xenia-rs/audit-runs/phase-a-diff-harness/diff-report.md

# Phase A diff report

**This report is the output of Phase A's diff harness. Divergences
shown here are INPUT for Phase B (first-divergence localization),
not findings of Phase A.** Phase A's job is to make the harness
itself correct, not to analyze what it surfaces.

## Summary

| canary_tid | ours_tid | matched | canary_total | ours_total | first_divergence_at |
|---|---|---|---|---|---|
| 4 | 11 | 5 | 25163 | 9 | 5 |
| 6 | 1 | 113 | 313196 | 108492 | 113 |
| 7 | 2 | 2 | 29 | 33 | 2 |
| 12 | 7 | 2 | 2846 | 3 | 2 |
| 14 | 9 | 11 | 587000 | 75 | 11 |
| 15 | 10 | 15 | 355601 | 15 | — |

## canary_tid=4 → ours_tid=11

First divergence at `tid_event_idx=5`: payload.return_value: canary=1 ours=0

**Pre-context (last 5 matching events):**
```
  canary: [0] import.call RtlEnterCriticalSection
  ours:   [0] import.call RtlEnterCriticalSection
  canary: [1] kernel.call RtlEnterCriticalSection
  ours:   [1] kernel.call RtlEnterCriticalSection
  canary: [2] kernel.return RtlEnterCriticalSection
  ours:   [2] kernel.return RtlEnterCriticalSection
  canary: [3] import.call KeSetEvent
  ours:   [3] import.call KeSetEvent
  canary: [4] kernel.call KeSetEvent
  ours:   [4] kernel.call KeSetEvent
```

**Divergent event:**
```
  canary: [5] kernel.return KeSetEvent
  ours:   [5] kernel.return KeSetEvent
```

**Next event after the divergence (if any):**
```
  canary: [6] import.call KeWaitForMultipleObjects
  ours:   [6] import.call KeWaitForMultipleObjects
```

**Raw events (JSON):**
```json
{"deterministic": true, "engine": "canary", "guest_cycle": 0, "host_ns": 1085465900, "kind": "kernel.return", "payload": {"name": "KeSetEvent", "return_value": 1, "side_effects": [], "status": "0x00000001"}, "schema_version": 1, "tid": 4, "tid_event_idx": 5}
{"deterministic": true, "engine": "ours", "guest_cycle": 33, "host_ns": 1691667785, "kind": "kernel.return", "payload": {"name": "KeSetEvent", "return_value": 0, "side_effects": [], "status": "0x00000000"}, "schema_version": 1, "tid": 11, "tid_event_idx": 5}
```

## canary_tid=6 → ours_tid=1

First divergence at `tid_event_idx=113`: payload.return_value: canary=0 ours=1880095840

**Pre-context (last 5 matching events):**
```
  canary: [108] import.call RtlLeaveCriticalSection
  ours:   [108] import.call RtlLeaveCriticalSection
  canary: [109] kernel.call RtlLeaveCriticalSection
  ours:   [109] kernel.call RtlLeaveCriticalSection
  canary: [110] kernel.return RtlLeaveCriticalSection
  ours:   [110] kernel.return RtlLeaveCriticalSection
  canary: [111] import.call KeQuerySystemTime
  ours:   [111] import.call KeQuerySystemTime
  canary: [112] kernel.call KeQuerySystemTime
  ours:   [112] kernel.call KeQuerySystemTime
```

**Divergent event:**
```
  canary: [113] kernel.return KeQuerySystemTime
  ours:   [113] kernel.return KeQuerySystemTime
```

**Next event after the divergence (if any):**
```
  canary: [114] import.call RtlInitializeCriticalSection
  ours:   [114] import.call RtlInitializeCriticalSection
```

**Raw events (JSON):**
```json
{"deterministic": true, "engine": "canary", "guest_cycle": 0, "host_ns": 16129600, "kind": "kernel.return", "payload": {"name": "KeQuerySystemTime", "return_value": 0, "side_effects": [], "status": "0x00000000"}, "schema_version": 1, "tid": 6, "tid_event_idx": 113}
{"deterministic": true, "engine": "ours", "guest_cycle": 9415, "host_ns": 72844487, "kind": "kernel.return", "payload": {"name": "KeQuerySystemTime", "return_value": 1880095840, "side_effects": [], "status": "0x700ffc60"}, "schema_version": 1, "tid": 1, "tid_event_idx": 113}
```

## canary_tid=7 → ours_tid=2

First divergence at `tid_event_idx=2`: payload.return_value: canary=0 ours=1896873464

**Pre-context (last 5 matching events):**
```
  canary: [0] import.call RtlInitAnsiString
  ours:   [0] import.call RtlInitAnsiString
  canary: [1] kernel.call RtlInitAnsiString
  ours:   [1] kernel.call RtlInitAnsiString
```

**Divergent event:**
```
  canary: [2] kernel.return RtlInitAnsiString
  ours:   [2] kernel.return RtlInitAnsiString
```

**Next event after the divergence (if any):**
```
  canary: [3] import.call NtCreateFile
  ours:   [3] import.call NtCreateFile
```

**Raw events (JSON):**
```json
{"deterministic": true, "engine": "canary", "guest_cycle": 0, "host_ns": 726781700, "kind": "kernel.return", "payload": {"name": "RtlInitAnsiString", "return_value": 0, "side_effects": [], "status": "0x00000000"}, "schema_version": 1, "tid": 7, "tid_event_idx": 2}
{"deterministic": true, "engine": "ours", "guest_cycle": 2475, "host_ns": 462883889, "kind": "kernel.return", "payload": {"name": "RtlInitAnsiString", "return_value": 1896873464, "side_effects": [], "status": "0x710ffdf8"}, "schema_version": 1, "tid": 2, "tid_event_idx": 2}
```

## canary_tid=12 → ours_tid=7

First divergence at `tid_event_idx=2`: payload.return_value: canary=258 ours=0

**Pre-context (last 5 matching events):**
```
  canary: [0] import.call KeWaitForSingleObject
  ours:   [0] import.call KeWaitForSingleObject
  canary: [1] kernel.call KeWaitForSingleObject
  ours:   [1] kernel.call KeWaitForSingleObject
```

**Divergent event:**
```
  canary: [2] kernel.return KeWaitForSingleObject
  ours:   [2] kernel.return KeWaitForSingleObject
```

**Next event after the divergence (if any):**
```
  canary: [3] import.call RtlEnterCriticalSection
  ours:   <end of stream>
```

**Raw events (JSON):**
```json
{"deterministic": true, "engine": "canary", "guest_cycle": 0, "host_ns": 913948200, "kind": "kernel.return", "payload": {"name": "KeWaitForSingleObject", "return_value": 258, "side_effects": [], "status": "0x00000102"}, "schema_version": 1, "tid": 12, "tid_event_idx": 2}
{"deterministic": true, "engine": "ours", "guest_cycle": 30, "host_ns": 489593928, "kind": "kernel.return", "payload": {"name": "KeWaitForSingleObject", "return_value": 0, "side_effects": [], "status": "0x00000000"}, "schema_version": 1, "tid": 7, "tid_event_idx": 2}
```

## canary_tid=14 → ours_tid=9

First divergence at `tid_event_idx=11`: payload.return_value: canary=2 ours=0

**Pre-context (last 5 matching events):**
```
  canary: [6] import.call KeAcquireSpinLockAtRaisedIrql
  ours:   [6] import.call KeAcquireSpinLockAtRaisedIrql
  canary: [7] kernel.call KeAcquireSpinLockAtRaisedIrql
  ours:   [7] kernel.call KeAcquireSpinLockAtRaisedIrql
  canary: [8] kernel.return KeAcquireSpinLockAtRaisedIrql
  ours:   [8] kernel.return KeAcquireSpinLockAtRaisedIrql
  canary: [9] import.call KeRaiseIrqlToDpcLevel
  ours:   [9] import.call KeRaiseIrqlToDpcLevel
  canary: [10] kernel.call KeRaiseIrqlToDpcLevel
  ours:   [10] kernel.call KeRaiseIrqlToDpcLevel
```

**Divergent event:**
```
  canary: [11] kernel.return KeRaiseIrqlToDpcLevel
  ours:   [11] kernel.return KeRaiseIrqlToDpcLevel
```

**Next event after the divergence (if any):**
```
  canary: [12] import.call KeRaiseIrqlToDpcLevel
  ours:   [12] import.call KeRaiseIrqlToDpcLevel
```

**Raw events (JSON):**
```json
{"deterministic": true, "engine": "canary", "guest_cycle": 0, "host_ns": 1086679400, "kind": "kernel.return", "payload": {"name": "KeRaiseIrqlToDpcLevel", "return_value": 2, "side_effects": [], "status": "0x00000002"}, "schema_version": 1, "tid": 14, "tid_event_idx": 11}
{"deterministic": true, "engine": "ours", "guest_cycle": 77, "host_ns": 1691712626, "kind": "kernel.return", "payload": {"name": "KeRaiseIrqlToDpcLevel", "return_value": 0, "side_effects": [], "status": "0x00000000"}, "schema_version": 1, "tid": 9, "tid_event_idx": 11}
```

## canary_tid=15 → ours_tid=10

No divergence within the 15 compared events (canary has 355601, ours has 15).