BDS-BCB: Code and Data for Branch Delay Slot Bounds Check Bypass Vulnerability on LoongArch WebAssembly JIT

This repository contains the proof-of-concept code, fuzzing data, cross-compiler analysis scripts, and vulnerability disclosure materials accompanying the BDS-BCB (Branch Delay Slot Bounds Check Bypass) research. BDS-BCB is a compiler-induced sandbox escape vulnerability in which LLVM's LoongArch instruction scheduler places memory access instructions into the branch delay slots of bounds-checking branches, causing out-of-bounds accesses to execute before security checks take effect. Contents: - Pure-assembly PoC proving ISA-level defect without compiler dependency- End-to-end WebAssembly sandbox escape exploit (host memory read/write, privilege escalation)- Fuzzing framework with 427 generated functions (35.4% vulnerability rate, 19 instruction fingerprints)- Cross-compiler comparison scripts (LLVM 18/19/21/22 vs GCC 8.3)- Detection and analysis scripts for BDS-BCB patterns in LoongArch binaries- Minimal reproducer and disclosure advisory draftsEnvironment: LoongArch64 (QEMU 9.2.3 user-mode emulation), Rust nightly toolchain, GCC 8.3 cross-compiler.