Pith Number

pith:IGUTFW24

pith:2026:IGUTFW24DLM2ICDKPYDFEJR4TP

not attested not anchored not stored refs resolved

Automatic Detection of Reference Counting Bugs in Linux Kernel Drivers

Joe Hattori, Ken Sakayori, Naoki Kobayashi

DrvHorn reduces reference counting verification in Linux kernel drivers to assertion checking through kernel modeling and program slicing.

arxiv:2605.13246 v1 · 2026-05-13 · cs.CR · cs.SE

Open paper page JSON Open Graph Bundle Merged state Verified badge What is a Pith Number?

Add to your LaTeX paper

\usepackage{pith}
\pithnumber{IGUTFW24DLM2ICDKPYDFEJR4TP}

Prints a linked badge after your title and injects PDF metadata. Compiles on arXiv. Learn more · Embed verified badge

Record completeness

1 Bitcoin timestamp

2 Internet Archive

3 Author claim open · sign in to claim

4 Citations open

5 Replications open

✓ Portable graph bundle live · download bundle · merged state

The bundle contains the canonical record plus signed events. A mirror can host it anywhere and recompute the same current state with the deterministic merge algorithm.

Claims

C1strongest claim

DrvHorn discovered 545 bugs, of which 424 were previously unknown, across all platform drivers in v6.6 Linux kernel, with a lower false positive rate of 29.9% compared to prior studies.

C2weakest assumption

The kernel modeling and aggressive slicing preserve enough reference counting semantics to detect real bugs without excessive distortion or omission of relevant paths.

C3one line summary

DrvHorn automatically detects reference counting bugs in Linux kernel drivers by reducing verification to assertion checking, uncovering 545 bugs (424 new) in v6.6 with 29.9% false positives and 45 merged patches.

References

16 extracted · 16 resolved · 0 Pith anchors

[1] Devicetree Kernel API,https://docs.kernel.org/devicetree/kernel-api. html

[2] Linux and the Devicetree,https://docs.kernel.org/devicetree/usage-model. html

[3] LLVM’s Analysis and Transform Passes,https://llvm.org/docs/Passes.html

[4] MITRE. CVE-2023-7192,https://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2023-7192 2023

[5] ACM SIGOPS Operating Systems Review40(4), 73–85 (2006) 2006

Receipt and verification

First computed	2026-05-18T02:44:49.465378Z
Builder	pith-number-builder-2026-05-17-v1
Signature	Pith Ed25519 (`pith-v1-2026-05`) · public key
Schema	pith-number/v1.0

Canonical hash

41a932db5c1ad9a4086a7e0652263c9bd4bbc6bea4ce9445f291521f33e4504d

Aliases

arxiv: 2605.13246 · arxiv_version: 2605.13246v1 · doi: 10.48550/arxiv.2605.13246 · pith_short_12: IGUTFW24DLM2 · pith_short_16: IGUTFW24DLM2ICDK · pith_short_8: IGUTFW24

Agent API

Resolver JSON Graph JSON Events JSON Schema Signing key

Verify this Pith Number yourself

curl -sH 'Accept: application/ld+json' https://pith.science/pith/IGUTFW24DLM2ICDKPYDFEJR4TP \
  | jq -c '.canonical_record' \
  | python3 -c "import sys,json,hashlib; b=json.dumps(json.loads(sys.stdin.read()), sort_keys=True, separators=(',',':'), ensure_ascii=False).encode(); print(hashlib.sha256(b).hexdigest())"
# expect: 41a932db5c1ad9a4086a7e0652263c9bd4bbc6bea4ce9445f291521f33e4504d

Canonical record JSON

{
  "metadata": {
    "abstract_canon_sha256": "7f2e8f2afe5743b511b8a6b98064d6393e8301d7b45d3972f150a73772248e9c",
    "cross_cats_sorted": [
      "cs.SE"
    ],
    "license": "http://creativecommons.org/licenses/by/4.0/",
    "primary_cat": "cs.CR",
    "submitted_at": "2026-05-13T09:31:08Z",
    "title_canon_sha256": "4ec7652bbd6ed0a4dbb1cdb115304c7495913b38e813dea7ecabb34597f52e22"
  },
  "schema_version": "1.0",
  "source": {
    "id": "2605.13246",
    "kind": "arxiv",
    "version": 1
  }
}