Oops, missed there was already v3 yesterday. Reposting comments here.
On Wed, Jul 22, 2026 at 05:27:31AM +0000, Yiyang Chen wrote:
> When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
> destination register inherits the pointer state from the source pointer.
> Copying only selected fields is fragile because pointer provenance is
> tracked by several bpf_reg_state fields.
>
> Use verifier-env scratch storage to preserve the scalar operand while
> replacing the destination with the full pointer state. This preserves the
> frame number for PTR_TO_STACK registers and keeps parent identity fields
> consistent.
>
> Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
Nit: This doesn't look right. Without bpf2bpf there is just one frame,
hence there isn't a bug at this point. I think the commit f4d7e40a5b71
("bpf: introduce function calls (verification)") the you mentioned in v1
should be used here instead.
[...]
