InSPECtor Finds 38,920 Discrepancies and 125 Unique Bugs in the SLEIGH Specs Behind Ghidra

arXiv 2608.13042·medium signalXBlueskyLinkedInCopy link

Processor specifications underpin disassemblers, decompilers and emulators, yet are rarely validated. InSPECtor uses the structure encoded in a specification itself to enumerate decodable instruction forms and generate targeted initial states, then differentially tests emulators driven by the spec against hardware references. Across x86-64, AArch64, ARM/Thumb, RISC-V and MSP430, it surfaced over 38,920 discrepancies leading to 125 unique bugs with proposed fixes, spanning decoding defects, semantic defects and cross-vendor inconsistencies — errors that in practice distort program behaviour, hide vulnerabilities and enable analysis evasion. The authors distil 8 concrete recommendations for spec authors.