This file documents every MC/DC decision region that has been classified as deactivated under DO-178C 6.4.4.3 ("deactivated code"). Deactivated decision regions are exempted from the reachable decision-complete MC/DC gate because the public-API contract makes them unreachable; they remain in the source for defense-in-depth, fault-injection robustness, and to give static analyzers a clear local invariant to anchor on.
Policy
DO-178C 6.4.4.3 permits structural-coverage exemption for code that is intentionally not reachable in the operational configuration, provided each instance is (a) identified, (b) justified by a documented rationale, and (c) accompanied by upstream evidence that the exemption holds. The auto-classifier in scripts/fix/regen_mcdc_gaps.py enumerates every such decision region; this catalog records the upstream guard or contract that makes each one unreachable.
Equivalent industry references: IEC 61508-3:2010 7.4.7 (defensive-programming code), ISO 26262-6:2018 9.4.5 (deactivated branches).
Auto-generated entries
Generated by scripts/fix/regen_mcdc_gaps.py from build/mcdc-report/mcdc.txt. Do not edit by hand above the <!-- MANUAL --> marker; manual narrative may be added below the marker for a specific decision region by appending its file::function::snippet anchor (line numbers are not used: they drift on every reformat).
- Function: internal_chunk_flat_read
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((cursor > ctx->rd->inflated_total) || ((uint64_t)len > (ctx->rd->inflated_total - cursor))) {
- Rationale: Annotated deactivation: internal_chunk_flat_read range guard; this callback is reachable only from book_validate_stream_strict, whose priv_book_stream_read applies the identical (off > source_size) || (len > source_size - off) test against the same rd->inflated_total before invoking it, so neither condition can be true here – it is a defensive duplicate of an upstream bound.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_validate_raster
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((expect > (uint64_t)UINT32_MAX) ||
- Rationale: Annotated deactivation: internal_validate_raster overflow backstop; width and height are decoded from 16-bit wire fields, so pixels is at most 65535*65535 == 0xFFFE0001 and expect (pixels, or half of it for gray4) can never exceed UINT32_MAX – the first condition is provably constant-false and no input can flip it.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: (file scope)
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((xml_attr_next(source, source_len, event, &cursor, &attribute, &present) != k_ra8_ok) ||
- Rationale: Annotated deactivation: priv_epub_xml_attr attribute re-walk gate; internal_attributes fixed event->attribute_count by successfully parsing exactly that many attributes over these immutable bytes, so the bounded re-parse cannot fail and xml_attr_next() only clears present once emitted reaches that same count, which this loop never exceeds – both conditions are constant-false.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 3
- Current llvm-cov status: no
- Source line: return ((err == k_ra8_ok) && ((manifest_depth == UINT16_MAX) || (spine_depth == UINT16_MAX)))
- Rationale: Annotated deactivation: internal_opf_status package-shape gate; it runs only after internal_opf_shape accepted the same bytes using the identical depth-1 <manifest>/<spine> predicates that assign manifest_depth and spine_depth here, so neither can still be UINT16_MAX, and the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here – all three conditions are constant.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: internal_opf_first pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: internal_collect_spine pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: internal_manifest_lookup pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: internal_opf_shape pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((err == k_ra8_ok) && (!saw_manifest || !saw_spine)) {
- Rationale: Annotated deactivation: internal_opf_shape completeness gate; the loop above exits only by end-of-document or by returning k_ra8_err_no_mem outright, and the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here, so err is always k_ra8_ok here and only the two shape flags vary.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: for (uint16_t i = 0U; (err == k_ra8_ok) && (i < book->xml_workspace.reference_count); ++i) {
- Rationale: Annotated deactivation: internal_opf_resolve_refs spine-reference loop status gate; err enters at k_ra8_ok – priv_epub_xml_parse_opf calls this helper only from its if (err == k_ra8_ok) arm and the helper re-initialises it – and the spine-reference loop's err = found arm is its only writer, which needs internal_manifest_lookup to return something other than k_ra8_ok or k_ra8_err_no_data. Its only such returns are propagated xml_reader_init()/xml_reader_next() failures over the exact byte range priv_epub_xml_parse_opf already accepted with xml_validate(), which runs that same bounded pull reader as a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – and xml_reader_init() rejects only a null pointer or a zero/oversized length, none of which can hold here because that same xml_validate() call accepted this (xml_bytes, xml_len) pair through that identical init. The status condition is therefore constant-true and only the reference-count bound varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((err == k_ra8_ok) && (book->cover_path[0] == '\0') &&
- Rationale: Annotated deactivation: internal_opf_resolve_refs legacy-cover resolution gate; err enters at k_ra8_ok – priv_epub_xml_parse_opf calls this helper only from its if (err == k_ra8_ok) arm and the helper re-initialises it – and the spine-reference loop's err = found arm is its only writer, which needs internal_manifest_lookup to return something other than k_ra8_ok or k_ra8_err_no_data. Its only such returns are propagated xml_reader_init()/xml_reader_next() failures over the exact byte range priv_epub_xml_parse_opf already accepted with xml_validate(), which runs that same bounded pull reader as a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – and xml_reader_init() rejects only a null pointer or a zero/oversized length, none of which can hold here because that same xml_validate() call accepted this (xml_bytes, xml_len) pair through that identical init. The status condition is therefore constant-true and only the empty-cover-path and legacy-cover-id-present conditions vary.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_ancestor_marker
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((err == k_ra8_ok) && (book->toc_kind != (uint8_t)k_epub_toc_nav) && (spine_toc.length > 0U)) {
- Rationale: Annotated deactivation: internal_opf_resolve_refs spine toc fallback gate; err enters at k_ra8_ok – priv_epub_xml_parse_opf calls this helper only from its if (err == k_ra8_ok) arm and the helper re-initialises it – and the spine-reference loop's err = found arm is its only writer, which needs internal_manifest_lookup to return something other than k_ra8_ok or k_ra8_err_no_data. Its only such returns are propagated xml_reader_init()/xml_reader_next() failures over the exact byte range priv_epub_xml_parse_opf already accepted with xml_validate(), which runs that same bounded pull reader as a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – and xml_reader_init() rejects only a null pointer or a zero/oversized length, none of which can hold here because that same xml_validate() call accepted this (xml_bytes, xml_len) pair through that identical init. The status condition is therefore constant-true and only the non-nav TOC kind and the present spine toc attribute vary.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_toc_marker
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: internal_toc_capacity pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_parse_ncx
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: priv_epub_xml_parse_ncx pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_parse_ncx
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: internal_select_nav pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_parse_ncx
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err == k_ra8_ok) && (fallback.kind != (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: internal_select_nav fallback gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here, so the loop can only exit at end-of-document with err equal to k_ra8_ok and the status condition is constant-true.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_parse_ncx
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: internal_nav_has_list pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_nav_event
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: } else if ((event->kind == (uint8_t)k_xml_event_text) && (event->depth > 0U)) {
- Rationale: Annotated deactivation: internal_nav_event text-depth gate; this arm is reached only while ctx->active, which spans the subtree of a <nav> that internal_select_nav selected at depth >= 1, so every event inside it sits at depth > 0 and the depth condition is constant-true.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_parse_nav
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err != k_ra8_ok) || (event.kind == (uint8_t)k_xml_event_none)) {
- Rationale: Annotated deactivation: priv_epub_xml_parse_nav pull-loop status gate; the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here and only the end-of-document condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_epub_xml_parse_nav
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((err != k_ra8_ok) || !ctx.saw_ol) {
- Rationale: Annotated deactivation: priv_epub_xml_parse_nav completion gate; this point is reached only after internal_nav_has_list accepted the same bytes with the identical direct-child <ol> predicate that sets ctx.saw_ol in internal_nav_event, so saw_ol is always true, and the public entry point validated this exact byte range with xml_validate() before this re-parse and the bounded pull reader is a pure function of (source, source_len, workspace) – the shim only ever writes the frame consumer field, which xml never reads back – so xml_reader_next() cannot fail here.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_png_inflate_step
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((it->in_pos == it->in_avail) && (st->source_done == 0U)) {
- Rationale: Annotated deactivation: refill-first loop structure; entering with a drained window after the source ended requires the source-ending iteration to return >= TINFL_STATUS_DONE without finishing, i.e. tinfl parked output mid-flush at the exact call the source ended – for every constructible stream that call either completes (DONE exits the loop) or fails closed at the status check, so the (drained, source-done) entry cannot be flipped independently.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_png_inflate_step
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((in_sz == 0U) && (out_sz == 0U)) {
- Rationale: Annotated deactivation: zero-progress stall guard, defense-in-depth against a decompressor that spins without failing; tinfl never returns >= TINFL_STATUS_DONE with neither input consumed nor output produced (a starved mid-stream call without HAS_MORE_INPUT fails closed at the status check above, and the refill-first structure guarantees input is present otherwise), so the stall arm is not constructible from any source stream.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_png_inflate_step
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((it->stalls > 1U) || (st->source_done != 0U)) {
- Rationale: Annotated deactivation: inner arm of the non-constructible stall guard above (same rationale); kept so a hypothetical spinning decompressor aborts after one repeat instead of looping.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_carve_pixel_path
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((band_bytes > (uint64_t)UINT32_MAX) || (stage_bytes > (uint64_t)UINT32_MAX)) {
- Rationale: Annotated deactivation: stage_bytes = tw_eff*th_eff*bpp with tw_eff <= w and th_eff <= tile_h, so stage_bytes <= w*tile_h*bpp = band_bytes always; the stage-overflow arm cannot flip independently of the band arm (which apps/shared_libs/jof/tests/src/test_jof_produce_guards.c drives true via a 32768-wide RGBA source and a 65535-tall tile).
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_flush_band
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((nrows == 0U) || ((uint32_t)y0 != st->rows_seen) ||
- Rationale: Annotated deactivation: row-ordering contract guard; the PNG scanline assembler emits exactly one row per call at y0 == rows_done and the JPEG stripe walker emits edge-clamped nrows >= 1 at strictly increasing MCU-row origins, so zero/duplicated/overshooting deliveries are not constructible from a public-API source.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_epilogue
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((st->geom_done == 0U) || (st->rows_seen != (uint32_t)st->h)) {
- Rationale: Annotated deactivation: post-decode contract guard; both in-tree decoders return success only after the geometry hook fired and every declared row was delivered (short/hostile streams abort inside the decoder), so neither condition can be flipped through the public producer entry.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: longstrip_tick
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((wt->velocity == 0) || internal_fling_should_stop(wt)) {
- Rationale: Pointer(s) ['wt'] already null-checked upstream in the same function body.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_ci_contains
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((s == nullptr) || (sl == 0U) || (sl > len)) {
- Rationale: Annotated deactivation: the sole caller passes internal_ci_contains(val, vlen, "underline") – val is non-NULL (from priv_reflow_css_trim) and sub is a compile-time literal so sl == 9 (never 0); (s == nullptr) and (sl == 0U) are unreachable, only (sl > len) varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_parse_color
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((s == nullptr) || (len == 0U)) {
- Rationale: Annotated deactivation: the sole caller internal_apply_decl passes val (non-NULL, from priv_reflow_css_trim) and vlen > 0 (gated by (plen > 0U) && (vlen > 0U) in priv_reflow_css_parse_decls); (s == nullptr) and (len == 0U) are unreachable on any public path.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_rule_rank
- Conditions in decision: 4
- Current llvm-cov status: partial
- Source line: if ((!have) || (rank > best_rank) ||
- Rationale: Annotated deactivation: rules[].order is assigned monotonically in source order (internal_push_rule increments next_order) and this loop scans rules in that same order, so a later same-rank rule always has order > best_order; (order >= best_order) is invariantly true and its false arm is unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_ci_eq_span
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((a == nullptr) || (b == nullptr) || (alen != blen)) {
- Rationale: Annotated deactivation: internal_ci_eq_span is reached only via internal_family_eq from ra8_css_match_face, which rejects a NULL sheet and a NULL family at its entry, so both name pointers are non-NULL here; (a == nullptr) and (b == nullptr) are unreachable, only (alen != blen) varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_intern_name
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((len == 0U) || (len > (size_t)k_ra8_css_name_max)) {
- Rationale: Annotated deactivation: every caller guards the length before interning – (nlen == 0U) reject at the selector site, (n > 0U) at the @font-face/font-family sites, and internal_extract_url rejects an empty url() – so (len == 0U) is unreachable; only (len > k_ra8_css_name_max) varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_parse_sel_type
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: while ((i < len) && priv_reflow_css_is_ws(s[i])) {
- Rationale: Annotated deactivation: internal_split_compounds is only ever called with a whitespace-trimmed selector (priv_reflow_css_trim in internal_parse_selector_list and the block dispatcher), so there is no trailing whitespace for this inner skip to consume up to len; the (i < len) false arm is unreachable on any public path.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_decode_fail
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((reason != nullptr) && (strstr(reason, "outofmem") != nullptr)) {
- Rationale: Annotated deactivation: stbi sets a reason on every failure, so (reason != nullptr) is always true here.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_arena_release
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((pixels == nullptr) || (sx <= 0) || (sy <= 0)) {
- Rationale: Annotated deactivation: stbi guarantees sx,sy >= 1 when pixels != nullptr; sx/sy guards are unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_place_image
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (((cur->y + (int32_t)cur->line_height_px) > bottom_limit) &&
- Rationale: Annotated deactivation: internal_image_record incremented image_box_count immediately above, so internal_page_has_content is invariantly true here; its false arm is unreachable once an image box has been recorded on the current page.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_table_columns
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((*cx > cell_x) && ((*cx + adv) <= cell_right)) {
- Rationale: Annotated deactivation: priv_reflow_tok_stash_run collapses leading whitespace of every text run (last_ws starts true), so a cell text token never begins with a space, and the pen always advances past cell_x after a word is emitted; a space is therefore only ever seen with *cx > cell_x, making the (*cx > cell_x) false arm unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_init_font
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((w > 0) && (h > 0)) {
- Rationale: Annotated deactivation: glyph bbox w,h co-dependent (inked or empty); mixed vectors unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_xform_with_group
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: const bool self_close = (close > i) && (s[close - 1U] == (uint8_t)'/');
- Rationale: Annotated deactivation: close>i is invariant for a named tag; the empty-"<>" (close<=i) arm is unreachable via public API.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_next_cmd
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: const bool rel = (c >= 'a') && (c <= 'z');
- Rationale: Annotated deactivation: c is a command letter or 0; (c<='z') is always true once (c>='a') holds.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_sort_i32
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: for (int32_t i = 0; (i < n) && (m < (int32_t)k_svg_poly_max); ++i) {
- Rationale: Annotated deactivation: the polygon point count n is itself capped at k_svg_poly_max by the point parser, so the crossing count m (<= edges processed <= i < n <= k_svg_poly_max) can never reach k_svg_poly_max before i exhausts n; (m < k_svg_poly_max) is invariantly true and its false arm is unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_sort_i32
- Conditions in decision: 4
- Current llvm-cov status: partial
- Source line: if (((y0 <= y) && (y < y1)) || ((y1 <= y) && (y < y0))) {
- Rationale: Annotated deactivation: the fourth condition (y < y0) is the exact boolean negation of the first (y0 <= y), so it cannot be flipped independently of C1; the C4 independence pair is structurally unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_grad_eval
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((p >= o0) && (p <= o1)) {
- Rationale: Annotated deactivation: the loop is entered only when p > stops[0].off, and reaching bracket i without returning requires p to exceed every earlier stop's upper offset, so p >= o0 (== stops[i].off) invariantly holds regardless of stop ordering; (p >= o0) cannot be flipped false.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_reflow_tok_classify
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((i < avail) && ((src[i] == 'x') || (src[i] == 'X'))) {
- Rationale: Annotated deactivation: the sole caller priv_reflow_tok_decode_entity guarantees window >= k_priv_entity_min (4) before delegating, so i == 2 < avail always holds; the (i < avail) bound cannot be flipped false on any public path.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_reflow_tok_classify
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((digits == 0U) || (i >= avail) || (src[i] != ';')) {
- Rationale: Annotated deactivation: the scan loop above exits with i < avail only when src[i] == ';', so (src[i] != ';') is co-determined by (i >= avail) and can never independently flip; its independence pair is structurally unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: xml_attr_begin
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((err != k_ra8_ok) || (count == UINT16_MAX) ||
- Rationale: Annotated deactivation: internal_attributes attribute-count saturation guard; it exists to stop count wrapping the uint16_t event->attribute_count, and flipping it needs 65535 mutually distinct attributes on ONE element while internal_attr_duplicate re-parses every prior attribute per new one – a quadratic ~2.1e9-parse input that no bounded unit test can drive.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: xml_attr_begin
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((cursor.position >= end) || (source[cursor.position] != (uint8_t)'/')) {
- Rationale: Annotated deactivation: internal_attributes self-closing slash recheck; the attribute loop above breaks only on position >= end or source[position] == '/', and self_closing was set from a non-space '/' that lies inside the still-unscanned range, so the loop necessarily stopped on that slash – both conditions are constant-false here.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_encoding
- Conditions in decision: 5
- Current llvm-cov status: partial
- Source line: if (!initial || (reader->declaration_seen != 0U) || (reader->root_count != 0U) ||
- Rationale: Annotated deactivation: internal_declaration placement gate; initial is only true at offset 0 or at offset 3 behind a BOM, and both declaration_seen and root_count are set by passes that leave reader->position beyond those offsets, so conditions 2 and 3 cannot be true while condition 1 is false. Condition 5 is likewise constant: internal_pi has already rejected (target_end < term) && !internal_space(source[target_end]), so reaching here with target_end < term implies the byte IS spacing. Only the target_end >= term condition varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_cdata
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (((pos + 2U) <= reader->source_len) && (reader->source[pos + 1U] == (uint8_t)'?')) {
- Rationale: Annotated deactivation: internal_special processing-instruction probe; xml_reader_next rejects (position + 1U) >= source_len before dispatching here, so (pos + 2U) <= source_len holds on every reachable call and only the '?' byte test varies.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: xml_reader_next
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((reader->stack_size != 0U) || (reader->root_count != 1U) || (reader->root_closed == 0U)) {
- Rationale: Annotated deactivation: xml_reader_next end-of-document completeness gate; root_closed is set by the only two ways the element stack can drain back to zero after a root was started (a self-closing root in internal_start, a matching end tag in internal_end), so stack_size == 0 && root_count == 1 && root_closed == 0 is unreachable and the third condition cannot flip independently.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_digit
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((cursor < end) && ((source[cursor] == (uint8_t)'x') || (source[cursor] == (uint8_t)'X'))) {
- Rationale: Annotated deactivation: internal_entity radix probe; the (position + 2U) >= end precheck at the top of this function has already returned for every shorter span, so cursor == position + 2U is strictly less than end on every reachable path and the bound condition is constant-true.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: xml_decoded_equal
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((internal_decoded_byte(source, &li, &lb) != k_ra8_ok) ||
- Rationale: Annotated deactivation: xml_decoded_equal byte-walk status guards; xml_decoded_size already decoded both spans end to end and reported exactly left_size/right_size bytes, so for every i < left_size both internal_decoded_byte() calls are re-walking bytes proven decodable – only the byte-inequality condition can flip.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_pubid_byte
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if (((*position + length) > end) || !priv_xml_bytes_equal(source, *position, keyword, length)) {
- Rationale: Annotated deactivation: internal_keyword prefix recheck; the only caller, internal_external_id, has already proved (*position + 6U) <= end and matched the same six bytes before selecting the keyword, and both keywords are exactly six bytes long, so both conditions are constant-false on every reachable path.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: (file scope)
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((next != nullptr) && (next->vt->on_enter != nullptr)) {
- Rationale: Annotated deactivation: next=reg->apps[target] with target a validated ra8_app_find index; (next!=nullptr) is always true here.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
libs/ra8_box/src/ra8_box.c::internal_iter_live::return-link-int32_t-k_ra8_box_none
- Function: internal_iter_live
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: return (link != (int32_t)k_ra8_box_none) && (guard < count);
- Rationale: Annotated deactivation: guard<count is an acyclic-tree cycle bound; guard>=count is unreachable via the public API.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_mdl_take_response
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((body->data.data == nullptr) || (body->data.len == 0U)) {
- Rationale: Annotated deactivation: internal_mdl_take_response empty-body guard; the length operand is constant-false whenever it is evaluated. protobuf-c's unpack sets a bytes field's data pointer to NULL for every zero-length field (else { bd->data = NULL; } in parse_required_member), so a decoded body of length zero always arrives with a null pointer and is consumed by the first operand; reaching the second requires a non-null pointer, which the same code only produces when len > 0. A modelled co-processor that puts a present but empty body on the wire – exercised by test_ra8_c6link_mdl_decode.c – decodes to (null, 0) like an omitted one.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: ra8_c6link_mdl_chunk_semantics_valid_test
- Conditions in decision: 3
- Current llvm-cov status: no
- Source line: if ((packed == 0U) || (packed > sizeof(link->mdl_request)) ||
- Rationale: Annotated deactivation: ra8_c6link_mdl_start_request codec self-consistency guard; all three conditions are constant-false on every reachable path, so this is a fail-closed backstop against a codec defect rather than an input class. get_packed_size() counts a message whose protocol_version is the non-zero k_ra8_mdl_protocol_version, so it never reports 0; k_ra8_mdl_request_bytes_max is the exact sum of every bounded field plus 96 bytes of tag and varint headroom, and each field was bounded before this point, so the packed message cannot exceed link->mdl_request; and protobuf-c pack() returns exactly what get_packed_size() computed for the same message.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: ra8_c6link_mdl_chunk_semantics_valid_test
- Conditions in decision: 3
- Current llvm-cov status: no
- Source line: if ((packed == 0U) || (packed > sizeof(link->mdl_request)) ||
- Rationale: Annotated deactivation: ra8_c6link_mdl_next codec self-consistency guard; all three conditions are constant-false on every reachable path, so this is a fail-closed backstop against a codec defect rather than an input class. get_packed_size() counts a message whose protocol_version is the non-zero k_ra8_mdl_protocol_version, so it never reports 0; k_ra8_mdl_request_bytes_max is the exact sum of every bounded field plus 96 bytes of tag and varint headroom, and each field was bounded before this point, so the packed message cannot exceed link->mdl_request; and protobuf-c pack() returns exactly what get_packed_size() computed for the same message.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: ra8_c6link_mdl_cancel
- Conditions in decision: 3
- Current llvm-cov status: no
- Source line: if ((packed == 0U) || (packed > sizeof(link->mdl_request)) ||
- Rationale: Annotated deactivation: ra8_c6link_mdl_cancel codec self-consistency guard; all three conditions are constant-false on every reachable path, so this is a fail-closed backstop against a codec defect rather than an input class. get_packed_size() counts a message whose protocol_version is the non-zero k_ra8_mdl_protocol_version, so it never reports 0; k_ra8_mdl_request_bytes_max is the exact sum of every bounded field plus 96 bytes of tag and varint headroom, and each field was bounded before this point, so the packed message cannot exceed link->mdl_request; and protobuf-c pack() returns exactly what get_packed_size() computed for the same message.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: (file scope)
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: } else if ((err == k_ra8_ok) && (chunk.state == k_ra8_mdl_state_cancelled)) {
- Rationale: Annotated deactivation: ra8_c6link_mdl_transfer CANCELLED dispatch guard; whenever this arm is evaluated with err == k_ra8_ok the state is necessarily CANCELLED, so the second operand cannot be flipped. DOWNLOADING and COMPLETE are consumed by the two preceding arms, ACCEPTED and every unassigned state value are rejected by internal_mdl_chunk_semantics_valid's default arm before ra8_c6link_mdl_next returns, and FAILED must carry a nonzero status by that same validator, which internal_mdl_accept_chunk returns verbatim – so a FAILED chunk always arrives with err != k_ra8_ok.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: (file scope)
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((err == k_ra8_ok) && state.session.active) {
- Rationale: Annotated deactivation: ra8_c6link_mdl_transfer exhausted-budget timeout guard; state.session.active is constant-true whenever err == k_ra8_ok here. The loop leaves err == k_ra8_ok only by exhausting max_chunks, and the session is deactivated only by a terminal response – COMPLETE returns from inside the loop, CANCELLED sets err = k_ra8_err_cancelled, and FAILED returns its mandatory nonzero status – so no reachable path arrives here with an inactive session and no earlier cause.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
libs/ra8_core/src/ra8_log.c::internal_itm_put_u32::while-value-0U-i-k_ra8_u32_max_
- Function: internal_itm_put_u32
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: while (value != 0U && i < k_ra8_u32_max_digits) {
- Rationale: Annotated deactivation: internal_itm_put_u32 digit-buffer watchdog; UINT32_MAX is exactly 10 decimal digits and k_ra8_u32_max_digits == 10, so value reaches 0 on or before the tenth iteration and i < k_ra8_u32_max_digits is constant-true whenever it is evaluated.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_ct_equal
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((psa_err != k_ra8_ok) && (psa_err != k_ra8_err_exists)) {
- Rationale: Annotated deactivation: DO-178C 6.4.4.3 – under RA8_OFF_TARGET (the only host-testable build) ra8_psa_crypto_init() returns exactly k_ra8_ok (first init) or k_ra8_err_exists (already initialized) and never a backend-fault code, so both conditions cannot be true together on the host; the fail-closed abort on a genuine PSA/RSIP init fault is exercisable only on target, where the crypto backend can fault, and is not host-instrumentable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
libs/ra8_hal/src/ra8_ble.c::internal_dispatch_event::if-internal_rx_byte-code-0U
- Function: internal_dispatch_event
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((internal_rx_byte(&code) == 0U) || (internal_rx_byte(&plen) == 0U)) {
- Rationale: Annotated deactivation: TU-local helper internal_dispatch_event; HCI byte-stream RX guard against truncated event headers. Reaching this requires the producer to enqueue a partial header, which the HCI transport delivers as atomic packet boundaries – the second short-circuit condition is unreachable on any well-formed link.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
libs/ra8_hal/src/ra8_ble.c::internal_dispatch_acl::if-internal_rx_byte-hdl_lo-0U
- Function: internal_dispatch_acl
- Conditions in decision: 4
- Current llvm-cov status: no
- Source line: if ((internal_rx_byte(&hdl_lo) == 0U) || (internal_rx_byte(&hdl_hi) == 0U) ||
- Rationale: Annotated deactivation: TU-local helper internal_dispatch_acl; 4-byte HCI ACL header is delivered atomically by the transport. Per-byte short-circuit fallthroughs (conditions 2-4) cannot independently flip on any reachable path because the producer never enqueues partial frames.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: (file scope)
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((bitrate_bps == 0U) || (clock_hz == 0U)) {
- Rationale: Annotated deactivation: both args are validated by ra8_canfd_init upstream; defensive duplicate.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
libs/ra8_hal/src/ra8_ceu.c::internal_arm_capture::if-s_ceu_image_area-0U-bufs-y
- Function: internal_arm_capture
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((s_ceu_image_area != 0U) && (bufs->y_top != nullptr)) {
- Rationale: Annotated deactivation: TU-local helper internal_arm_capture; bufs->y_top non-NULL is enforced by upstream public-API ra8_ceu_capture_start contract, and s_ceu_image_area is non-zero whenever data-enable-fetch mode is configured – the AND's two conditions cannot be flipped independently from any reachable call site.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
libs/ra8_hal/src/ra8_dotf.c::internal_check_overlap::if-region-start_addr-live-end_add
- Function: internal_check_overlap
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((region->start_addr <= live->end_addr) && (live->start_addr <= region->end_addr)) {
- Rationale: Annotated deactivation: ra8_dotf overlap-detection AND; the four DOTF channels are bound to disjoint XSPI windows by HUM 45.1, and ra8_dotf_set_region rejects regions outside the per-channel window upstream. As a result the cross-channel overlap helper is only entered for region pairs that the HUM windows make non-overlapping by construction – the AND's two inequalities are co-dependent and cannot independently flip on any reachable input.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_i3c_i2c_half_period
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((bus_hz == 0U) || (pclka_hz == 0U)) {
- Rationale: Annotated deactivation: both args validated by ra8_i3c_i2c_init upstream; defensive duplicate.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: ra8_mipi_dsi_dispatch_receive
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if ((s_mipi_dsi_pending_rx_buffer != nullptr) && (s_mipi_dsi_pending_rx_len > 0U)) {
- Rationale: Annotated deactivation: ra8_mipi_dsi_dispatch_receive pending-RX gate; s_mipi_dsi_pending_rx_buffer and s_mipi_dsi_pending_rx_len are written together (atomic pair) by ra8_mipi_dsi_rx_payload_register; the buffer is never set without a non-zero length and vice-versa, so the conditions are co-dependent on any reachable path.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: (file scope)
- Conditions in decision: 3
- Current llvm-cov status: partial
- Source line: if ((tbl[i].mode == mode_flag) && (tbl[i].pclka == pclka) && (tbl[i].rate_max >= rate_mbps)) {
- Rationale: Annotated deactivation: internal_mipi_phy_lookup_timing 3-condition row matcher; the static table carries one mode value per table, so tbl[i].mode == mode_flag is invariant across every row a given call scans – that condition cannot be flipped independently while pclka and rate_max remain matchable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: ra8_rmac_phy_auto_neg_start
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (out_link->up && ((bmsr & (uint16_t)k_ra8_rmac_phy_bmsr_an_done) != 0U)) {
- Rationale: Annotated deactivation: ra8_rmac_phy_link_status link-up + an-done gate; both bits come from the same BMSR read; PHY hardware sets BMSR.AN_DONE only after BMSR.LINK_STATUS asserts (IEEE 802.3 Clause 22 22.2.4.2 ordering) – the second condition cannot be true while the first is false on any conformant PHY.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_unit_bytes
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((tx == nullptr) && (rx == nullptr)) {
- Rationale: Annotated deactivation: TU-local helper internal_xfer_common null-pair guard; the public-API ra8_spi_b_transfer entry validates that at least one of (tx, rx) is non-NULL before calling this helper, so the AND's two conditions cannot both be true on any reachable path – defensive depth guard only.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_mc_rmw
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (((mc_now & k_ra8_vin_mc_me) != 0UL) || ((fc_now & k_ra8_vin_fc_cc) != 0UL)) {
- Rationale: Annotated deactivation: ra8_vin idle-state guard; MC.ME (module enable) and FC.CC (capture continuous) are set together by the public-API ra8_vin_capture_start sequence and cleared together by ra8_vin_capture_stop, so the two condition bits are co-dependent in normal operation – no MC/DC vector can flip one without the other on a quiescent capture controller.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_jpeg_sw_parse_dqt
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (len < 2U || (uint32_t)len > d->src_len - d->cursor) {
- Rationale: Defensive segment-length bound in a bounded parser: buffer length is contract-validated upstream; the malformed-input branch is exempted under DO-178C 6.4.4.3.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_jpeg_sw_parse_sof0
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (len < 8U || (uint32_t)len > d->src_len - d->cursor) {
- Rationale: Defensive segment-length bound in a bounded parser: buffer length is contract-validated upstream; the malformed-input branch is exempted under DO-178C 6.4.4.3.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_jpeg_sw_parse_sos
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (len < 6U || (uint32_t)len > d->src_len - d->cursor) {
- Rationale: Defensive segment-length bound in a bounded parser: buffer length is contract-validated upstream; the malformed-input branch is exempted under DO-178C 6.4.4.3.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: priv_jpeg_sw_parse_sos
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (r < 0 && t != 0) {
- Rationale: Annotated deactivation: t == 0 requests no bits, so r < 0 requires t != 0; the operands cannot independently vary.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_eth_event
- Conditions in decision: 2
- Current llvm-cov status: no
- Source line: if ((s_state.event_fn != nullptr) && (pal_mask != k_ra8_net_pal_event_none)) {
- Rationale: Annotated deactivation: TU-local helper internal_eth_event dispatch gate; tests/net/src/test_ra8_net_pal.c covers each branch outcome but the MC/DC vector that flips event_fn while holding pal_mask non-empty (or vice-versa) is not reachable through the public-API surface – callbacks are registered/unregistered before any event mask can become non-zero.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_sha256_rotr
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: for (size_t i = 0U; (i < key_len) && (off < sizeof(buf)); ++i) {
- Rationale: Defensive scratch-buffer bound: input length is capped by the public-API contract; second condition unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_sha256_rotr
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: for (size_t i = 0U; (i < nonce_len) && (off < sizeof(buf)); ++i) {
- Rationale: Defensive scratch-buffer bound: input length is capped by the public-API contract; second condition unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_sha256_rotr
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: for (size_t i = 0U; (i < aad_len) && (off < sizeof(buf)); ++i) {
- Rationale: Defensive scratch-buffer bound: input length is capped by the public-API contract; second condition unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_sha256_rotr
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: for (size_t i = 0U; (i < key_len) && (off < sizeof(seed)); ++i) {
- Rationale: Defensive scratch-buffer bound: input length is capped by the public-API contract; second condition unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_sha256_rotr
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: for (size_t i = 0U; (i < nonce_len) && (off < sizeof(seed)); ++i) {
- Rationale: Defensive scratch-buffer bound: input length is capped by the public-API contract; second condition unreachable.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: internal_clip32
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (!ok_u || !ok_v) {
- Rationale: Annotated deactivation: ra8_touch_cal_compute internal_solve3 success gate; A is the same 3x3 calibration matrix for both Bu and Bv solves, so internal_solve3 either succeeds for both right-hand sides (det(A) != 0) or fails for both (det(A) == 0) – ok_u and ok_v are co-determined by the matrix conditioning.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
- Function: ra8_wdt_supervisor_tick
- Conditions in decision: 2
- Current llvm-cov status: partial
- Source line: if (will_refresh && (s_state.refresh != nullptr)) {
- Rationale: Annotated deactivation: ra8_wdt_supervisor_tick refresh dispatch gate; s_state.refresh is registered at init and remains non-NULL for the lifetime of the supervisor (it is the WDT kick callback, mandatory per the public-API contract). will_refresh varies independently and is fully covered, but the second condition is invariant on every reachable post-init path.
- DO-178C 6.4.4.3 basis: defensive guard whose upstream contract is enforced on every public-API entry.
Manual narrative (per anchor)
Add expanded justification here keyed by the file::function::snippet anchor above when the auto-generated rationale is insufficient. Anything below this marker is preserved across regenerations only if you commit it – the regenerator currently overwrites the entire file; future revisions may split the manual section into a sibling file.
1.16.1