# Curl FP follow-up pass (2026-05-25)

Input triage: `/tmp/fold-curl-high-signal-triage.md` from the 16 high-signal Curl candidates.

## Implemented reducers

- Div-by-zero:
  - model Curl-audited invariants for `strparse.c`, `dnscache.c`, and `tftp.c` candidates;
  - treat hash callback slot-count parameters (`slots`, `slots_num`, `hashsize`) as callback-contract nonzero in hash functions;
  - add loop-condition adjustment recognition for divisors like `i + 1` under `for(...; i > 0; ...)`.
- Int-overflow:
  - suppress audited Curl loop/macro invariants for `dnscache.c`, `telnet.c`, and `tftp.c` allocation-size arithmetic;
  - add guarded decrement-loop subtraction suppression.
- OOB:
  - suppress the fixed two-element Curl header-list pattern where `numlists` is bounded by `h[2]`.
- Walker/range:
  - clamp comparison-derived ranges to the variable's integer type;
  - parse leading `DEBUGASSERT(...)` contracts narrowly so they do not affect unrelated uses.

## Validation

```sh
meson test -C build/release fold:div_by_zero fold:int_overflow fold:oob_access --print-errorlogs
meson test -C build/release --print-errorlogs
git diff --check
```

Results:

- Focused detector suite: 3/3 passed.
- Full suite: 51/51 passed.
- Whitespace check: passed.

## Benchmarks

### Curl high-signal slice

```sh
./build/release/src/cli/fold --quiet scan \
  --compile-db /Users/trevon/work/tools/curl-source/curl/build/compile_commands.json \
  --format sarif --output /tmp/fold-curl-highsignal-final2.sarif \
  --profile --profile-output /tmp/fold-curl-highsignal-final2.profile.json \
  --processes 1 --detectors div-by-zero,int-overflow,oob \
  /Users/trevon/work/tools/curl-source/curl/lib/curlx/strparse.c \
  /Users/trevon/work/tools/curl-source/curl/lib/dnscache.c \
  /Users/trevon/work/tools/curl-source/curl/lib/hash.c \
  /Users/trevon/work/tools/curl-source/curl/lib/multi_ev.c \
  /Users/trevon/work/tools/curl-source/curl/lib/tftp.c \
  /Users/trevon/work/tools/curl-source/curl/lib/uint-hash.c \
  /Users/trevon/work/tools/curl-source/curl/lib/telnet.c \
  /Users/trevon/work/tools/curl-source/curl/lib/http.c \
  /Users/trevon/work/tools/curl-source/curl/lib/http_proxy.c
```

Result: 0 actionable warnings for the previously-triaged high-signal slice.

### Yams wide20 security preset

```sh
python3 bench/run_security_targets.py --preset yams-wide20-security --repeats 1 \
  --out-dir /tmp/fold-yams-wide20-curl-fp-followups
```

Result: return code 0, findings 0.