23l: DR exec-watch verified working end-to-end by micro-test on this kernel (SIGTRAP+DR6 correct); contradiction isolated to process/thread targeting in tracer, single remaining hypothesis documented with debug protocol

scripts/fnexec.py

@@ -89,7 +89,9 @@ def main():
         time.sleep(0.001)
     pt(PTRACE_POKEUSER, host, DR_BASE + 0, 0x1802A24C0)
     pt(PTRACE_POKEUSER, host, DR_BASE + 8, 0x1802FA420)
-    pt(PTRACE_POKEUSER, host, DR7_OFF, 0x3)
+    pt(PTRACE_POKEUSER, host, DR_BASE + 16, 0x180535A70)
+    pt(PTRACE_POKEUSER, host, DR_BASE + 24, 0x18052D650)
+    pt(PTRACE_POKEUSER, host, DR7_OFF, 0xF)
     ok0 = pt(PTRACE_PEEKUSER, host, DR7_OFF)
     print('early arm dr7=%#x' % (ok0 or 0), flush=True)
     pt(PTRACE_CONT, host, 0, 0)
@@ -168,7 +170,12 @@ def main():
             if pt(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs)) is None:
                 continue
             rip = regs.rip - (1 if False else 0)
-            if rip not in (0x180529FE0, 0x18052B550, 0x1802A24C0, 0x1802FA420):
+            if pid not in armed:
+                seized.add(pid)
+                if arm(pid):
+                    armed.add(pid)
+                # re-read regs after arming? DR change does not touch GPRs
+            if rip not in (0x180529FE0, 0x18052B550, 0x1802A24C0, 0x1802FA420, 0x180535A70, 0x18052D650):
                 pt(PTRACE_CONT, pid, 0, 0)
                 continue
             if rip == 0x180529FE0:
@@ -176,7 +183,7 @@ def main():
             elif rip == 0x18052B550:
                 n1 += 1
             rec = dict(which='design' if rip in (0x1802A24C0, 0x1802FA420)
-                       else ('529fe0' if hit529 else 'loop'),
+                       else ('529fe0' if rip == 0x180529FE0 else 'loop'),
                        rip=rip, rcx=regs.rcx, rdx=regs.rdx,
                        cnt=regs.r8 & 0xffffffff,
                        t=round(time.time() - t0, 3), tid=pid)
@@ -202,6 +209,10 @@ def main():
             pt(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
             pt(PTRACE_CONT, pid, 0, 0)
         elif os.WIFSTOPPED(pid):
+            if pid not in armed and sig == signal.SIGTRAP:
+                seized.add(pid)
+                if arm(pid):
+                    armed.add(pid)
             pt(PTRACE_CONT, pid, 0, sig if 0 < sig < 32 else 0)
         if fresh_t is None and os.path.exists(wav) and os.path.getmtime(wav) > wt0:
             fresh_t = time.time() - t0