[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84663-en":3,"doc-seo-84663-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},84663,4810365810221,"Aurora","https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d",8,"Research & Report","Characterizing and Bridging the Diagnostic Gap in eBPF Verifier Rejections","eBPF enables running custom programs inside the Linux kernel, with a verifier proving safety along execution paths. When the verifier rejects a program, the error typically indicates where verification stopped rather than where the proof was lost, creating a diagnostic gap. An empirical study of 235 reproduced rejections quantifies the gap and shows high error ambiguity and eBPF-specific root causes. bpfix reconstructs proof establishment and loss from verifier logs and outputs Rust-like diagnostics. A 75-task LLM repair benchmark demonstrates that bpfix localization improves repair by 11–21 percentage points.","Characterizing and Bridging the Diagnostic Gap in  \neBPF Verifier Rejections  \nYusheng Zheng∗1,2 , Zhengjie Ji∗3, Weichen Tao∗4, Xiangyu Gao5 , Jianchang Su6 , Wei Zhang6 , Andi  \nQuinn 1 , Dan Williams3  \n1UC Santa Cruz 2 eunomia-bpf 3Virginia Tech 4Telecom Paris 5University of Washington 6University of  \nConnecticut  \narXiv :2607 .02748v 1 [ cs .OS] 2 Jul 2026  \nAbstract  \neBPF lets developers run custom programs inside the Linux kernel, where a verifier proves each program safe. However, when the verifier rejects a program, the unclear error makes repair challenging: the error reports where verification stopped, not where the program lost the proof theverifier required. To quantify this gap, we conduct an empirical study of 235 reproduced rejections, showing that 47% of rejections return only EINVAL, one error string maps to as many as nine distinct root causes, and 10 of the 12 root causes are eBPF-specific. Repair thus requires both domain knowledge and locating where the proof was lost, yet existing tools only help developers read the error. We present bpfix, which reconstructs where the required proof was established and where it was lost from the verifier log, and prints a Rust-like diagnostic. To evaluate bpfix and the ability ofLLMs to help repair, we construct a benchmark of 75 LLM repair tasks. Current models achieve 0–37% one-shot success with the raw log, and replacing the log with the bpfix localization improves repair by 11–21pp, suggesting that locating where the proof was lost is key to guiding repair. bpfix is available at [https://github.com/eunomia-bpf/bpfix](https://github.com/eunomia-bpf/bpfix).  \n1 Introduction  \neBPF lets developers run custom programs inside the Linux kernel for networking, security, and observability [1, 4] . To load a program, a developer writes it in C or Rust, compilesit to eBPF bytecode, and submits it to a verifier. The verifier proves the program safe by tracking abstract values along every execution path [5, 11] .  \nHowever, the unclear verifier rejection makes repair challenging. Figure 1 illustrates this diagnostic gap: a packet pointer that the program bounds-checks is rejected at a later load with R5 invalid mem access ‘scalar’, on a line the developer has no reason to suspect. Without a way to locate where the proof was lost, developers must rely on repeated trial and error [3] .  \nTo quantify this gap, we conduct an empirical study of 235 rejections reproduced from Stack Overflow, GitHub issues, fix commits, and kernel selftests. We find that 191 are program bugs spanning 12 root causes, while the other 44 reject correct source due to compiler optimizations that obscure  \n∗Equal contribution.  \npointer types, environment misconfiguration, or verifier limitations. Of the 12 root causes, 10 are eBPF-specific (e.g., packet bounds, dynptr lifetime), so repair requires domain knowledge beyond general programming. The terminal error provides little help: 47% of rejections return EINVAL, and one error string maps to as many as nine distinct root causes.  \nExisting tools do not close this gap. PrettyVerifier [14] and the BPF Verifier Visualizer [8] help developers read the error with regular expressions or visualizations, but neither locates where the proof was lost. Error Explainers in other domains like Rust walk a structure the checker builds, such as an AST or typing constraints [13, 22], but the eBPF verifier exposes no such artifact.  \nTo improve the diagnostic process, we introduce bpfix, which reconstructs where the required proof was established and where it was lost from the verifier log, and prints a Rustlike diagnostic (Figure 1) .  \nTo measure the ability of LLMs to fix verifier rejections, we construct bpfix-bench, a benchmark of 75 repair tasks. With the raw verifier log, current LLMs achieve only 0–37% one-shot repair across three models ranging from 3B to 27B parameters, showing that verifier rejections remain difficult even for capable models. To see whether be","cbCailTzPSFkBX3N","https://ap.wps.com/l/cbCailTzPSFkBX3N","pdf",642675,2,1,7,"English","en",105,"# Introduction\n# An Empirical Study of Verifier Rejections\n# bpfix and bpfix-bench","[{\"question\":\"What problem does the paper address in eBPF verifier rejections?\",\"answer\":\"The paper addresses the diagnostic gap where verifier errors show where verification stopped, not where the required proof was lost, making repairs difficult.\"},{\"question\":\"What does the empirical study of 235 rejections show?\",\"answer\":\"It finds that nearly half of rejections return only EINVAL, a single error string can correspond to multiple distinct root causes, and most root causes are specific to eBPF rather than general programming.\"},{\"question\":\"How does bpfix help developers repair rejected eBPF programs?\",\"answer\":\"bpfix reconstructs where the verifier-visible required proof was established and where it was lost from the verifier log, then prints a Rust-like diagnostic to guide repair.\"}]",1784197546,18,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"characterizing-and-bridging-the-diagnostic-gap-in-ebpf-verifier-rejections","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,47,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":20},"https://docshare.wps.com/document/","Document",{"item":48,"name":12,"@type":43,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/characterizing-and-bridging-the-diagnostic-gap-in-ebpf-verifier-rejections/84663/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-23","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the paper address in eBPF verifier rejections?","Question",{"text":75,"@type":76},"The paper addresses the diagnostic gap where verifier errors show where verification stopped, not where the required proof was lost, making repairs difficult.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What does the empirical study of 235 rejections show?",{"text":80,"@type":76},"It finds that nearly half of rejections return only EINVAL, a single error string can correspond to multiple distinct root causes, and most root causes are specific to eBPF rather than general programming.",{"name":82,"@type":73,"acceptedAnswer":83},"How does bpfix help developers repair rejected eBPF programs?",{"text":84,"@type":76},"bpfix reconstructs where the verifier-visible required proof was established and where it was lost from the verifier log, then prints a Rust-like diagnostic to guide repair.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,119,122,127,130,134],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":22,"doc_module":4,"doc_module_name":46,"category_name":116,"show_sort_weight":117,"slug":118},"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]