kit

read.c (49008B)

---

 /* ELF reader. Parses a 64-bit little-endian ELF object back into a fresh
  * ObjBuilder. ET_REL produces the section/symbol/reloc view; the
  * post-finalize shape is the canonical superset doc/DESIGN.md §5.5
  * promises: read_elf of an emit_elf output produces an ObjBuilder
  * equivalent to the writer's input, modulo (a) section ordering and
  * (b) STT_SECTION symbols synthesized by the writer.
  *
  * ET_EXEC / ET_DYN additionally attach the linked-image view via
  * read_elf_image (program-header segments, .dynamic dependencies,
  * .dynsym dynamic symbols, and allocatable dynamic relocations) — see
  * doc/OBJ.md. Their section tables still parse through the same
  * passes. The standalone read_elf_dso (below) remains the linker's
  * exports-only DSO-input path.
  *
  * Scope: AArch64 little-endian. Other archs / endianness produce a
  * compiler_panic with a diagnostic. */
 
 #include <string.h>
 
 #include "core/heap.h"
 #include "core/pool.h"
 #include "core/slice.h"
 #include "obj/elf/elf.h"
 #include "obj/format.h"
 
 /* ---- shdr scratch struct ---- */
 
 typedef struct ShdrRec {
   u32 sh_name;
   u32 sh_type;
   u64 sh_flags;
   u64 sh_addr;
   u64 sh_offset;
   u64 sh_size;
   u32 sh_link;
   u32 sh_info;
   u64 sh_addralign;
   u64 sh_entsize;
 } ShdrRec;
 
 static void parse_shdr(const u8* p, int is32, ShdrRec* out) {
   /* Elf32_Shdr (40B) shares field order with Elf64_Shdr (64B); only the
    * flags/addr/offset/size/addralign/entsize fields narrow to u32 and
    * shift the following offsets. The ShdrRec stays u64-wide. */
   if (is32) {
     out->sh_name = rd_u32_le(p + 0);
     out->sh_type = rd_u32_le(p + 4);
     out->sh_flags = rd_u32_le(p + 8);
     out->sh_addr = rd_u32_le(p + 12);
     out->sh_offset = rd_u32_le(p + 16);
     out->sh_size = rd_u32_le(p + 20);
     out->sh_link = rd_u32_le(p + 24);
     out->sh_info = rd_u32_le(p + 28);
     out->sh_addralign = rd_u32_le(p + 32);
     out->sh_entsize = rd_u32_le(p + 36);
   } else {
     out->sh_name = rd_u32_le(p + 0);
     out->sh_type = rd_u32_le(p + 4);
     out->sh_flags = rd_u64_le(p + 8);
     out->sh_addr = rd_u64_le(p + 16);
     out->sh_offset = rd_u64_le(p + 24);
     out->sh_size = rd_u64_le(p + 32);
     out->sh_link = rd_u32_le(p + 40);
     out->sh_info = rd_u32_le(p + 44);
     out->sh_addralign = rd_u64_le(p + 48);
     out->sh_entsize = rd_u64_le(p + 56);
   }
 }
 
 /* ---- mappers ---- */
 
 /* The bits this function maps to SecFlag — anything outside this mask is
  * treated as opaque and stashed in Section.ext_flags by the caller so the
  * emitter can write it back unchanged.  Examples of bits left over:
  * SHF_EXCLUDE (0x80000000) on .llvm_addrsig, SHF_COMPRESSED (0x800) on
  * compressed .debug_*, SHF_INFO_LINK (0x40) on .rela.* sections. */
 #define ELF_KNOWN_FLAGS_MASK                                           \
   ((u64)(SHF_ALLOC | SHF_EXECINSTR | SHF_WRITE | SHF_TLS | SHF_MERGE | \
          SHF_STRINGS | SHF_GROUP | SHF_LINK_ORDER | SHF_GNU_RETAIN))
 
 static u16 elf_flags_to_obj(u64 f) {
   u16 r = 0;
   if (f & SHF_ALLOC) r |= SF_ALLOC;
   if (f & SHF_EXECINSTR) r |= SF_EXEC;
   if (f & SHF_WRITE) r |= SF_WRITE;
   if (f & SHF_TLS) r |= SF_TLS;
   if (f & SHF_MERGE) r |= SF_MERGE;
   if (f & SHF_STRINGS) r |= SF_STRINGS;
   if (f & SHF_GROUP) r |= SF_GROUP;
   if (f & SHF_LINK_ORDER) r |= SF_LINK_ORDER;
   if (f & SHF_GNU_RETAIN) r |= SF_RETAIN;
   return r;
 }
 
 /* Map ELF sh_type -> SecSem.  Sets *known to 1 if the value is one of
  * the canonical types the kit model knows about; 0 means the caller
  * fell through to the SSEM_PROGBITS fallback and should preserve the
  * raw sh_type via Section.ext_type so emit_elf can write it back. */
 static u16 elf_type_to_sem(u32 t, int* known) {
   *known = 1;
   switch (t) {
     case SHT_PROGBITS:
       return SSEM_PROGBITS;
     case SHT_NOBITS:
       return SSEM_NOBITS;
     case SHT_SYMTAB:
       return SSEM_SYMTAB;
     case SHT_STRTAB:
       return SSEM_STRTAB;
     case SHT_RELA:
       return SSEM_RELA;
     case SHT_REL:
       return SSEM_REL;
     case SHT_NOTE:
       return SSEM_NOTE;
     case SHT_INIT_ARRAY:
       return SSEM_INIT_ARRAY;
     case SHT_FINI_ARRAY:
       return SSEM_FINI_ARRAY;
     case SHT_PREINIT_ARRAY:
       return SSEM_PREINIT_ARRAY;
     case SHT_GROUP:
       return SSEM_GROUP;
     default:
       *known = 0;
       return SSEM_PROGBITS;
   }
 }
 
 static u16 elf_kind_from_name(const char* name, u32 nlen, u64 sh_flags,
                               u32 sh_type) {
   if (sh_type == SHT_NOBITS) return SEC_BSS;
   if (nlen >= 5 && memcmp(name, ".text", 5) == 0) return SEC_TEXT;
   if (nlen >= 7 && memcmp(name, ".rodata", 7) == 0) return SEC_RODATA;
   if (nlen >= 5 && memcmp(name, ".data", 5) == 0) return SEC_DATA;
   if (nlen >= 4 && memcmp(name, ".bss", 4) == 0) return SEC_BSS;
   if (nlen >= 7 && memcmp(name, ".debug_", 7) == 0) return SEC_DEBUG;
   /* Fallback: classify by flags. */
   if (sh_flags & SHF_EXECINSTR) return SEC_TEXT;
   if (sh_flags & SHF_WRITE) return SEC_DATA;
   if (sh_flags & SHF_ALLOC) return SEC_RODATA;
   return SEC_OTHER;
 }
 
 static u16 elf_bind_to_obj(u32 b) {
   switch (b) {
     case STB_GLOBAL:
     case STB_GNU_UNIQUE:
       /* GNU-unique is a global with extra runtime uniqueness semantics; for
        * link-time resolution it is an ordinary global definition. FreeBSD's
        * crt1.o brands the binary with a GNU-unique `.freebsd.note*` symbol. */
       return SB_GLOBAL;
     case STB_WEAK:
       return SB_WEAK;
     default:
       return SB_LOCAL;
   }
 }
 
 static u16 elf_type_to_kind(u32 t, u16 shndx) {
   if (shndx == SHN_UNDEF) return SK_UNDEF;
   if (shndx == SHN_COMMON) return SK_COMMON;
   /* SHN_ABS is the convention for STT_FILE and a few other defined
    * symbols whose value is not an address. Don't smother the type
    * with SK_ABS when the type field carries real information — only
    * fall through to SK_ABS for STT_NOTYPE-at-SHN_ABS. */
   if (shndx == SHN_ABS && t == STT_NOTYPE) return SK_ABS;
   switch (t) {
     case STT_FUNC:
       return SK_FUNC;
     case STT_OBJECT:
       return SK_OBJ;
     case STT_SECTION:
       return SK_SECTION;
     case STT_FILE:
       return SK_FILE;
     case STT_TLS:
       return SK_TLS;
     case STT_COMMON:
       return SK_COMMON;
     case STT_GNU_IFUNC:
       return SK_IFUNC;
     default:
       /* STT_NOTYPE on a defined symbol (e.g. AArch64 mapping symbols
        * `$x` / `$d`, or assembly labels) round-trips as SK_NOTYPE.
        * The linker keeps definedness keyed on SK_UNDEF; SK_NOTYPE is
        * "defined but typeless". */
       return SK_NOTYPE;
   }
 }
 
 static u8 elf_other_to_vis(u32 other) {
   switch (other & 3) {
     case STV_HIDDEN:
       return SV_HIDDEN;
     case STV_PROTECTED:
       return SV_PROTECTED;
     case STV_INTERNAL:
       return SV_INTERNAL;
     default:
       return SV_DEFAULT;
   }
 }
 
 /* Bounds-checked C-string slice from a strtab section. Returns "" on
  * out-of-range so callers don't have to special-case it. `len_out` is
  * set to the result's byte length. */
 static const char* strtab_lookup(const u8* tab, u64 tab_size, u32 off,
                                  u32* len_out) {
   if (off >= tab_size) {
     *len_out = 0;
     return "";
   }
   const char* s = (const char*)(tab + off);
   u32 max = (u32)(tab_size - off);
   u32 n = 0;
   while (n < max && s[n] != '\0') ++n;
   *len_out = n;
   return s;
 }
 
 static const char* pt_type_name(u32 t) {
   switch (t) {
     case PT_NULL:
       return "NULL";
     case PT_LOAD:
       return "LOAD";
     case PT_DYNAMIC:
       return "DYNAMIC";
     case PT_INTERP:
       return "INTERP";
     case PT_NOTE:
       return "NOTE";
     case PT_PHDR:
       return "PHDR";
     case PT_TLS:
       return "TLS";
     case PT_GNU_EH_FRAME:
       return "GNU_EH_FRAME";
     case PT_GNU_STACK:
       return "GNU_STACK";
     case PT_GNU_RELRO:
       return "GNU_RELRO";
     default:
       return "UNKNOWN";
   }
 }
 
 static Sym intern_cstr(Compiler* c, const char* s) {
   return pool_intern_slice(c->global, (Slice){.s = s, .len = (u32)strlen(s)});
 }
 
 /* ELF default-version normalization. A symbol "base@@VERSION" is the *default*
  * version of `base`: an unversioned reference binds to it. GNU as emits the
  * literal "@@" into a relocatable object's .symtab string (e.g. FreeBSD
  * libc.a's openat@@FBSD_1.2 / setcontext / swapcontext). Trim to the base so
  * kit's name-based resolution matches plain references. A single-'@'
  * (non-default) version is left intact -- those are inert compatibility
  * aliases (e.g. fstat@FBSD_1.0) that must NOT shadow the modern base symbol.
  * Shared-library exports keep their version in .gnu.version_d rather than the
  * name string, so this only fires for relocatable .symtab reads. Returns the
  * length of the base name (== nlen when there is no "@@"). */
 static u32 elf_default_version_namelen(const char* nm, u32 nlen) {
   u32 i;
   if (!nm) return nlen;
   for (i = 1; i + 1 < nlen; ++i)
     if (nm[i] == '@' && nm[i + 1] == '@') return i;
   return nlen;
 }
 
 /* Parse a DSO's .gnu.version_d (SHT_GNU_VERDEF) into an index->version-name
  * table so .dynsym entries (whose version lives in the parallel .gnu.version)
  * can be labelled. Returns an arena table indexed by version index (0/1 unused,
  * matching VER_NDX_LOCAL/GLOBAL) and sets *out_max to the highest index seen;
  * NULL when the input has no verdef. The Verdef/Verdaux wire layout is identical
  * on ELFCLASS32/64 (all Half/Word fields), so this is width-agnostic. */
 static Sym* read_elf_verdefs(Compiler* c, const u8* data, size_t len,
                              const ShdrRec* shdrs, u16 e_shnum, u32* out_max) {
   u32 i, verdef_idx = 0, max_ndx = 0;
   const ShdrRec* sh;
   const ShdrRec* str_sh;
   const u8* strtab;
   const u8* base;
   u64 strtab_sz, size, off;
   Sym* tbl;
   *out_max = 0;
   for (i = 1; i < e_shnum; ++i)
     if (shdrs[i].sh_type == SHT_GNU_VERDEF) {
       verdef_idx = i;
       break;
     }
   if (!verdef_idx) return NULL;
   sh = &shdrs[verdef_idx];
   if (sh->sh_link >= e_shnum) return NULL;
   str_sh = &shdrs[sh->sh_link];
   if (sh->sh_offset + sh->sh_size > len ||
       str_sh->sh_offset + str_sh->sh_size > len)
     return NULL;
   strtab = data + str_sh->sh_offset;
   strtab_sz = str_sh->sh_size;
   base = data + sh->sh_offset;
   size = sh->sh_size;
 
   /* Pass 1: highest version index, to size the table. */
   off = 0;
   while (off + ELF_VERDEF_SIZE <= size) {
     u32 ndx = (u32)(rd_u16_le(base + off + 4) & VERSYM_VERSION);
     u32 vd_next = rd_u32_le(base + off + 16);
     if (ndx > max_ndx) max_ndx = ndx;
     if (!vd_next) break;
     off += vd_next;
   }
   tbl = arena_zarray(c->scratch, Sym, (size_t)max_ndx + 1u);
 
   /* Pass 2: record each non-base version's name (its first Verdaux). */
   off = 0;
   while (off + ELF_VERDEF_SIZE <= size) {
     u16 vd_flags = rd_u16_le(base + off + 2);
     u32 ndx = (u32)(rd_u16_le(base + off + 4) & VERSYM_VERSION);
     u32 vd_aux = rd_u32_le(base + off + 12);
     u32 vd_next = rd_u32_le(base + off + 16);
     if (!(vd_flags & VER_FLG_BASE) && ndx <= max_ndx &&
         off + vd_aux + ELF_VERDAUX_SIZE <= size) {
       u32 nlen;
       const char* nm =
           strtab_lookup(strtab, strtab_sz, rd_u32_le(base + off + vd_aux), &nlen);
       if (nlen)
         tbl[ndx] = pool_intern_slice(c->global, (Slice){.s = nm, .len = nlen});
     }
     if (!vd_next) break;
     off += vd_next;
   }
   *out_max = max_ndx;
   return tbl;
 }
 
 /* Populate the builder's ObjImage from an ET_EXEC / ET_DYN input: the
  * program-header segment table (+ interp + image base), the .dynamic
  * dependency view (DT_NEEDED / DT_SONAME / DT_RPATH / DT_RUNPATH), the
  * .dynsym dynamic symbols, and the allocatable .rela.* / .rel.* dynamic
  * relocations. The section / symbol tables are parsed by read_elf's normal
  * passes; this adds the orthogonal image dimension. Lenient where a
  * malformed sub-table would otherwise abort a useful inspection: a bad
  * .dynamic / .dynsym / dyn-reloc table is skipped rather than panicked. */
 static void read_elf_image(Compiler* c, ObjBuilder* ob, const u8* data,
                            size_t len, u16 e_type, int is32,
                            const ShdrRec* shdrs, u16 e_shnum,
                            const u32* elf_to_obj, u32 (*reloc_from)(u32)) {
   u32 phdr_size = is32 ? ELF32_PHDR_SIZE : ELF64_PHDR_SIZE;
   u32 sym_size = is32 ? ELF32_SYM_SIZE : ELF64_SYM_SIZE;
   u32 rela_size = is32 ? ELF32_RELA_SIZE : ELF64_RELA_SIZE;
   u32 rel_size = is32 ? 8u : 16u;
   u32 dyn_size = is32 ? ELF32_DYN_SIZE : ELF64_DYN_SIZE;
   ObjImage* im =
       obj_image_ensure(ob, e_type == ET_DYN ? OBJ_KIND_DYN : OBJ_KIND_EXEC);
   if (!im) compiler_panic(c, SRCLOC_NONE, "read_elf: obj_image_ensure failed");
 
   /* e_entry is at offset 24 in both Ehdr32/Ehdr64, native width. */
   obj_image_set_entry(im, elf_rd_addr(data + 24, is32));
 
   /* Program headers -> segments (+ PT_INTERP string, image base). */
   {
     /* e_phoff: 4B@28 on ELF32, 8B@32 on ELF64. e_phentsize/e_phnum
      * shift accordingly (42/44 vs 54/56). */
     u64 e_phoff = is32 ? (u64)rd_u32_le(data + 28) : rd_u64_le(data + 32);
     u16 e_phentsize = rd_u16_le(data + (is32 ? 42 : 54));
     u16 e_phnum = rd_u16_le(data + (is32 ? 44 : 56));
     int have_base = 0;
     u64 image_base = 0;
     if (e_phnum) {
       if (e_phentsize != phdr_size)
         compiler_panic(c, SRCLOC_NONE, "read_elf: unexpected e_phentsize %u",
                        (u32)e_phentsize);
       if (e_phoff + (u64)e_phnum * phdr_size > len)
         compiler_panic(c, SRCLOC_NONE,
                        "read_elf: program header table out of range");
       for (u16 i = 0; i < e_phnum; ++i) {
         const u8* p = data + e_phoff + (u64)i * phdr_size;
         /* Elf32_Phdr REORDERS p_flags AFTER the sizes:
          *   p_type@0,p_offset@4,p_vaddr@8,p_paddr@12,p_filesz@16,
          *   p_memsz@20,p_flags@24,p_align@28 (all u32).
          * Elf64_Phdr: p_type@0,p_flags@4,p_offset@8,p_vaddr@16,
          *   p_filesz@32,p_memsz@40,p_align@48. */
         u32 p_type = rd_u32_le(p + 0);
         u32 p_flags = is32 ? rd_u32_le(p + 24) : rd_u32_le(p + 4);
         u64 p_offset = is32 ? (u64)rd_u32_le(p + 4) : rd_u64_le(p + 8);
         u64 p_vaddr = is32 ? (u64)rd_u32_le(p + 8) : rd_u64_le(p + 16);
         u64 p_filesz = is32 ? (u64)rd_u32_le(p + 16) : rd_u64_le(p + 32);
         u64 p_memsz = is32 ? (u64)rd_u32_le(p + 20) : rd_u64_le(p + 40);
         u64 p_align = is32 ? (u64)rd_u32_le(p + 28) : rd_u64_le(p + 48);
         ObjSegment seg;
         seg.name = intern_cstr(c, pt_type_name(p_type));
         seg.vaddr = p_vaddr;
         seg.vsize = p_memsz;
         seg.file_off = p_offset;
         seg.file_size = p_filesz;
         /* PF_R/W/X share bit values with OBJ_SEG_R/W/X. */
         seg.perms = p_flags & (PF_R | PF_W | PF_X);
         seg.align = (u32)(p_align ? p_align : 1);
         obj_image_add_segment(im, &seg);
 
         if (p_type == PT_LOAD && (!have_base || p_vaddr < image_base)) {
           image_base = p_vaddr;
           have_base = 1;
         }
         if (p_type == PT_INTERP && p_filesz && p_offset + p_filesz <= len) {
           u32 ilen = (u32)p_filesz;
           while (ilen && data[p_offset + ilen - 1] == '\0') --ilen;
           if (ilen)
             obj_image_set_interp(
                 im, pool_intern_slice(
                         c->global, (Slice){.s = (const char*)(data + p_offset),
                                            .len = ilen}));
         }
       }
     }
     if (have_base) obj_image_set_base(im, image_base);
   }
 
   /* Locate .dynamic and .dynsym. */
   u32 dynamic_idx = 0, dynsym_idx = 0;
   for (u16 i = 1; i < e_shnum; ++i) {
     if (shdrs[i].sh_type == SHT_DYNAMIC && !dynamic_idx) dynamic_idx = i;
     if (shdrs[i].sh_type == SHT_DYNSYM && !dynsym_idx) dynsym_idx = i;
   }
 
   /* .dynamic -> dependency view. */
   if (dynamic_idx) {
     const ShdrRec* dsh = &shdrs[dynamic_idx];
     if (dsh->sh_link < e_shnum) {
       const ShdrRec* str_sh = &shdrs[dsh->sh_link];
       if (str_sh->sh_offset + str_sh->sh_size <= len &&
           dsh->sh_offset + dsh->sh_size <= len) {
         const u8* dynstr = data + str_sh->sh_offset;
         u64 dynstr_sz = str_sh->sh_size;
         const u8* dynp = data + dsh->sh_offset;
         u64 dynsz = dsh->sh_size;
         /* ELF32 DT entries are 8B (d_tag:u32, d_un:u32); ELF64 16B. */
         for (u64 off = 0; off + dyn_size <= dynsz; off += dyn_size) {
           u64 tag = elf_rd_addr(dynp + off, is32);
           u64 val = elf_rd_addr(dynp + off + (is32 ? 4 : 8), is32);
           /* Raw .dynamic view (escape hatch): one entry per DT_* tag, the
            * terminating DT_NULL included, before the NEEDED/SONAME/RPATH
            * filtering below. */
           {
             ObjImageRaw r;
             r.tag = (u32)tag;
             r.value = val;
             r.extra = 0;
             obj_image_add_raw(im, &r);
           }
           if (tag == DT_NULL) break;
           if (tag != DT_NEEDED && tag != DT_SONAME && tag != DT_RPATH &&
               tag != DT_RUNPATH)
             continue;
           {
             u32 nlen;
             const char* nm = strtab_lookup(dynstr, dynstr_sz, (u32)val, &nlen);
             Sym s = nlen ? pool_intern_slice(c->global,
                                              (Slice){.s = nm, .len = nlen})
                          : 0;
             if (!s) continue;
             if (tag == DT_NEEDED) {
               ObjImageDep d;
               d.name = s;
               d.imports = NULL;
               d.nimports = 0;
               obj_image_add_dep(im, &d);
             } else if (tag == DT_SONAME) {
               obj_image_set_soname(im, s);
             } else {
               obj_image_add_rpath(im, s);
             }
           }
         }
       }
     }
   }
 
   /* .dynsym -> dynamic symbols, plus an index->name table for dyn relocs. */
   Sym* dynsym_names = NULL;
   u32 ndynsym = 0;
   if (dynsym_idx) {
     const ShdrRec* sh = &shdrs[dynsym_idx];
     if (sh->sh_entsize == sym_size && (sh->sh_size % sym_size) == 0 &&
         sh->sh_link < e_shnum && sh->sh_offset + sh->sh_size <= len) {
       const ShdrRec* str_sh = &shdrs[sh->sh_link];
       if (str_sh->sh_offset + str_sh->sh_size <= len) {
         const u8* strtab = data + str_sh->sh_offset;
         u64 strtab_sz = str_sh->sh_size;
         const u8* base = data + sh->sh_offset;
         ndynsym = (u32)(sh->sh_size / sym_size);
         dynsym_names = arena_zarray(c->scratch, Sym, ndynsym ? ndynsym : 1);
         /* Parallel symbol-version tables: .gnu.version_d names indexed by
          * version index, and .gnu.version (one u16 per dynsym entry). A
          * defined entry whose versym lacks VERSYM_HIDDEN is the *default*
          * version of its name — the version a plain reference should bind. */
         u32 verdef_max = 0;
         Sym* verdef_tbl = read_elf_verdefs(c, data, len, shdrs, e_shnum,
                                            &verdef_max);
         const u8* versym = NULL;
         u32 nversym = 0;
         for (u16 vi = 1; vi < e_shnum; ++vi) {
           if (shdrs[vi].sh_type != SHT_GNU_VERSYM) continue;
           if (shdrs[vi].sh_offset + shdrs[vi].sh_size <= len &&
               shdrs[vi].sh_entsize == 2)
             versym = data + shdrs[vi].sh_offset,
             nversym = (u32)(shdrs[vi].sh_size / 2u);
           break;
         }
         for (u32 i = 1; i < ndynsym; ++i) {
           const u8* p = base + (u64)i * sym_size;
           /* Elf32_Sym REORDERS: st_name@0, st_value@4, st_size@8,
            * st_info@12, st_other@13, st_shndx@14. Elf64_Sym:
            * st_name@0, st_info@4, st_other@5, st_shndx@6,
            * st_value@8, st_size@16. */
           u32 st_name = rd_u32_le(p + 0);
           u8 st_info = is32 ? p[12] : p[4];
           u16 st_shndx = is32 ? rd_u16_le(p + 14) : rd_u16_le(p + 6);
           u64 st_value = is32 ? (u64)rd_u32_le(p + 4) : rd_u64_le(p + 8);
           u64 st_size = is32 ? (u64)rd_u32_le(p + 8) : rd_u64_le(p + 16);
           u32 nlen;
           const char* nm = strtab_lookup(strtab, strtab_sz, st_name, &nlen);
           Sym sn =
               nlen ? pool_intern_slice(c->global, (Slice){.s = nm, .len = nlen})
                    : 0;
           ObjImageSym ds;
           dynsym_names[i] = sn;
           ds.name = sn;
           ds.bind = (SymBind)elf_bind_to_obj(ELF64_ST_BIND(st_info));
           ds.kind = (SymKind)elf_type_to_kind(ELF64_ST_TYPE(st_info), st_shndx);
           ds.section = (st_shndx == SHN_UNDEF || st_shndx == SHN_ABS ||
                         st_shndx == SHN_COMMON || st_shndx >= e_shnum)
                            ? OBJ_SEC_NONE
                            : elf_to_obj[st_shndx];
           ds.value = st_value;
           ds.size = st_size;
           ds.version = 0;
           if (versym && verdef_tbl && i < nversym && st_shndx != SHN_UNDEF) {
             u16 v = rd_u16_le(versym + (u64)i * 2u);
             u32 ndx = (u32)(v & VERSYM_VERSION);
             if (!(v & VERSYM_HIDDEN) && ndx >= 2u && ndx <= verdef_max)
               ds.version = verdef_tbl[ndx];
           }
           obj_image_add_dynsym(im, &ds);
         }
       }
     }
   }
 
   /* Allocatable .rela.* / .rel.* -> dynamic relocations. */
   for (u16 i = 1; i < e_shnum; ++i) {
     const ShdrRec* sh = &shdrs[i];
     int is_rela = (sh->sh_type == SHT_RELA);
     int is_rel = (sh->sh_type == SHT_REL);
     u32 entsize, nrec, j;
     const u8* base;
     if (!is_rela && !is_rel) continue;
     if (!(sh->sh_flags & SHF_ALLOC))
       continue; /* link-time relocs: not dynamic */
     entsize = is_rela ? rela_size : rel_size;
     if (sh->sh_entsize != entsize || (sh->sh_size % entsize) != 0) continue;
     if (sh->sh_offset + sh->sh_size > len) continue;
     nrec = (u32)(sh->sh_size / entsize);
     base = data + sh->sh_offset;
     for (j = 0; j < nrec; ++j) {
       /* Elf32_Rela (12B): r_offset@0, r_info@4 (ELF32 packing),
        * r_addend@8. Elf64_Rela (24B): r_offset@0, r_info@8, r_addend@16. */
       const u8* p = base + (u64)j * entsize;
       u64 r_offset = elf_rd_addr(p + 0, is32);
       u64 r_info = is32 ? (u64)rd_u32_le(p + 4) : rd_u64_le(p + 8);
       i64 r_addend =
           is_rela ? (is32 ? (i64)(i32)rd_u32_le(p + 8) : (i64)rd_u64_le(p + 16))
                   : 0;
       u32 esym = is32 ? ELF32_R_SYM(r_info) : ELF64_R_SYM(r_info);
       u32 kind = reloc_from(is32 ? ELF32_R_TYPE(r_info) : ELF64_R_TYPE(r_info));
       ObjImageReloc dr;
       if (kind == (u32)-1) continue; /* unmodeled dyn reloc type: skip */
       dr.section = OBJ_SEC_NONE; /* offset is a vaddr, not section-relative */
       dr.offset = r_offset;
       dr.sym_name = (dynsym_names && esym < ndynsym) ? dynsym_names[esym] : 0;
       dr.addend = r_addend;
       dr.kind = (RelocKind)kind;
       obj_image_add_dynreloc(im, &dr);
     }
   }
 }
 
 ObjBuilder* read_elf(Compiler* c, const char* name, const u8* data,
                      size_t len) {
   (void)name;
 
   /* Need at least the e_ident to read EI_CLASS; the full min-length
    * check below uses the class-selected ehdr size. */
   if (len < EI_NIDENT)
     compiler_panic(c, SRCLOC_NONE, "read_elf: input shorter than ELF header");
 
   if (data[EI_MAG0] != ELFMAG0 || data[EI_MAG1] != ELFMAG1 ||
       data[EI_MAG2] != ELFMAG2 || data[EI_MAG3] != ELFMAG3)
     compiler_panic(c, SRCLOC_NONE, "read_elf: bad ELF magic");
 
   /* Accept both classes; is32 (EI_CLASS==ELFCLASS32) drives every
    * stride/offset/field-order decision below. RV32 and RV64 share
    * EM_RISCV — the reader cannot tell them apart by e_machine, only by
    * EI_CLASS, so is32 is the single source of truth here. */
   if (data[EI_CLASS] != ELFCLASS64 && data[EI_CLASS] != ELFCLASS32)
     compiler_panic(c, SRCLOC_NONE, "read_elf: not ELFCLASS32/64 (got %u)",
                    data[EI_CLASS]);
   if (data[EI_DATA] != ELFDATA2LSB)
     compiler_panic(c, SRCLOC_NONE, "read_elf: not ELFDATA2LSB (got %u)",
                    data[EI_DATA]);
 
   int is32 = (data[EI_CLASS] == ELFCLASS32);
   u32 ehdr_size = is32 ? ELF32_EHDR_SIZE : ELF64_EHDR_SIZE;
   u32 shdr_size = is32 ? ELF32_SHDR_SIZE : ELF64_SHDR_SIZE;
   u32 sym_size = is32 ? ELF32_SYM_SIZE : ELF64_SYM_SIZE;
   u32 rela_size = is32 ? ELF32_RELA_SIZE : ELF64_RELA_SIZE;
   u32 rel_size = is32 ? 8u : 16u;
   if (len < ehdr_size)
     compiler_panic(c, SRCLOC_NONE, "read_elf: input shorter than ELF header");
 
   u16 e_type = rd_u16_le(data + 16);
   /* ET_REL parses to the section/symbol/reloc view only. ET_EXEC/ET_DYN
    * additionally get the linked-image view (read_elf_image, below); their
    * section tables still parse through the same passes. ET_CORE and other
    * types are out of scope (see doc/plan/IMAGE_INSPECT.md). */
   if (e_type != ET_REL && e_type != ET_EXEC && e_type != ET_DYN)
     compiler_panic(c, SRCLOC_NONE,
                    "read_elf: unsupported e_type=%u (expected ET_REL, "
                    "ET_EXEC, or ET_DYN)",
                    (u32)e_type);
 
   u16 e_machine = rd_u16_le(data + 18);
   /* EM_RISCV is shared by RV32/RV64; disambiguate by EI_CLASS via
    * obj_elf_machine_class (obj_elf_machine keys on e_machine alone). */
   const ObjElfArchOps* arch = obj_elf_machine_class(e_machine, data[EI_CLASS]);
   u32 (*reloc_from)(u32);
   if (!arch || !arch->reloc_from) {
     compiler_panic(c, SRCLOC_NONE, "read_elf: unsupported e_machine 0x%x",
                    (u32)e_machine);
   }
   reloc_from = arch->reloc_from;
 
   /* Post-e_version Ehdr fields narrow + shift under ELF32: e_entry/
    * e_phoff/e_shoff are 4B (vs 8B), so e_flags@36, e_phentsize@42,
    * e_phnum@44, e_shentsize@46, e_shnum@48, e_shstrndx@50 (vs 48/54/
    * 56/58/60/62 on ELF64). */
   u64 e_shoff = is32 ? (u64)rd_u32_le(data + 32) : rd_u64_le(data + 40);
   u32 e_flags = rd_u32_le(data + (is32 ? 36 : 48));
   u16 e_shentsize = rd_u16_le(data + (is32 ? 46 : 58));
   u16 e_shnum = rd_u16_le(data + (is32 ? 48 : 60));
   u16 e_shstrndx = rd_u16_le(data + (is32 ? 50 : 62));
 
   /* A fully section-stripped image (objcopy --strip-sections, packers,
    * some release binaries) sets e_shoff/e_shnum to zero: the section
    * header table is gone, but the load segments still describe the file.
    * That's valid for ET_EXEC/ET_DYN — parse the image view (segments +
    * dynamic) and present an empty section view, matching GNU/LLVM. An
    * ET_REL with no sections carries no model state, so still reject it. */
   int has_sht = (e_shoff != 0 && e_shnum != 0);
   if (has_sht) {
     if (e_shentsize != shdr_size)
       compiler_panic(c, SRCLOC_NONE, "read_elf: unexpected e_shentsize %u",
                      (u32)e_shentsize);
     if (e_shoff + (u64)e_shnum * shdr_size > len)
       compiler_panic(c, SRCLOC_NONE,
                      "read_elf: section header table out of range");
     if (e_shstrndx >= e_shnum)
       compiler_panic(c, SRCLOC_NONE, "read_elf: e_shstrndx %u >= e_shnum %u",
                      (u32)e_shstrndx, (u32)e_shnum);
   } else {
     if (e_type == ET_REL)
       compiler_panic(c, SRCLOC_NONE,
                      "read_elf: ET_REL with no section header table");
     e_shnum = 0; /* normalize so the section/symbol/reloc passes are no-ops */
   }
 
   /* Parse all shdrs into scratch. NULL when the table is absent. */
   ShdrRec* shdrs = NULL;
   const u8* shstrtab = NULL;
   u64 shstrtab_sz = 0;
   if (has_sht) {
     shdrs = arena_array(c->scratch, ShdrRec, e_shnum);
     for (u32 i = 0; i < e_shnum; ++i)
       parse_shdr(data + e_shoff + (u64)i * shdr_size, is32, &shdrs[i]);
 
     const ShdrRec* shstr_sh = &shdrs[e_shstrndx];
     if (shstr_sh->sh_offset + shstr_sh->sh_size > len)
       compiler_panic(c, SRCLOC_NONE, "read_elf: .shstrtab out of range");
     shstrtab = data + shstr_sh->sh_offset;
     shstrtab_sz = shstr_sh->sh_size;
   }
 
   /* Build the ObjBuilder. */
   ObjBuilder* ob = obj_new(c);
   if (!ob) compiler_panic(c, SRCLOC_NONE, "read_elf: obj_new failed");
   obj_set_elf_e_flags(ob, e_flags);
 
   /* elf_to_obj[shndx] -> ObjSecId, OBJ_SEC_NONE for skipped sections. */
   u32* elf_to_obj = arena_zarray(c->scratch, u32, e_shnum ? e_shnum : 1);
 
   /* Pass 1: create obj sections for every non-NULL shdr that carries
    * load-bearing model state. SYMTAB / STRTAB / RELA / REL are
    * consumed below for symbols and relocations and do NOT round-trip
    * as obj sections — emit_elf re-synthesizes them from the
    * ObjBuilder's symbols / strtab / relocs. The shstrtab is a STRTAB
    * too, so it falls out the same way. */
   for (u32 i = 1; i < e_shnum; ++i) {
     const ShdrRec* sh = &shdrs[i];
     if (sh->sh_type == SHT_NULL) continue;
     if (sh->sh_type == SHT_SYMTAB) continue;
     if (sh->sh_type == SHT_STRTAB) continue;
     if (sh->sh_type == SHT_RELA) continue;
     if (sh->sh_type == SHT_REL) continue;
     /* SHT_GROUP is consumed below into an ObjGroup record (signature
      * symbol + member ObjSecIds). emit_elf re-synthesizes the group
      * section bytes from the ObjGroup, using current section indices
      * — so the original section's raw body would be stale anyway. */
     if (sh->sh_type == SHT_GROUP) continue;
 
     u32 nlen;
     const char* nm = strtab_lookup(shstrtab, shstrtab_sz, sh->sh_name, &nlen);
     Sym sym = pool_intern_slice(c->global, (Slice){.s = nm, .len = nlen});
 
     u16 sec_kind = elf_kind_from_name(nm, nlen, sh->sh_flags, sh->sh_type);
     int type_known;
     u16 sec_sem = elf_type_to_sem(sh->sh_type, &type_known);
     u16 flags = elf_flags_to_obj(sh->sh_flags);
     u32 align = sh->sh_addralign ? (u32)sh->sh_addralign : 1;
 
     ObjSecId id =
         obj_section_ex(ob, sym, (SecKind)sec_kind, (SecSem)sec_sem, flags,
                        align, (u32)sh->sh_entsize, sh->sh_link, sh->sh_info);
     if (id == OBJ_SEC_NONE)
       compiler_panic(c, SRCLOC_NONE,
                      "read_elf: obj_section_ex failed for '%.*s'",
                      SLICE_ARG(((Slice){.s = nm, .len = nlen})));
     elf_to_obj[i] = id;
 
     /* Load address: 0 for ET_REL, the assigned vaddr for linked images.
      * Lets the section view carry the load picture for execs/DSOs. */
     if (sh->sh_addr) obj_section_set_addr(ob, id, sh->sh_addr);
 
     /* Preserve format-specific bits the canonical SecSem/SecFlag
      * mapping can't represent so emit_elf can write them back
      * verbatim.  ext_type only set when the sh_type fell through
      * to the "unknown" path. */
     u32 leftover = (u32)(sh->sh_flags & ~ELF_KNOWN_FLAGS_MASK);
     if (!type_known || leftover) {
       obj_section_set_ext(ob, id, OBJ_EXT_ELF, type_known ? 0 : sh->sh_type,
                           leftover);
     }
 
     /* Body bytes. */
     if (sh->sh_type == SHT_NOBITS) {
       obj_reserve_bss(ob, id, (u32)sh->sh_size, align);
     } else if (sh->sh_size) {
       if (sh->sh_offset + sh->sh_size > len)
         compiler_panic(c, SRCLOC_NONE,
                        "read_elf: section '%.*s' bytes out of range",
                        SLICE_ARG(((Slice){.s = nm, .len = nlen})));
       /* For SYMTAB/STRTAB/RELA we still copy the raw bytes — the
        * post-finalize shape contract says these sections are
        * present; emit_elf will regenerate them on re-emit, so the
        * preserved bytes are informational rather than load-bearing.
        */
       obj_write(ob, id, data + sh->sh_offset, (size_t)sh->sh_size);
     }
   }
 
   /* Pass 2: parse the .symtab into ObjSyms, building an
    * elf_sym_idx -> ObjSymId table. There may be zero or one SYMTAB in
    * an ET_REL; pick the first. */
   u32 symtab_shndx = 0;
   for (u32 i = 1; i < e_shnum; ++i) {
     if (shdrs[i].sh_type == SHT_SYMTAB) {
       symtab_shndx = i;
       break;
     }
   }
 
   u32 nsyms = 0;
   u32* sym_elf_to_obj = NULL;
 
   if (symtab_shndx) {
     const ShdrRec* sh = &shdrs[symtab_shndx];
     if (sh->sh_entsize != sym_size)
       compiler_panic(c, SRCLOC_NONE, "read_elf: .symtab entsize %llu != %u",
                      (unsigned long long)sh->sh_entsize, sym_size);
     if (sh->sh_size % sym_size)
       compiler_panic(c, SRCLOC_NONE,
                      "read_elf: .symtab size %llu not a multiple of %u",
                      (unsigned long long)sh->sh_size, sym_size);
     if (sh->sh_link >= e_shnum)
       compiler_panic(c, SRCLOC_NONE,
                      "read_elf: .symtab sh_link %u out of range", sh->sh_link);
     const ShdrRec* str_sh = &shdrs[sh->sh_link];
     if (str_sh->sh_offset + str_sh->sh_size > len)
       compiler_panic(c, SRCLOC_NONE, "read_elf: .strtab out of range");
     const u8* strtab = data + str_sh->sh_offset;
     u64 strtab_sz = str_sh->sh_size;
 
     nsyms = (u32)(sh->sh_size / sym_size);
     sym_elf_to_obj = arena_zarray(c->scratch, u32, nsyms ? nsyms : 1);
 
     const u8* base = data + sh->sh_offset;
     for (u32 i = 1; i < nsyms; ++i) { /* skip index 0 */
       const u8* p = base + (u64)i * sym_size;
       /* Elf32_Sym REORDERS: st_name@0, st_value@4, st_size@8, st_info@12,
        * st_other@13, st_shndx@14. Elf64_Sym: st_name@0, st_info@4,
        * st_other@5, st_shndx@6, st_value@8, st_size@16. */
       u32 st_name = rd_u32_le(p + 0);
       u8 st_info = is32 ? p[12] : p[4];
       u8 st_other = is32 ? p[13] : p[5];
       u16 st_shndx = is32 ? rd_u16_le(p + 14) : rd_u16_le(p + 6);
       u64 st_value = is32 ? (u64)rd_u32_le(p + 4) : rd_u64_le(p + 8);
       u64 st_size = is32 ? (u64)rd_u32_le(p + 8) : rd_u64_le(p + 16);
 
       u32 nlen;
       const char* nm = strtab_lookup(strtab, strtab_sz, st_name, &nlen);
       nlen = elf_default_version_namelen(nm, nlen);
       Sym sn = nlen
                    ? pool_intern_slice(c->global, (Slice){.s = nm, .len = nlen})
                    : 0;
 
       u32 e_bind = ELF64_ST_BIND(st_info);
       u32 e_type = ELF64_ST_TYPE(st_info);
       u16 bind = elf_bind_to_obj(e_bind);
       u16 kind = elf_type_to_kind(e_type, st_shndx);
       u8 vis = elf_other_to_vis(st_other);
 
       ObjSecId sec_id;
       u64 value;
       u64 cmnalign = 0;
       if (st_shndx == SHN_UNDEF) {
         sec_id = OBJ_SEC_NONE;
         value = st_value;
       } else if (st_shndx == SHN_ABS || st_shndx == SHN_COMMON) {
         sec_id = OBJ_SEC_NONE;
         value = st_value;
         if (st_shndx == SHN_COMMON) cmnalign = st_value;
       } else if (st_shndx < e_shnum && shdrs[st_shndx].sh_type == SHT_GROUP) {
         /* A COMDAT group's signature symbol is defined in its SHT_GROUP
          * section, which we consume into an ObjGroup and never keep as an
          * obj section (so elf_to_obj is OBJ_SEC_NONE for it). The symbol just
          * names the group; it is not a data location and is never a reloc
          * target. Record it as an absolute defined symbol so it doesn't look
          * like a phantom undefined reference -- FreeBSD's crt1.o brands the
          * binary with such a symbol (.freebsd.note*). */
         sec_id = OBJ_SEC_NONE;
         value = st_value;
         kind = SK_ABS;
       } else if (st_shndx < e_shnum) {
         sec_id = elf_to_obj[st_shndx];
         value = st_value;
       } else {
         compiler_panic(c, SRCLOC_NONE, "read_elf: symbol shndx %u out of range",
                        (u32)st_shndx);
         sec_id = OBJ_SEC_NONE;
         value = 0; /* unreachable */
       }
 
       ObjSymId id =
           obj_symbol_ex(ob, sn, (SymBind)bind, (SymVis)vis, (SymKind)kind,
                         sec_id, value, st_size, cmnalign);
       obj_sym_mark_referenced(ob, id);
       sym_elf_to_obj[i] = id;
     }
   }
 
   /* Pass 3: parse each SHT_RELA / SHT_REL into ObjBuilder relocations
    * targeting the section the rela header's sh_info points at. */
   for (u32 i = 1; i < e_shnum; ++i) {
     const ShdrRec* sh = &shdrs[i];
     int is_rela = (sh->sh_type == SHT_RELA);
     int is_rel = (sh->sh_type == SHT_REL);
     if (!is_rela && !is_rel) continue;
     /* Allocatable rela/rel in ET_EXEC/ET_DYN are loader (dynamic)
      * relocations — sh_info is 0 or a .got index, not a target section.
      * They belong to the image's dynamic-reloc view (read_elf_image), not
      * the section-relocation table. ET_REL link-time relocs are never
      * SHF_ALLOC, so this is a no-op for relocatable objects. */
     if (sh->sh_flags & SHF_ALLOC) continue;
 
     u32 entsize = is_rela ? rela_size : rel_size;
     if (sh->sh_entsize != entsize)
       compiler_panic(c, SRCLOC_NONE, "read_elf: rela entsize %llu != %u",
                      (unsigned long long)sh->sh_entsize, entsize);
     if (sh->sh_info == 0 || sh->sh_info >= e_shnum)
       compiler_panic(c, SRCLOC_NONE, "read_elf: rela sh_info %u out of range",
                      sh->sh_info);
     ObjSecId target = elf_to_obj[sh->sh_info];
     if (target == OBJ_SEC_NONE) continue;
 
     u32 nrec = (u32)(sh->sh_size / entsize);
     const u8* base = data + sh->sh_offset;
     for (u32 j = 0; j < nrec; ++j) {
       /* Elf32_Rela (12B): r_offset@0, r_info@4 (ELF32 packing, 8-bit
        * type), r_addend@8. Elf64_Rela (24B): r_offset@0, r_info@8,
        * r_addend@16. */
       const u8* p = base + (u64)j * entsize;
       u64 r_offset = elf_rd_addr(p + 0, is32);
       u64 r_info = is32 ? (u64)rd_u32_le(p + 4) : rd_u64_le(p + 8);
       i64 r_addend =
           is_rela ? (is32 ? (i64)(i32)rd_u32_le(p + 8) : (i64)rd_u64_le(p + 16))
                   : 0;
       u32 esym = is32 ? ELF32_R_SYM(r_info) : ELF64_R_SYM(r_info);
       u32 etype = is32 ? ELF32_R_TYPE(r_info) : ELF64_R_TYPE(r_info);
 
       u32 kind = reloc_from(etype);
       if (kind == (u32)-1)
         compiler_panic(c, SRCLOC_NONE,
                        "read_elf: unsupported reloc type %u for e_machine 0x%x",
                        etype, (u32)e_machine);
 
       ObjSymId target_sym = OBJ_SYM_NONE;
       if (esym && sym_elf_to_obj && esym < nsyms)
         target_sym = sym_elf_to_obj[esym];
 
       obj_reloc_ex(ob, target, (u32)r_offset, (RelocKind)kind, target_sym,
                    r_addend, is_rela ? 1 : 0, 0);
     }
   }
 
   /* Pass 4: SHT_GROUP. Each GROUP section's body is a sequence of
    * 4-byte LE indices: [flags, shndx, shndx, ...]. The signature is
    * the symbol named by sh_link/sh_info convention (sh_link=symtab,
    * sh_info=symbol index in that symtab). */
   for (u32 i = 1; i < e_shnum; ++i) {
     const ShdrRec* sh = &shdrs[i];
     if (sh->sh_type != SHT_GROUP) continue;
 
     if (sh->sh_size < 4 || (sh->sh_size % 4)) continue;
     const u8* p = data + sh->sh_offset;
     u32 flags = rd_u32_le(p);
     u32 nm_len;
     const char* gnm =
         strtab_lookup(shstrtab, shstrtab_sz, sh->sh_name, &nm_len);
     Sym gname = pool_intern_slice(c->global, (Slice){.s = gnm, .len = nm_len});
 
     ObjSymId signature = OBJ_SYM_NONE;
     if (sym_elf_to_obj && sh->sh_info < nsyms)
       signature = sym_elf_to_obj[sh->sh_info];
 
     ObjGroupId gid = obj_group(ob, gname, signature, flags);
     u32 n = (u32)(sh->sh_size / 4) - 1;
     for (u32 j = 0; j < n; ++j) {
       u32 shndx = rd_u32_le(p + 4 + j * 4);
       if (shndx < e_shnum && elf_to_obj[shndx] != OBJ_SEC_NONE)
         obj_group_add_section(ob, gid, elf_to_obj[shndx]);
     }
   }
 
   /* ET_EXEC / ET_DYN: attach the linked-image view (segments + dynamic). */
   if (e_type != ET_REL)
     read_elf_image(c, ob, data, len, e_type, is32, shdrs, e_shnum, elf_to_obj,
                    reloc_from);
 
   obj_finalize(ob);
   return ob;
 }
 
 /* ---- ET_DYN (shared object) reader ----
  *
  * Produces an ObjBuilder containing only the DSO's exported symbols
  * (parsed from .dynsym, not .symtab). The DSO's sections, relocations,
  * and groups are skipped — DSOs contribute no bytes to the output
  * image. The DT_SONAME (if any) is interned and returned via
  * `*soname_out` so the caller can record DT_NEEDED at link time.
  *
  * Symbol shape: each defined dynsym entry produces an ObjSym whose
  * (bind, kind, vis) match the source. `section_id` is OBJ_SEC_NONE —
  * the symbol's value is its DSO-internal vaddr, not meaningful to the
  * consuming linker, so we record `value=0`. The linker layer
  * (resolve_undefs) only consults the name and the defined-ness flag.
  *
  * Undefined dynsym entries (st_shndx==SHN_UNDEF) are imports the DSO
  * itself has against other libraries; they're not relevant to a
  * consumer that's linking against this DSO and are dropped. */
 
 static int parse_phdr(const u8* data, size_t len, u64 e_phoff, u16 e_phentsize,
                       u16 e_phnum, u32 want_type, u64* out_offset,
                       u64* out_filesz) {
   u32 i;
   if (e_phentsize != ELF64_PHDR_SIZE) return 0;
   if (e_phoff + (u64)e_phnum * ELF64_PHDR_SIZE > len) return 0;
   for (i = 0; i < e_phnum; ++i) {
     const u8* p = data + e_phoff + (u64)i * ELF64_PHDR_SIZE;
     u32 p_type = rd_u32_le(p + 0);
     if (p_type != want_type) continue;
     *out_offset = rd_u64_le(p + 8);
     *out_filesz = rd_u64_le(p + 32);
     return 1;
   }
   return 0;
 }
 
 ObjBuilder* read_elf_dso(Compiler* c, const char* name, const u8* data,
                          size_t len, Sym* soname_out) {
   (void)name;
   if (soname_out) *soname_out = 0;
 
   if (len < ELF64_EHDR_SIZE)
     compiler_panic(c, SRCLOC_NONE,
                    "read_elf_dso: input shorter than ELF header");
   if (data[EI_MAG0] != ELFMAG0 || data[EI_MAG1] != ELFMAG1 ||
       data[EI_MAG2] != ELFMAG2 || data[EI_MAG3] != ELFMAG3)
     compiler_panic(c, SRCLOC_NONE, "read_elf_dso: bad ELF magic");
   if (data[EI_CLASS] != ELFCLASS64)
     compiler_panic(c, SRCLOC_NONE, "read_elf_dso: not ELFCLASS64");
   if (data[EI_DATA] != ELFDATA2LSB)
     compiler_panic(c, SRCLOC_NONE, "read_elf_dso: not ELFDATA2LSB");
 
   u16 e_type = rd_u16_le(data + 16);
   if (e_type != ET_DYN)
     compiler_panic(c, SRCLOC_NONE,
                    "read_elf_dso: expected ET_DYN, got e_type=%u", (u32)e_type);
 
   u16 e_machine = rd_u16_le(data + 18);
   {
     const ObjFormatImpl* fmt = obj_format_lookup(KIT_OBJ_ELF);
     const ObjElfArchOps* arch =
         fmt && fmt->elf_machine ? fmt->elf_machine(e_machine) : NULL;
     if (!arch)
       compiler_panic(c, SRCLOC_NONE, "read_elf_dso: unsupported e_machine 0x%x",
                      (u32)e_machine);
   }
 
   u64 e_phoff = rd_u64_le(data + 32);
   u64 e_shoff = rd_u64_le(data + 40);
   u16 e_phentsize = rd_u16_le(data + 54);
   u16 e_phnum = rd_u16_le(data + 56);
   u16 e_shentsize = rd_u16_le(data + 58);
   u16 e_shnum = rd_u16_le(data + 60);
   u16 e_shstrndx = rd_u16_le(data + 62);
 
   if (e_shentsize != ELF64_SHDR_SIZE)
     compiler_panic(c, SRCLOC_NONE, "read_elf_dso: unexpected e_shentsize %u",
                    (u32)e_shentsize);
   if (e_shoff + (u64)e_shnum * ELF64_SHDR_SIZE > len)
     compiler_panic(c, SRCLOC_NONE,
                    "read_elf_dso: section header table out of range");
   if (e_shstrndx >= e_shnum)
     compiler_panic(c, SRCLOC_NONE, "read_elf_dso: e_shstrndx out of range");
 
   /* read_elf_dso is ELFCLASS64-only (panics above on other classes), so
    * parse with the ELF64 layout (is32 = 0). */
   ShdrRec* shdrs = arena_array(c->scratch, ShdrRec, e_shnum);
   for (u32 i = 0; i < e_shnum; ++i)
     parse_shdr(data + e_shoff + (u64)i * ELF64_SHDR_SIZE, 0, &shdrs[i]);
 
   /* Locate .dynsym (preferred over .symtab — a stripped DSO carries
    * only .dynsym) and its associated strtab via sh_link. */
   u32 dynsym_idx = 0, dynamic_idx = 0;
   for (u32 i = 1; i < e_shnum; ++i) {
     if (shdrs[i].sh_type == SHT_DYNSYM && !dynsym_idx) dynsym_idx = i;
     if (shdrs[i].sh_type == SHT_DYNAMIC && !dynamic_idx) dynamic_idx = i;
   }
 
   if (!dynsym_idx)
     compiler_panic(c, SRCLOC_NONE,
                    "read_elf_dso: no SHT_DYNSYM in shared object");
 
   /* Parse PT_DYNAMIC for DT_SONAME. The .dynamic section gives us the
    * dynstr to resolve the SONAME's offset; if there's no .dynamic
    * section we fall back to scanning the PT_DYNAMIC segment. */
   Sym soname = 0;
   if (dynamic_idx) {
     const ShdrRec* dsh = &shdrs[dynamic_idx];
     if (dsh->sh_link >= e_shnum)
       compiler_panic(c, SRCLOC_NONE,
                      "read_elf_dso: .dynamic sh_link %u out of range",
                      dsh->sh_link);
     const ShdrRec* str_sh = &shdrs[dsh->sh_link];
     if (str_sh->sh_offset + str_sh->sh_size > len)
       compiler_panic(c, SRCLOC_NONE,
                      "read_elf_dso: .dynamic strtab out of range");
     const u8* dynstr = data + str_sh->sh_offset;
     u64 dynstr_sz = str_sh->sh_size;
 
     if (dsh->sh_offset + dsh->sh_size > len)
       compiler_panic(c, SRCLOC_NONE,
                      "read_elf_dso: .dynamic body out of range");
     const u8* dynp = data + dsh->sh_offset;
     u64 dynsz = dsh->sh_size;
     /* DT entries are 16 bytes: (d_tag: u64, d_un: u64). */
     for (u64 off = 0; off + 16 <= dynsz; off += 16) {
       u64 tag = rd_u64_le(dynp + off);
       u64 val = rd_u64_le(dynp + off + 8);
       if (tag == DT_NULL) break;
       if (tag == DT_SONAME) {
         u32 nlen;
         const char* nm = strtab_lookup(dynstr, dynstr_sz, (u32)val, &nlen);
         if (nlen)
           soname = pool_intern_slice(c->global, (Slice){.s = nm, .len = nlen});
         break;
       }
     }
   } else if (e_phnum) {
     /* Fallback: walk PT_DYNAMIC straight from program headers. We
      * only need DT_SONAME, so skip if we can't find a strtab pointer
      * inline (DT_STRTAB carries a vaddr, not a file offset — stripped
      * DSOs without SHT_DYNAMIC are exceedingly rare in practice). */
     u64 dyn_off, dyn_sz;
     (void)parse_phdr(data, len, e_phoff, e_phentsize, e_phnum, PT_DYNAMIC,
                      &dyn_off, &dyn_sz);
   }
   if (soname_out) *soname_out = soname;
 
   /* Now parse .dynsym. */
   const ShdrRec* sh = &shdrs[dynsym_idx];
   if (sh->sh_entsize != ELF64_SYM_SIZE)
     compiler_panic(c, SRCLOC_NONE, "read_elf_dso: .dynsym entsize %llu != %u",
                    (unsigned long long)sh->sh_entsize, (u32)ELF64_SYM_SIZE);
   if (sh->sh_size % ELF64_SYM_SIZE)
     compiler_panic(c, SRCLOC_NONE,
                    "read_elf_dso: .dynsym size not multiple of entry size");
   if (sh->sh_link >= e_shnum)
     compiler_panic(c, SRCLOC_NONE,
                    "read_elf_dso: .dynsym sh_link out of range");
   const ShdrRec* str_sh = &shdrs[sh->sh_link];
   if (str_sh->sh_offset + str_sh->sh_size > len)
     compiler_panic(c, SRCLOC_NONE, "read_elf_dso: .dynstr out of range");
   const u8* strtab = data + str_sh->sh_offset;
   u64 strtab_sz = str_sh->sh_size;
 
   ObjBuilder* ob = obj_new(c);
   if (!ob) compiler_panic(c, SRCLOC_NONE, "read_elf_dso: obj_new failed");
 
   /* The DSO always gets an ObjImage: its dynsyms record each export's default
    * version (so the linker can emit a matching .gnu.version_r — see
    * build_versions in link_dyn.c, harmless/empty for unversioned DSOs like
    * musl), and its undef list records the symbols this DSO references so
    * --gc-sections keeps the executable's definitions of them alive. */
   u32 verdef_max = 0;
   Sym* verdef_tbl = read_elf_verdefs(c, data, len, shdrs, e_shnum, &verdef_max);
   const u8* versym = NULL;
   u32 nversym = 0;
   for (u32 i = 1; i < e_shnum; ++i) {
     if (shdrs[i].sh_type != SHT_GNU_VERSYM) continue;
     if (shdrs[i].sh_offset + shdrs[i].sh_size <= len && shdrs[i].sh_entsize == 2)
       versym = data + shdrs[i].sh_offset,
       nversym = (u32)(shdrs[i].sh_size / 2u);
     break;
   }
   ObjImage* im = obj_image_ensure(ob, OBJ_KIND_DYN);
   if (im && soname) obj_image_set_soname(im, soname);
 
   u32 nsyms = (u32)(sh->sh_size / ELF64_SYM_SIZE);
   const u8* base = data + sh->sh_offset;
   for (u32 i = 1; i < nsyms; ++i) { /* skip index 0 */
     const u8* p = base + (u64)i * ELF64_SYM_SIZE;
     u32 st_name = rd_u32_le(p + 0);
     u8 st_info = p[4];
     u8 st_other = p[5];
     u16 st_shndx = rd_u16_le(p + 6);
     u32 e_bind = ELF64_ST_BIND(st_info);
     u32 nlen;
     const char* nm;
     Sym sn;
 
     /* Locals are neither exports nor reference dependencies we track. */
     if (e_bind == STB_LOCAL) continue;
     nm = strtab_lookup(strtab, strtab_sz, st_name, &nlen);
     if (!nlen) continue;
     sn = pool_intern_slice(c->global, (Slice){.s = nm, .len = nlen});
 
     /* The DSO's own undefined references: not exports, but if the executable
      * defines one (e.g. libc.so.7's `environ` / `__progname`, defined by the
      * crt) the static linker must keep that definition under --gc-sections. */
     if (st_shndx == SHN_UNDEF) {
       obj_image_add_undef(im, sn);
       continue;
     }
 
     u32 e_type_field = ELF64_ST_TYPE(st_info);
     u16 bind = elf_bind_to_obj(e_bind);
     u16 kind = elf_type_to_kind(e_type_field, st_shndx);
     u8 vis = elf_other_to_vis(st_other);
 
     /* DSO exports land as defined symbols in OBJ_SEC_NONE with
      * value=0. The consumer treats them as imports — see
      * resolve_undefs in src/link/link_layout.c. */
     {
       ObjSymId did = obj_symbol_ex(ob, sn, (SymBind)bind, (SymVis)vis,
                                    (SymKind)kind, OBJ_SEC_NONE, 0, 0, 0);
       obj_sym_mark_referenced(ob, did);
     }
     if (im) {
       ObjImageSym ds;
       ds.name = sn;
       ds.bind = (SymBind)bind;
       ds.kind = (SymKind)kind;
       ds.section = OBJ_SEC_NONE;
       ds.value = 0;
       ds.size = 0;
       ds.version = 0;
       if (i < nversym) {
         u16 v = rd_u16_le(versym + (u64)i * 2u);
         u32 ndx = (u32)(v & VERSYM_VERSION);
         if (!(v & VERSYM_HIDDEN) && ndx >= 2u && ndx <= verdef_max)
           ds.version = verdef_tbl[ndx];
       }
       obj_image_add_dynsym(im, &ds);
     }
   }
 
   obj_finalize(ob);
   return ob;
 }