OpenWrt arm_cortex-a9_vfpv3-d16 v1.13.12 release package crashes with SIGILL at startup

[millionart]

Operating system

Linux / OpenWrt

System version

OpenWrt 23.05.4 r24012-d8dd03c46f

DISTRIB_TARGET='mvebu/cortexa9'
DISTRIB_ARCH='arm_cortex-a9_vfpv3-d16'
Linux OpenWrt 5.15.162 armv7l GNU/Linux
Hardware: Marvell Armada 380/385 (Device Tree)
CPU: ARMv7 Processor rev 1 (v7l), CPU part 0xc09 (Cortex-A9)
Features: half thumb fastmult vfp edsp neon vfpv3 tls vfpd32

Installation type

Original sing-box Command Line / OpenWrt release package from GitHub Releases

Version

Failing release package:

sing-box_1.13.12_openwrt_arm_cortex-a9_vfpv3-d16.ipk

The unpacked binary also shows the same behavior as:

sing-box-1.13.12-linux-armv7-musl.tar.gz

The failing binary contains:

build GOARM=7
build tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_naive_outbound,badlinkname,tfogo_checklinkname0,with_musl

Description

The v1.13.12 OpenWrt package for arm_cortex-a9_vfpv3-d16 installs, but the binary crashes immediately with SIGILL: illegal instruction before printing version information.

This appears specific to the official OpenWrt/musl/naive-enabled release build for armv7. The same device can run an armv7 build from the same v1.13.12 source when built without CGO/naive.

Reproduction

On the OpenWrt device described above:

opkg install ./sing-box_1.13.12_openwrt_arm_cortex-a9_vfpv3-d16.ipk
/usr/bin/sing-box version

Expected: version information is printed.

Actual: immediate SIGILL.

Crash output

SIGILL: illegal instruction
PC=0x38d750c m=0 sigcode=1
instruction bytes: 0x13 0xf2 0x33 0xe7 0x1 0x30 0x43 0xe2 0x4 0x0 0x53 0xe1 0x1 0x30 0x44 0xa2

runtime: g 0 gp=0x3a03fa0: unknown pc 0x38d750c
...
goroutine 1 gp=... m=0 mp=... [running]:
runtime.systemstack_switch()
    runtime/asm_arm.s:272 +0x4
runtime.main()
    runtime/proc.go:173 +0x64
runtime.goexit({})
    runtime/asm_arm.s:877 +0x4

trap    0x6
pc      0x38d750c
cpsr    0x80000010
fault   0x0

Additional validation

A locally built v1.13.12 binary from tag v1.13.12 runs successfully on the same router when built as:

CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 \
  go build -trimpath \
  -tags "with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0,with_musl" \
  -ldflags "-X github.com/sagernet/sing-box/constant.Version=1.13.12 ... -s -w -buildid=" \
  ./cmd/sing-box

That binary prints:

sing-box version 1.13.12
Environment: go1.25.10 linux/arm
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0,with_musl
CGO: disabled

and passes:

sing-box check -c /tmp/etc/passwall/DNS.json

A previously working v1.12.22 arm build also runs on this device.

Suspected area

The release workflow maps arm_cortex-a9_vfpv3-d16 to the linux/arm GOARM=7 musl naive build output. Since the CGO-disabled v1.13.12 build works on the same CPU, the problem may be in the armv7 musl/CGO/naive release build chain rather than in sing-box core logic.

Could the OpenWrt arm_cortex-a9_vfpv3-d16 package be split to use a non-naive/CGO-disabled armv7 binary, or otherwise adjusted so the released package does not emit instructions unsupported by Cortex-A9 devices?