{
  "asset": "M1 \u2014 impossibility theorem: finite empirical validation cannot be sound",
  "theorem": "For every class \u2203 a guard passing a finite battery yet unsound (T1); the formal oracle accepts iff guard \u27fa in_bounds, false-accept measure 0 (T2). So the formal oracle is the unique sound+complete acceptor.",
  "n_classes": 6,
  "T1_empirical_incompleteness": {
    "n_classes_with_battery_fooling_unsound_guard": 6,
    "all_classes": true,
    "per_class": [
      {
        "name": "openssl_heartbeat",
        "loosened_atom_index": 0,
        "delta": 1,
        "gamed_guard_fools_finite_battery": true,
        "gamed_guard_unsound": true,
        "blind_spot_witness": {
          "hb_payload": 0,
          "hb_record_len": 2
        },
        "battery": "random fuzz battery, 4096 i.i.d. domain samples (seed 0)"
      },
      {
        "name": "libxml2_len_overflow",
        "loosened_atom_index": 0,
        "delta": 1,
        "gamed_guard_fools_finite_battery": true,
        "gamed_guard_unsound": true,
        "blind_spot_witness": {
          "xl_len": 2147483644,
          "xl_incr": 4
        },
        "battery": "random fuzz battery, 4096 i.i.d. domain samples (seed 0)"
      },
      {
        "name": "zlib_inflate_extra",
        "loosened_atom_index": 1,
        "delta": 1,
        "gamed_guard_fools_finite_battery": true,
        "gamed_guard_unsound": true,
        "blind_spot_witness": {
          "zl_off": 0,
          "zl_copy": 1,
          "zl_extra_max": 0
        },
        "battery": "random fuzz battery, 4096 i.i.d. domain samples (seed 0)"
      },
      {
        "name": "libpng_rfc1123",
        "loosened_atom_index": 0,
        "delta": 1,
        "gamed_guard_fools_finite_battery": true,
        "gamed_guard_unsound": true,
        "blind_spot_witness": {
          "pn_month": 0
        },
        "battery": "random fuzz battery, 4096 i.i.d. domain samples (seed 0)"
      },
      {
        "name": "sudo_set_cmnd",
        "loosened_atom_index": 0,
        "delta": 1,
        "gamed_guard_fools_finite_battery": true,
        "gamed_guard_unsound": true,
        "blind_spot_witness": {
          "su_idx": 1,
          "su_size": 1
        },
        "battery": "random fuzz battery, 4096 i.i.d. domain samples (seed 0)"
      },
      {
        "name": "curl_ntlm_type3",
        "loosened_atom_index": 1,
        "delta": 1,
        "gamed_guard_fools_finite_battery": true,
        "gamed_guard_unsound": true,
        "blind_spot_witness": {
          "cu_size": 0,
          "cu_ntresplen": 1,
          "cu_bufsize": 0
        },
        "battery": "random fuzz battery, 4096 i.i.d. domain samples (seed 0)"
      }
    ],
    "heartbleed_exact": {
      "exact": true,
      "class": "openssl_heartbeat (CVE-2014-0160)",
      "gamed_guard": "ovh=3,slk=1,op=le",
      "fools_fuzz_battery": true,
      "domain_size": 281474976710656,
      "exact_over_acceptance": 65536,
      "over_acceptance_fraction": 2.3283064365386963e-10,
      "crosscheck_width": [
        6,
        10
      ],
      "crosscheck_brute": 64,
      "crosscheck_analytic": 64,
      "crosscheck_agree": true,
      "samples_for_50pct_detection": 2977044472,
      "interpretation": "a fuzzer needs ~2,977,044,472 i.i.d. draws for even a coin-flip chance of catching this blind spot; the formal oracle catches it with certainty."
    }
  },
  "T2_formal_completeness": {
    "n_classes_false_accept_measure_zero": 6,
    "all_classes": true,
    "per_class": [
      {
        "name": "openssl_heartbeat",
        "sound": true,
        "no_false_reject": false,
        "guard_equiv_in_bounds": false,
        "false_accept_measure_zero": true
      },
      {
        "name": "libxml2_len_overflow",
        "sound": true,
        "no_false_reject": true,
        "guard_equiv_in_bounds": true,
        "false_accept_measure_zero": true
      },
      {
        "name": "zlib_inflate_extra",
        "sound": true,
        "no_false_reject": true,
        "guard_equiv_in_bounds": true,
        "false_accept_measure_zero": true
      },
      {
        "name": "libpng_rfc1123",
        "sound": true,
        "no_false_reject": true,
        "guard_equiv_in_bounds": true,
        "false_accept_measure_zero": true
      },
      {
        "name": "sudo_set_cmnd",
        "sound": true,
        "no_false_reject": true,
        "guard_equiv_in_bounds": true,
        "false_accept_measure_zero": true
      },
      {
        "name": "curl_ntlm_type3",
        "sound": true,
        "no_false_reject": true,
        "guard_equiv_in_bounds": true,
        "false_accept_measure_zero": true
      }
    ]
  },
  "empirical_validation_provably_unsound": true,
  "formal_oracle_false_accept_measure_zero": true,
  "headline_detection_samples": 2977044472,
  "lean": {
    "leanchecker_available": true,
    "kernel_checked": true,
    "false_control_rejected": true
  },
  "honest_scope": "T1 is constructive over the bounded fragment domain; the EXACT blind-spot count is given for Heartbleed (closed form, cross-checked vs brute enumeration); other classes report a concrete blind-spot witness (positive measure) rather than a closed-form count.",
  "what_this_is": "A MACHINE-CHECKED FORMALIZATION + EXACT MODEL-COUNT of the classical observation that testing shows the presence, not the absence, of bugs (Dijkstra 1969). The novel, deliverable content is (a) the exact closed-form blind-spot count (65536 = 2^16 for Heartbleed, cross-checked against brute enumeration) and (b) a Lean-kernel-checked witness that a battery-passing guard is unsound \u2014 NOT the qualitative claim itself, which is well known.",
  "fuzzer_model_caveat": "The ~2.98e9-draws statistic models the fuzzer as UNIFORM i.i.d. sampling of the domain. Real fuzzers are coverage-guided / boundary-seeking and may find a thin off-boundary slab (delta=1) far faster; the point is the soundness/completeness GAP (a formal oracle catches it with certainty; a sampler cannot guarantee to), not a claim about wall-clock fuzzer performance.",
  "does_not_claim": "Does NOT prove any specific deployed AIxCC/APR pipeline is unsound. It proves the EXISTENCE of a battery-passing unsound guard per class \u2014 the general reason test/fuzz acceptance is not a soundness certificate."
}