## Host environment - Operating system: Kali GNU/Linux 2026.3 - OS/kernel version: Linux kali 7.1.5+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.1.5-1kali1 (2026-07-29) x86_64 GNU/Linux - Architecture: x86_64 - QEMU flavor: qemu-aarch64 - QEMU version: 11.1.50 (v11.1.0-2514-g023efbee5c) - QEMU command line: ``` $ qemu-aarch64 ./poc ``` ## Emulated/Virtualized environment - Operating system: Does not matter - OS/kernel version: Does not matter - Architecture: AArch64 ## Description of problem When an AArch64 core attempts to fetch code using an unaligned PC value, it should raise a PC Alignment exception, which should then passed to the guest program as `SIGBUS` by qemu-aarch64. Although QEMU does that, there is a case when it passes `SIGSEGV` instead: when PC points to unmapped memory. ## Steps to reproduce 1. Compile the following code: ``` .globl _start .section .text _start: mov x30, #1 ret ``` ```bash $ clang -o aarch64_unaligned_ret aarch64_unaligned_ret.s -target aarch64-linux-gnu -nostdlib -static ``` 2. Start qemu-aarch64: ```bash $ ./qemu-aarch64 ./aarch64_unaligned_ret qemu: uncaught target signal 11 (Segmentation fault) - core dumped zsh: segmentation fault ./qemu-aarch64 ./aarch64_unaligned_ret $ ``` The real hardware (SM-M215F) gives the following results: ``` ~ $ objdump -d unaligned_ret unaligned_ret: file format elf64-littleaarch64 Disassembly of section .text: 0000000000210158 <_start>: 210158: d280003e mov x30, #0x1 // =1 21015c: d65f03c0 ret ~ $ taskset -c 0 ./unaligned_ret Bus error taskset -c 0 ./unaligned_ret ~ $ taskset -c 4 ./unaligned_ret Bus error taskset -c 4 ./unaligned_ret ~ $ uname -a Linux localhost 4.14.113-25741605 #1 SMP PREEMPT Thu Nov 30 15:39:46 KST 2023 aarch64 Android ~ $ cat /proc/cpuinfo processor : 0 BogoMIPS : 52.00 Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid CPU implementer : 0x41 CPU architecture: 8 CPU variant : 0x0 CPU part : 0xd03 CPU revision : 4 processor : 1 BogoMIPS : 52.00 Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid CPU implementer : 0x41 CPU architecture: 8 CPU variant : 0x0 CPU part : 0xd03 CPU revision : 4 processor : 2 BogoMIPS : 52.00 Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid CPU implementer : 0x41 CPU architecture: 8 CPU variant : 0x0 CPU part : 0xd03 CPU revision : 4 processor : 3 BogoMIPS : 52.00 Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid CPU implementer : 0x41 CPU architecture: 8 CPU variant : 0x0 CPU part : 0xd03 CPU revision : 4 processor : 4 BogoMIPS : 52.00 Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid CPU implementer : 0x41 CPU architecture: 8 CPU variant : 0x0 CPU part : 0xd09 CPU revision : 2 processor : 5 BogoMIPS : 52.00 Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid CPU implementer : 0x41 CPU architecture: 8 CPU variant : 0x0 CPU part : 0xd09 CPU revision : 2 processor : 6 BogoMIPS : 52.00 Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid CPU implementer : 0x41 CPU architecture: 8 CPU variant : 0x0 CPU part : 0xd09 CPU revision : 2 processor : 7 BogoMIPS : 52.00 Features : fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid CPU implementer : 0x41 CPU architecture: 8 CPU variant : 0x0 CPU part : 0xd09 CPU revision : 2 ~ $ gdb ./unaligned_ret -q Reading symbols from ./unaligned_ret... (No debugging symbols found in ./unaligned_ret) (gdb) set disassemble-next-line on (gdb) br _start Breakpoint 1 at 0x21015c (gdb) r Starting program: /data/data/com.termux/files/home/unaligned_ret [Thread debugging using libthread_db enabled] Using host libthread_db library "/data/data/com.termux/files/usr/lib/libthread_db.so". Breakpoint 1, 0x000000000021015c in _start () => 0x000000000021015c <_start+4>: d65f03c0 ret (gdb) info r x30 x30 0x1 1 (gdb) si 0x0000000000000001 in ?? () => 0x0000000000000001: ❌️ Cannot access memory at address 0x1 (gdb) info r pc pc 0x1 0x1 (gdb) si Program received signal SIGBUS, Bus error. 0x0000000000000001 in ?? () => 0x0000000000000001: ❌️ Cannot access memory at address 0x1 (gdb) info r pc pc 0x1 0x1 (gdb) ```