Fix two BPF verifier OOB rejections on strict/newer kernels

[jevansnyc]

Summary

On stricter/newer kernels claudefeed fails to load with BPF_VERIFIER_REJECTED (reproduced on Linux 6.12 arm64). The handle_execve program has two out-of-bounds accesses, both from the same root cause: a bound the compiler proves, but the verifier doesn't carry. More lenient kernels happened to accept them; stricter ones don't.

Note: yeet truncates the verifier log, which makes it look like the failure is in name_matches. Loading the object directly — sudo bpftool prog loadall claudefeed.bpf.o /sys/fs/bpf/t — gives the real, untruncated verdict, and the first failure is actually in read_cmdline.

Bug 1 — read_cmdline, OOB write

592: call bpf_probe_read_user_str
invalid access to memory, mem_size=848 off=844 size=256
R1 max value is outside of the allowed memory range

The ARGSIZE write to &e->cmdline[sz] overflows the event record. The sz > ARGS_CEIL break keeps sz <= ARGS_CEIL, but the compiler folds the resulting clamp away as redundant, and the verifier — which doesn't carry that bound through the unrolled accumulation — sees the offset reach 512.

Fix: clamp the offset behind barrier_var() so the optimizer can't prove the clamp redundant, leaving the verifier a register it can bound.

Bug 2 — name_matches, OOB read

invalid access to map value, value_size=20 off=20 size=1
R0 min value is outside of the allowed memory range

needle_len lives in .data and is verifier-unbounded. The compiler trusts the nl <= NEEDLE_LEN guard and drops the & (NEEDLE_LEN-1) index mask, while the verifier lets j run past NEEDLE_LEN via the j >= nl exit — reading past the 16-byte needle.

Fix: constant trip count with no data-dependent break, so clang unrolls to NEEDLE_LEN iterations with compile-time-constant indices; gate each compare with j < nl to preserve early-mismatch semantics.

Testing

• bpftool prog loadall -> all 5 programs (handle_execve, handle_exit, handle_openat, handle_tcp_connect, handle_inet_listen) load.
• yeet run . -- --secs=8 on 6.12 arm64 -> streams exec/open/conn/listen events; no rejection.
• Both changes are behavior-preserving.