Based on how the 3 floats all got stuck within NEDwaves_memlight, Phil thinks the issue is likely to be that some inputs cause it to run out of memory. Combined with our discovery that the code does not consistently check the that the return value of calloc_replacement is not null before using it, this could lead to stack corruption, which would match some of the symptoms we saw in stepping through the assembly.
There are two steps that would make sense for confirming this + hopefully point to better fixes:
- Try to reproduce this using the logged data from floats 190, 195, 196 (last file before Nov 2)
- Write a fuzzer to find other inputs that cause issues