Re: RFC: a checked mbuf accessor for -fbounds-safety

Hi Jessica,

Sorry for the late reply, the start of the semester had been hectic.

On Wed, 16 Sep 2026 at 02:27:11 CEST, Jessica Clarke wrote:
> I am very concerned about the amount of churn and annotations these
> diffs are already creating for just some of the basic groundwork,

The Foundation raised the same concern, and I will be working with the
CICD team on a pipeline that builds the annotated files with the flag. I
will be working on that in the next milestone.
 
> the ways in which ISO C constructs that are explicitly stated in the
> spec to be semantically identical are treated as not being the same
> under -fbounds-safety.

The two cases from your D58985 review are deliberate in -fbounds-safety.
A parameter written as [] still becomes a __single pointer, which cannot
be indexed.  People write generally write [] when they mean to index it,
so the compiler reports the mismatch as an error.

In ISO C an extern array can be declared without a size, since its
definition elsewhere has one. Under -fbounds-safety that declaration
carries no bounds and thus every access through it traps. The compiler
supports two ways to provide the bound writing the size as extern T a[N],
or annotating the declaration as extern T a[__counted_by(N)]. I used the
size, which is plain ISO C, because GCC and mainline clang ship a
narrower attribute of the same name, for FAMs only, and LinuXKPI enables
it for the imported drivers. An upstreaming effort is underway in LLVM
which should make atleast clang to accept it.  

> I think there needs to be some very serious
> consideration within the project as to whether this is something we
> want before any of it lands,

Looking forward to hearing from the community about this. 

Best,
Abhijeet