e18a0a40b8
Phase 4 batch 1: 9 PPCBUGs in the active-poisoning sub-section. All follow the pattern `!val` on u64, which unconditionally flips the upper 32 bits and poisons the GPR even with clean inputs — every execution corrupts the high 32 bits regardless of upstream state. Sub/neg family: - PPCBUG-006 negx: `(!ra).wrapping_add(1)` on u64 + neg_ov_64 checks 64-bit INT_MIN. Fix: do arithmetic in u32, OE checks PPC[ra32==0x80000000]. - PPCBUG-008 subfex: same shape as above plus 64-bit unsigned CA compare. Fix: cast all operands to u32, compute, write `as u64`. - PPCBUG-018 subfzex: `!ra` on u64. Fix: u32 arithmetic. - PPCBUG-019 subfmex: `!ra` on u64 + always-true CA edge (`!ra != 0` was always true for clean ra<0xFFFFFFFF because high bits of !u64 are non-zero). Fix: u32 arithmetic; CA predicate now correct. Logical NOT family: - PPCBUG-028 orcx: rs | !rb on u64 → high-bit poison. - PPCBUG-029 norx: !(rs|rb) — the `not` simplified mnemonic. Hot path, every `not` corrupted GPR upper 32 bits. - PPCBUG-030 nandx: !(rs&rb). - PPCBUG-031 eqvx: !(rs^rb). The common `eqv rA,rA,rA` set-to-all-ones idiom now produces 0x00000000_FFFFFFFF instead of 0xFFFFFFFF_FFFFFFFF. - PPCBUG-033 andcx: rs & !rb. CR0 update at every Rc=1 path now uses `as u32 as i32 as i64` so a result with bit 31 set gets classified as negative under the 32-bit ABI (was positive before because upper bits were ones; will be positive in new truncated form unless we cast through i32). This pre-emptively addresses PPCBUG-020 for these specific opcodes; the catch-all sweep in batch 6 covers the remaining sites. Tests: - nego_sets_ov_only_on_int_min: updated from i64::MIN → 0x80000000 (32-bit). - test_subfze_carry_only_when_ra_zero_and_ca_one: result expectations updated from u64::MAX → 0xFFFFFFFF (low 32 bits, upper 32 zero). - New: neg_clean_input_no_upper_bits (PPCBUG-006 regression). - New: norx_not_simplified_keeps_upper_bits_clean (PPCBUG-029 regression). - New: eqvx_self_self_self_sets_low32_to_all_ones (PPCBUG-031 regression). - New: andcx_bit_clear_keeps_upper_clean (PPCBUG-033 regression). - New: subfex_clean_inputs_no_upper_bits (PPCBUG-008 regression). - New: subfmex_ra_max_ca_zero_clears_ca (PPCBUG-019 always-true CA fix). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>