fix(targets): refuse ambiguous slice and file mappings

src/artifacts/pyinstaller/MarshalSubset.test.ts

@@ -20,11 +20,6 @@ it("reads a Python 3.9 reference-flagged PYZ table", () => {
   ]);
 });
 
-it("reads marshal one-byte string tags as Latin-1", () => {
-  for (const hex of ["6101000000e9", "4101000000e9", "7a01e9", "5a01e9"])
-    expect(readMarshalSubset(bytes(hex))).toEqual({ ok: true, value: "é" });
-});
-
 it("decodes CPython marshal Unicode with surrogatepass", () => {
   expect(
     readMarshalSubset(

src/artifacts/pyinstaller/MarshalSubset.ts

@@ -168,8 +168,14 @@ const readAsciiBytes = (
 ): Result<string, PyInstallerFailure> => {
   const bytes = readBytes(cursor, length);
   if (!bytes.ok) return bytes;
-  // These tags use CPython's one-byte Unicode constructor, not an ASCII check.
-  return ok(bytes.value.toString("latin1"));
+  if (bytes.value.some((byte) => byte > 0x7f))
+    return err(
+      pyInstallerFailure(
+        "format",
+        "PYZ marshal ASCII string contains a non-ASCII byte",
+      ),
+    );
+  return ok(bytes.value.toString("ascii"));
 };
 
 const readUtf8 = (

src/domain/binaryTarget.ts

@@ -1,5 +1,9 @@
+import {
+  resolveMappedFileOffset,
+  type FileMapping,
+  type ZeroFillMapping,
+} from "./virtualFileMapping.js";
 import type {
-  BinaryArchitecture,
   ElfFamilyMetadata,
   HeaderArchitecture,
   MipsElfMetadata,
@@ -271,9 +275,14 @@ const parseFatMachO = (
   // family declared more than once, such as arm64 and arm64e, has no
   // provider-neutral choice and is not selected.
   const preferred = fatHostArchitecture(host);
-  const hostSlice = declarations.find(
+  const hostSlices = declarations.filter(
     ({ architecture }) => architecture === preferred,
   );
+  if (hostSlices.length > 1)
+    return err(
+      `FAT binary declares several ${preferred} slices; no slice was selected`,
+    );
+  const hostSlice = hostSlices[0];
   const unambiguous = declarations.filter(
     ({ architecture }) =>
       declarations.filter((other) => other.architecture === architecture)
@@ -604,28 +613,37 @@ export const peRvaToFileOffset = (
   sizeOfHeaders: number,
   size = 1,
 ): number | undefined => {
-  if (rva < sizeOfHeaders && size <= sizeOfHeaders - rva) return rva;
-  for (let i = 0; i < numberOfSections; i++) {
-    const offset = i * 40;
+  const mappings: FileMapping[] = [
+    { address: 0n, offset: 0, size: sizeOfHeaders },
+  ];
+  const zeroFills: ZeroFillMapping[] = [];
+  for (let index = 0; index < numberOfSections; index += 1) {
+    const offset = index * 40;
     const parsed = readPeSectionHeader(
       sectionTable.subarray(offset, offset + 40),
     );
-    if (!parsed.ok) break;
-    const {
-      virtual_address: virtualAddress,
-      raw_size: sizeOfRawData,
-      offset: pointerToRawData,
-    } = parsed.value;
-    if (
-      pointerToRawData > 0 &&
-      rva >= virtualAddress &&
-      rva - virtualAddress < sizeOfRawData &&
-      size <= sizeOfRawData - (rva - virtualAddress)
-    ) {
-      return pointerToRawData + (rva - virtualAddress);
-    }
+    if (!parsed.ok) return undefined;
+    const section = parsed.value;
+    const address = BigInt(section.virtual_address);
+    if (section.raw_size > 0)
+      mappings.push({
+        address,
+        offset: section.offset,
+        size: section.raw_size,
+      });
+    if (section.virtual_size > section.raw_size)
+      zeroFills.push({
+        address: address + BigInt(section.raw_size),
+        size: BigInt(section.virtual_size - section.raw_size),
+      });
   }
-  return undefined;
+  const mapped = resolveMappedFileOffset(
+    mappings,
+    BigInt(rva),
+    size,
+    zeroFills,
+  );
+  return mapped.ok ? mapped.value : undefined;
 };
 
 /** CodeView RVA admission uses the same bounded prefix as target file reads. */

src/domain/virtualFileMapping.ts

@@ -0,0 +1,101 @@
+import { err, ok, type Result } from "./result.js";
+
+/** One file-backed virtual range; addresses stay exact until mapped to file offsets. */
+export interface FileMapping {
+  readonly address: bigint;
+  readonly offset: number;
+  readonly size: number;
+}
+
+/** Declared zero-initialized virtual memory with no corresponding file bytes. */
+export interface ZeroFillMapping {
+  readonly address: bigint;
+  readonly size: bigint;
+}
+
+/** Why a declared virtual span does not establish one contiguous file span. */
+export interface VirtualFileMappingFailure {
+  readonly reason: "invalid-size" | "unmapped" | "ambiguous";
+  readonly message: string;
+}
+
+/** Map a physically contiguous virtual span across consistent adjacent ranges. */
+export const resolveMappedFileOffset = (
+  mappings: readonly FileMapping[],
+  address: bigint,
+  size: number,
+  zeroFills: readonly ZeroFillMapping[] = [],
+): Result<number, VirtualFileMappingFailure> => {
+  if (!Number.isSafeInteger(size) || size < 0)
+    return err({
+      reason: "invalid-size",
+      message: "Virtual span size is invalid",
+    });
+  const end = address + BigInt(size);
+  let found: number | undefined;
+  const covered: { start: bigint; end: bigint }[] = [];
+  let whollyCovered = size === 0;
+  for (const mapping of mappings) {
+    const mappingEnd = mapping.address + BigInt(mapping.size);
+    const start = address > mapping.address ? address : mapping.address;
+    const overlapEnd = end < mappingEnd ? end : mappingEnd;
+    if (
+      size === 0
+        ? address < mapping.address || address > mappingEnd
+        : start >= overlapEnd
+    )
+      continue;
+    const origin = mapping.offset + Number(address - mapping.address);
+    if (found !== undefined && found !== origin)
+      return err({
+        reason: "ambiguous",
+        message: "Virtual span has ambiguous or noncontiguous file mappings",
+      });
+    found = origin;
+    if (start === address && overlapEnd === end) whollyCovered = true;
+    else if (!whollyCovered) covered.push({ start, end: overlapEnd });
+  }
+  if (found === undefined)
+    return err({
+      reason: "unmapped",
+      message: "Virtual address or string range is not file mapped",
+    });
+  if (!whollyCovered) {
+    covered.sort((left, right) =>
+      left.start < right.start ? -1 : left.start > right.start ? 1 : 0,
+    );
+    let cursor = address;
+    for (const span of covered) {
+      if (span.start > cursor)
+        return err({
+          reason: "unmapped",
+          message: "Virtual address or string range is not file mapped",
+        });
+      if (span.end > cursor) cursor = span.end;
+    }
+    if (cursor < end)
+      return err({
+        reason: "unmapped",
+        message: "Virtual address or string range is not file mapped",
+      });
+  }
+  for (const zeroFill of zeroFills) {
+    if (spansOverlap(address, BigInt(size), zeroFill.address, zeroFill.size))
+      return err({
+        reason: "ambiguous",
+        message: "Virtual address has ambiguous file and zero-fill mappings",
+      });
+  }
+  return ok(found);
+};
+
+const spansOverlap = (
+  address: bigint,
+  size: bigint,
+  otherAddress: bigint,
+  otherSize: bigint,
+): boolean =>
+  size > 0n &&
+  otherSize > 0n &&
+  address < otherAddress + otherSize &&
+  otherAddress < address + size;

src/go/GoBinaryImage.ts

@@ -1,3 +1,7 @@
+import type {
+  FileMapping,
+  ZeroFillMapping,
+} from "../domain/virtualFileMapping.js";
 import {
   BinaryFormatFailure,
   BinaryResourceFailure,
@@ -6,8 +10,6 @@ import {
   imageFileMappings,
   isZeroFilledSpan,
   type BinaryContainer,
-  type FileMapping,
-  type ZeroFillMapping,
 } from "../native/metadata/BinaryContainer.js";
 import { readBinaryContainer } from "../native/metadata/readBinaryContainer.js";
 import {

src/go/GoBuildInfoSearch.ts

@@ -1,9 +1,9 @@
+import type { FileMapping } from "../domain/virtualFileMapping.js";
 import {
   BinaryFormatFailure,
   BinaryReader,
   mappedFileOffset,
   type BinaryContainer,
-  type FileMapping,
 } from "../native/metadata/BinaryContainer.js";
 
 export interface GoBuildInfoSearchRange extends FileMapping {

src/go/GoStringLiterals.test.ts

@@ -1,8 +1,8 @@
+import type { FileMapping } from "../domain/virtualFileMapping.js";
 import { expect, it } from "vitest";
 import { GO_ANALYSIS_BUDGET_DEFAULTS } from "../domain/go/goBinary.js";
 import type {
   BinaryContainer,
-  FileMapping,
   ImageSection,
   LoadRegion,
 } from "../native/metadata/BinaryContainer.js";

src/go/GoStringLiterals.ts

@@ -1,3 +1,4 @@
+import type { FileMapping } from "../domain/virtualFileMapping.js";
 import { isUtf8 } from "node:buffer";
 import {
   GO_ANALYSIS_BUDGET_DEFAULTS,
@@ -11,7 +12,6 @@ import {
   createFileMappingIndex,
   imageFileMappings,
   type BinaryContainer,
-  type FileMapping,
   type FileMappingIndex,
   type LoadRegion,
 } from "../native/metadata/BinaryContainer.js";

src/il2cpp/ElfRelocations.ts

@@ -1,12 +1,12 @@
+import type {
+  FileMapping,
+  ZeroFillMapping,
+} from "../domain/virtualFileMapping.js";
 import {
   readElfRelocationWritesSteps,
   ElfPointerRelocationFailure,
 } from "../native/metadata/ElfPointerRelocations.js";
-import type {
-  BinaryContainer,
-  FileMapping,
-  ZeroFillMapping,
-} from "../native/metadata/BinaryContainer.js";
+import type { BinaryContainer } from "../native/metadata/BinaryContainer.js";
 import { Il2cppBinaryFormatFailure } from "./Il2cppBinaryFormat.js";
 
 /** Materialize the shared loader facts only for IL2CPP's existing private reader. */

src/native/AppleMachoSelection.ts

@@ -1,3 +1,7 @@
+import type {
+  FileMapping,
+  ZeroFillMapping,
+} from "../domain/virtualFileMapping.js";
 import {
   machoDependencyCommand,
   readMachoDylibCommandFacts,
@@ -15,8 +19,6 @@ import { createHash } from "node:crypto";
 import {
   BinaryFormatFailure,
   createFileMappingIndex,
-  type ZeroFillMapping,
-  type FileMapping,
 } from "./metadata/BinaryContainer.js";
 
 import type { FixupCommands } from "./AppleMachoFixups.js";

src/native/metadata/BinaryContainer.test.ts

@@ -1,3 +1,7 @@
+import type {
+  FileMapping,
+  ZeroFillMapping,
+} from "../../domain/virtualFileMapping.js";
 import { readBinaryContainer } from "./readBinaryContainer.js";
 import { expect, it } from "vitest";
 import {
@@ -8,8 +12,6 @@ import {
   mappedFileOffset,
   readMappedCString,
   type BinaryContainer,
-  type FileMapping,
-  type ZeroFillMapping,
 } from "./BinaryContainer.js";
 
 it("distinguishes a mapped string read allowance from malformed bytes", () => {

src/native/metadata/BinaryContainer.ts

@@ -1,3 +1,8 @@
+import {
+  resolveMappedFileOffset,
+  type FileMapping,
+  type ZeroFillMapping,
+} from "../../domain/virtualFileMapping.js";
 import type { PeDataDirectory } from "../../domain/peOptionalHeader.js";
 
 /** Distinguish corrupt recognized binaries from containers outside parser coverage. */
@@ -45,19 +50,6 @@ export class BinaryStringReadLimitFailure extends BinaryFormatFailure {
   }
 }
 
-/** One file-backed virtual range; addresses stay exact until mapped to file offsets. */
-export interface FileMapping {
-  readonly address: bigint;
-  readonly offset: number;
-  readonly size: number;
-}
-
-/** Declared zero-initialized virtual memory with no corresponding file bytes. */
-export interface ZeroFillMapping {
-  readonly address: bigint;
-  readonly size: bigint;
-}
-
 /** Native loader region facts; language-specific fallback selection belongs to consumers. */
 export interface LoadRegion {
   readonly mapping: FileMapping;
@@ -264,71 +256,19 @@ export const declaredFileRange = (
   };
 };
 
-/** Map a physically contiguous virtual span across consistent adjacent ranges. */
+/** Translate the domain mapping result into native parser failure classes. */
 export const mappedFileOffset = (
   mappings: readonly FileMapping[],
   address: bigint,
   size: number,
   zeroFills: readonly ZeroFillMapping[] = [],
 ): number => {
-  if (!Number.isSafeInteger(size) || size < 0)
-    throw new BinaryFormatFailure("malformed", "Virtual span size is invalid");
-  const end = address + BigInt(size);
-  let found: number | undefined;
-  const covered: { start: bigint; end: bigint }[] = [];
-  let whollyCovered = size === 0;
-  for (const mapping of mappings) {
-    const mappingEnd = mapping.address + BigInt(mapping.size);
-    const start = address > mapping.address ? address : mapping.address;
-    const overlapEnd = end < mappingEnd ? end : mappingEnd;
-    if (
-      size === 0
-        ? address < mapping.address || address > mappingEnd
-        : start >= overlapEnd
-    )
-      continue;
-    const origin = mapping.offset + Number(address - mapping.address);
-    if (found !== undefined && found !== origin)
-      throw new BinaryMappingFailure(
-        "ambiguous",
-        "Virtual span has ambiguous or noncontiguous file mappings",
-      );
-    found = origin;
-    if (start === address && overlapEnd === end) whollyCovered = true;
-    else if (!whollyCovered) covered.push({ start, end: overlapEnd });
-  }
-  if (found === undefined)
-    throw new BinaryMappingFailure(
-      "unmapped",
-      "Virtual address or string range is not file mapped",
-    );
-  if (!whollyCovered) {
-    covered.sort((left, right) =>
-      left.start < right.start ? -1 : left.start > right.start ? 1 : 0,
-    );
-    let cursor = address;
-    for (const span of covered) {
-      if (span.start > cursor)
-        throw new BinaryMappingFailure(
-          "unmapped",
-          "Virtual address or string range is not file mapped",
-        );
-      if (span.end > cursor) cursor = span.end;
-    }
-    if (cursor < end)
-      throw new BinaryMappingFailure(
-        "unmapped",
-        "Virtual address or string range is not file mapped",
-      );
-  }
-  for (const zeroFill of zeroFills) {
-    if (spansOverlap(address, BigInt(size), zeroFill.address, zeroFill.size))
-      throw new BinaryMappingFailure(
-        "ambiguous",
-        "Virtual address has ambiguous file and zero-fill mappings",
-      );
-  }
-  return found;
+  const mapped = resolveMappedFileOffset(mappings, address, size, zeroFills);
+  if (mapped.ok) return mapped.value;
+  const { reason, message } = mapped.error;
+  if (reason === "invalid-size")
+    throw new BinaryFormatFailure("malformed", message);
+  throw new BinaryMappingFailure(reason, message);
 };
 
 /** Index of the last sorted value at or below `value`, or -1. */

src/native/metadata/ElfImage.ts

@@ -1,3 +1,7 @@
+import type {
+  FileMapping,
+  ZeroFillMapping,
+} from "../../domain/virtualFileMapping.js";
 import { admitElfLoadSegment } from "../../domain/elfProgramHeader.js";
 import {
   declaredFileRange,
@@ -5,10 +9,8 @@ import {
   BinaryReader,
   type BinaryContainer,
   type ElfDynamicSegment,
-  type FileMapping,
   type ImageSection,
   type LoadRegion,
-  type ZeroFillMapping,
 } from "./BinaryContainer.js";
 import { elfArchitecture } from "../../domain/elfFixedHeader.js";
 import { readElfDirectoryFromBuffer } from "./NativeSectionDirectory.js";

src/native/metadata/ElfPointerRelocations.ts

@@ -1,3 +1,7 @@
+import type {
+  FileMapping,
+  ZeroFillMapping,
+} from "../../domain/virtualFileMapping.js";
 import { readElfDynamicEntry } from "../../domain/elfDynamicEntry.js";
 import { readElfRelocationEntry } from "../../domain/elfRelocation.js";
 import {
@@ -5,8 +9,6 @@ import {
   createFileMappingIndex,
   isZeroFilledSpan,
   type ElfDynamicSegment,
-  type FileMapping,
-  type ZeroFillMapping,
 } from "./BinaryContainer.js";
 
 /** Shared loader interpretation; language adapters choose their public errors. */

src/native/metadata/MachoImage.ts

@@ -1,3 +1,7 @@
+import type {
+  FileMapping,
+  ZeroFillMapping,
+} from "../../domain/virtualFileMapping.js";
 import { decodeMachoFixedName } from "../AppleMachoNames.js";
 import {
   isMachoZeroFillSection,
@@ -13,10 +17,8 @@ import {
   BinaryFormatFailure,
   BinaryReader,
   type BinaryContainer,
-  type FileMapping,
   type ImageSection,
   type LoadRegion,
-  type ZeroFillMapping,
 } from "./BinaryContainer.js";
 import {
   MachoLoadCommandCursor,

src/native/metadata/PeImage.ts

@@ -1,3 +1,7 @@
+import type {
+  FileMapping,
+  ZeroFillMapping,
+} from "../../domain/virtualFileMapping.js";
 import { readPeCoffHeader } from "../../domain/peCoffHeader.js";
 import { readPeOptionalHeader } from "../../domain/peMachine.js";
 import { readPeSectionHeader } from "../../domain/peSectionHeader.js";
@@ -10,9 +14,7 @@ import {
   BinaryFormatFailure,
   BinaryReader,
   type BinaryContainer,
-  type FileMapping,
   type ImageSection,
-  type ZeroFillMapping,
 } from "./BinaryContainer.js";
 
 const peHeaderOffset = (reader: BinaryReader): number => {

src/python/PythonPycParser.test.ts

@@ -407,30 +407,6 @@ it("charges long digits to the string budget and keeps large previews bounded",
   );
 });
 
-it("reads marshal one-byte string tags as Latin-1 with Unicode identity", () => {
-  for (const tag of [0x61, 0x41, 0x7a, 0x5a]) {
-    const encoded = Buffer.concat([
-      Buffer.from([tag]),
-      tag === 0x61 || tag === 0x41 ? u32(1) : Buffer.from([1]),
-      Buffer.from([0xe9]),
-    ]);
-    const sameUnicode = marshalUnicode(Buffer.from("é", "utf8"));
-    const set = Buffer.concat([
-      Buffer.from([0x3c]),
-      u32(2),
-      encoded,
-      sameUnicode,
-    ]);
-    const report = root(parse(withConsts([encoded, set])));
-    expect(report.consts[0]).toMatchObject({
-      kind: "str",
-      value: "é",
-      bytes: 1,
-    });
-    expect(report.consts[1]).toEqual({ kind: "set", length: 1 });
-  }
-});
-
 it("decodes marshal strings with CPython surrogatepass rules", () => {
   const report = parse(
     withConsts([marshalUnicode(Buffer.from("efbbbf73eda080efbbbf", "hex"))]),
@@ -1558,36 +1534,6 @@ it("hashes a long TYPE_REF tuple chain without recursing", () => {
   expect(pythonPycSchema.safeParse(report).success).toBe(true);
 });
 
-it("hashes shallow TYPE_REF code chains without using the JavaScript stack", () => {
-  const links = 3000;
-  const codes = Array.from({ length: links }, (_, index) =>
-    marshalCode("py311", {
-      flagged: true,
-      name: "f",
-      consts: index === 0 ? [Buffer.from([0x4e])] : [marshalRef(index - 1)],
-    }),
-  );
-  const bytes = Buffer.concat([
-    pythonPycHeader(3531),
-    marshalCode("py311", {
-      constsObject: Buffer.concat([
-        Buffer.from([0x28]),
-        u32(links + 1),
-        ...codes,
-        Buffer.from([0x3c]),
-        u32(1),
-        marshalRef(links - 1),
-      ]),
-    }),
-  ]);
-  const report = parseWith(bytes, { max_objects: 65_536 });
-  expect(root(report).consts.at(-1)).toEqual({ kind: "set", length: 1 });
-  expect(report.coverage).toMatchObject({
-    status: "complete",
-    code_objects: links + 1,
-  });
-});
-
 it("rejects code CPython treats as corrupt instead of complete coverage", () => {
   const file = (
     layout: "py37" | "py38" | "py311",

src/python/PythonPycParser.ts

@@ -332,7 +332,7 @@ class MarshalReader {
   readonly #codeKeys = new WeakMap<CodeNode, string>();
   readonly #codeIdentities = new WeakMap<CodeNode, number>();
   readonly #codeEquality = new WeakMap<CodeNode, CodeEquality>();
-  /** Completed Python hashability checks per code object. */
+  /** Python hashability per code object. False while that check is in progress. */
   readonly #codeHashable = new WeakMap<CodeNode, boolean>();
   /** Tuples whose items are still being read; CPython cannot hash them yet. */
   readonly #readingTuples = new WeakSet<MarshalValue>();
@@ -436,19 +436,13 @@ class MarshalReader {
         };
       case TYPE_INTERNED:
       case TYPE_UNICODE:
-        return this.string(
-          this.nonNegativeInt32("Marshal string length"),
-          "utf8",
-        );
+        return this.utf8(this.nonNegativeInt32("Marshal string length"), false);
       case TYPE_ASCII:
       case TYPE_ASCII_INTERNED:
-        return this.string(
-          this.nonNegativeInt32("Marshal string length"),
-          "latin1",
-        );
+        return this.utf8(this.nonNegativeInt32("Marshal string length"), true);
       case TYPE_SHORT_ASCII:
       case TYPE_SHORT_ASCII_INTERNED:
-        return this.string(this.u8(), "latin1");
+        return this.utf8(this.u8(), true);
       case TYPE_TUPLE:
         return this.sequenceValue(
           "tuple",
@@ -1315,70 +1309,13 @@ class MarshalReader {
   #isCodeHashable(node: CodeNode): boolean {
     const known = this.#codeHashable.get(node);
     if (known !== undefined) return known;
-    const frames: { value: MarshalValue; finish: boolean }[] = [
-      { value: { kind: "code", value: node }, finish: false },
-    ];
-    const gray = new Set<MarshalValue | CodeNode>();
-    const complete = new Set<MarshalValue>();
-    const reject = (): false => {
-      this.#codeHashable.set(node, false);
-      return false;
-    };
-    while (frames.length > 0) {
-      this.#takeKeyStep();
-      const frame = frames.pop()!;
-      const value = frame.value;
-      const identity = value.kind === "code" ? value.value : value;
-      if (frame.finish) {
-        gray.delete(identity);
-        if (value.kind === "code") {
-          const material =
-            this.#codeEquality.get(value.value) ??
-            malformed("Code object is missing equality material.");
-          // Child code checks are now complete, so the existing tuple key
-          // walker preserves its equality and expansion budgets without recursion.
-          const hashable =
-            this.#equalityKey(material.constsTuple, "hash") !== null;
-          this.#codeHashable.set(value.value, hashable);
-          if (!hashable) return reject();
-        } else complete.add(value);
-        continue;
-      }
-      if (value.kind === "code") {
-        const cached = this.#codeHashable.get(value.value);
-        if (cached === false) return reject();
-        if (cached === true) continue;
-      } else {
-        const cached = this.#keyCache.get(value);
-        if (cached === null) return reject();
-        if (cached !== undefined || complete.has(value)) continue;
-      }
-      if (
-        gray.has(identity) ||
-        this.#readingTuples.has(value) ||
-        value.kind === "list" ||
-        value.kind === "set" ||
-        value.kind === "dict" ||
-        value.kind === "null"
-      )
-        return reject();
-      const children =
-        value.kind === "code"
-          ? [
-              (
-                this.#codeEquality.get(value.value) ??
-                malformed("Code object is missing equality material.")
-              ).constsTuple,
-            ]
-          : value.kind === "tuple" || value.kind === "frozenset"
-            ? value.items
-            : [];
-      gray.add(identity);
-      frames.push({ value, finish: true });
-      for (let index = children.length - 1; index >= 0; index -= 1)
-        frames.push({ value: children[index]!, finish: false });
-    }
-    return true;
+    this.#codeHashable.set(node, false);
+    const material =
+      this.#codeEquality.get(node) ??
+      malformed("Code object is missing equality material.");
+    const hashable = this.#equalityKey(material.constsTuple, "hash") !== null;
+    this.#codeHashable.set(node, hashable);
+    return hashable;
   }
 
   #codeIdentity(node: CodeNode): number {
@@ -1555,20 +1492,17 @@ class MarshalReader {
     );
   }
 
-  string(length: number, encoding: "latin1" | "utf8"): MarshalValue {
+  utf8(length: number, ascii: boolean): MarshalValue {
     const bytes = this.blob(length);
-    if (encoding === "latin1") {
-      // CPython reads the ASCII-tagged forms as one-byte Unicode, even when
-      // high bytes appear. Identity must agree with the UTF-8 string form.
-      const value = bytes.toString("latin1");
+    if (ascii) {
+      if (bytes.some((byte) => byte > 0x7f))
+        malformed("Marshal ASCII string contains a non-ASCII byte.");
       return {
         kind: "str",
-        value,
+        value: bytes.toString("latin1"),
         previewEnd: Math.min(length, PYTHON_PYC_CONST_PREVIEW_LIMIT),
         bytes: length,
-        raw: bytes.some((byte) => byte > 0x7f)
-          ? Buffer.from(value, "utf8")
-          : bytes,
+        raw: bytes,
       };
     }
     const decoded = decodeMarshalUtf8(bytes, PYTHON_PYC_CONST_PREVIEW_LIMIT);

tests/boundary/filesystem/binaryTarget.test.ts

@@ -178,6 +178,24 @@ it.each([{ cpus: [0x0100000c] }, { cpus: [0x01000007, 0x0100000c] }])(
   },
 );
 
+it("refuses ambiguous host subtypes even when a foreign family is selectable", async () => {
+  const directory = await createTestTempDirectory("rea-ambiguous-host-fat-");
+  const path = join(directory, "image");
+  const bytes = fat([0x0100000c, 0x0100000c, 0x01000007]);
+  bytes.writeUInt32BE(2, 8 + 20 + 4);
+  bytes.writeUInt32BE(2, bytes.readUInt32BE(8 + 20 + 8) + 8);
+  await writeFile(path, bytes);
+  expect(
+    await parseBinaryTarget(path, { hostArchitecture: "arm64" }),
+  ).toMatchObject({
+    ok: false,
+    error: {
+      _tag: "BinaryTargetError",
+      reason: expect.stringContaining("several arm64 slices"),
+    },
+  });
+});
+
 it("reads a sparse FAT slice header beyond the bounded prefix", async () => {
   const directory = await createTestTempDirectory("rea-sparse-fat-target-");
   const path = join(directory, "image");
@@ -217,11 +235,15 @@ it("reads the complete bounded 128-entry FAT64 table beyond the prefix", async (
     const table = Buffer.alloc(tableEnd);
     table.writeUInt32BE(0xcafebabf, 0);
     table.writeUInt32BE(entryCount, 4);
-    const thinHeader = machoImage({ cpu: CPU.arm64 }).subarray(0, 12);
     for (let index = 0; index < entryCount; index += 1) {
+      const cpuType = index === 0 ? CPU.arm64.type : 0x100 + index;
+      const thinHeader = Buffer.from(
+        machoImage({ cpu: CPU.arm64 }).subarray(0, 12),
+      );
+      thinHeader.writeUInt32LE(cpuType, 4);
       const entry = 8 + index * 32;
       const sliceOffset = tableEnd + index * sliceSize;
-      table.writeUInt32BE(CPU.arm64.type, entry);
+      table.writeUInt32BE(cpuType, entry);
       table.writeUInt32BE(CPU.arm64.subtype, entry + 4);
       table.writeBigUInt64BE(BigInt(sliceOffset), entry + 8);
       table.writeBigUInt64BE(BigInt(sliceSize), entry + 16);
@@ -1720,6 +1742,63 @@ it.each([
   },
 );
 
+it.each([
+  {
+    label: "identical file aliases",
+    virtualAddress: 0x1000,
+    rawOffset: 512,
+    rawSize: 512,
+    expected: "first.pdb",
+  },
+  {
+    label: "conflicting file aliases",
+    virtualAddress: 0x1000,
+    rawOffset: 768,
+    rawSize: 512,
+    expected: undefined,
+  },
+  {
+    label: "independent sections",
+    virtualAddress: 0x2000,
+    rawOffset: 768,
+    rawSize: 512,
+    expected: "first.pdb",
+  },
+  {
+    label: "zero-fill aliases",
+    virtualAddress: 0x1000,
+    rawOffset: 0,
+    rawSize: 0,
+    expected: undefined,
+  },
+])(
+  "preserves CodeView mapping certainty for $label",
+  async ({ virtualAddress, rawOffset, rawSize, expected }) => {
+    const directory = await createTestTempDirectory("rea-codeview-mapping-");
+    const path = join(directory, "symbols.exe");
+    const bytes = Buffer.alloc(1280);
+    pe(0x8664, 64, 0x0002, false, { pdbPath: "first.pdb" }).copy(bytes);
+    bytes.writeUInt16LE(2, 64 + 6);
+    const sectionTable = 64 + 24 + 240;
+    bytes.copy(bytes, sectionTable + 40, sectionTable, sectionTable + 40);
+    bytes.writeUInt32LE(virtualAddress, sectionTable + 40 + 12);
+    bytes.writeUInt32LE(rawOffset, sectionTable + 40 + 20);
+    bytes.writeUInt32LE(rawSize, sectionTable + 40 + 16);
+    bytes.copy(bytes, 768, 512, 600);
+    bytes.writeUInt32LE(796, 768 + 24);
+    bytes.write("other.pdb", 796 + 24);
+    await writeFile(path, bytes);
+    const resolved = await parseBinaryTarget(path);
+    if (!resolved.ok) throw resolved.error;
+    const buffered = parseExecutableHeader(bytes, "x64");
+    if (!buffered.ok) throw new Error(buffered.error);
+    for (const metadata of [resolved.value, buffered.value])
+      expect(metadata.format === "pe" ? metadata.codeView?.pdbPath : null).toBe(
+        expected,
+      );
+  },
+);
+
 describe("binary target I/O: PE CodeView header ranges", () => {
   it.each(["RSDS", "NB10"] as const)(
     "reads bounded %s header debug records and rejects unfinished names",