsets): the class model fixes field widths, so a defect expressible only at a larger width is not represented.

out_of_model: Unsigned wrap-around arising from arithmetic performed *before* the guard is reached: the model begins at the guard, so a value already corrupted upstream is outside it.

title: off-by-one index against a size

verdict: COMPLETE


defect_class: B

form: payload - record + 8 <= 0

label: corrected: payload + 8 <= record

form: - payload + record - 7 <= 0

label: not safety: payload + 8 > record

title: payload length against record length with a dropped header allowance


defect_class: C

label: corrected: sel < 20

label: not safety: sel >= 20

title: bounded field missing an upper-bound test


defect_class: A-badfix

title: off-by-one 'fixed' by excluding one witness (DEMO: incomplete)

verdict: INCOMPLETE


defect_class: A-vacuous

title: off-by-one 'fixed' by rejecting all input (DEMO: vacuous)

verdict: VACUOUS