AI Trajectory

null

{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "check_max_stack_depth_subprog",
    "check_max_stack_depth"
  ],
  "Reasoning": "The patch modifies the BPF verifier to reject tail calls within any callback (not just exception callbacks). This is a functional change in the core BPF verifier logic that affects program validation and execution flow.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 06f397b5e30faaec3ba0f08f1e127f197ee36f63\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Jul 12 03:48:49 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c\nindex 03e2202cca13d5..3f6c8b8fc04d08 100644\n--- a/kernel/bpf/verifier.c\n+++ b/kernel/bpf/verifier.c\n@@ -5258,10 +5258,6 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,\n \t\tif (verifier_bug_if(sidx \u003c 0, env, \"callee not found at insn %d\", next_insn))\n \t\t\treturn -EFAULT;\n \t\tif (subprog[sidx].is_async_cb) {\n-\t\t\tif (subprog[sidx].has_tail_call) {\n-\t\t\t\tverifier_bug(env, \"subprog has tail_call and async cb\");\n-\t\t\t\treturn -EFAULT;\n-\t\t\t}\n \t\t\t/* async callbacks don't increase bpf prog stack size unless called directly */\n \t\t\tif (!bpf_pseudo_call(insn + i))\n \t\t\t\tcontinue;\n@@ -5302,8 +5298,8 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,\n \t */\n \tif (tail_call_reachable) {\n \t\tfor (tmp = idx; tmp \u003e= 0; tmp = dinfo[tmp].caller) {\n-\t\t\tif (subprog[tmp].is_exception_cb) {\n-\t\t\t\tverbose(env, \"cannot tail call within exception cb\\n\");\n+\t\t\tif (subprog[tmp].is_cb) {\n+\t\t\t\tverbose(env, \"cannot tail call within callback\\n\");\n \t\t\t\treturn -EINVAL;\n \t\t\t}\n \t\t\tif (subprog[tmp].stack_arg_cnt) {\ndiff --git a/tools/testing/selftests/bpf/prog_tests/tailcalls.c b/tools/testing/selftests/bpf/prog_tests/tailcalls.c\nindex a5a226d0104cd2..c66037162da5ae 100644\n--- a/tools/testing/selftests/bpf/prog_tests/tailcalls.c\n+++ b/tools/testing/selftests/bpf/prog_tests/tailcalls.c\n@@ -12,6 +12,7 @@\n #include \"tailcall_cgrp_storage_no_storage.skel.h\"\n #include \"tailcall_cgrp_storage.skel.h\"\n #include \"tailcall_sleepable.skel.h\"\n+#include \"tailcall_callback.skel.h\"\n \n /* test_tailcall_1 checks basic functionality by patching multiple locations\n  * in a single program for a single tail call slot with nop-\u003ejmp, jmp-\u003enop\n@@ -1901,6 +1902,11 @@ static void test_tailcall_sleepable(void)\n \ttailcall_sleepable__destroy(skel);\n }\n \n+static void test_tailcall_callback(void)\n+{\n+\tRUN_TESTS(tailcall_callback);\n+}\n+\n void test_tailcalls(void)\n {\n \tif (test__start_subtest(\"tailcall_1\"))\n@@ -1967,4 +1973,5 @@ void test_tailcalls(void)\n \t\ttest_tailcall_cgrp_storage_no_storage_leaf();\n \tif (test__start_subtest(\"tailcall_cgrp_storage_no_storage_bridge\"))\n \t\ttest_tailcall_cgrp_storage_no_storage_bridge();\n+\ttest_tailcall_callback();\n }\ndiff --git a/tools/testing/selftests/bpf/progs/tailcall_callback.c b/tools/testing/selftests/bpf/progs/tailcall_callback.c\nnew file mode 100644\nindex 00000000000000..504d8e7a69969e\n--- /dev/null\n+++ b/tools/testing/selftests/bpf/progs/tailcall_callback.c\n@@ -0,0 +1,129 @@\n+// SPDX-License-Identifier: GPL-2.0\n+#include \u003clinux/bpf.h\u003e\n+#include \u003cbpf/bpf_helpers.h\u003e\n+#include \"bpf_misc.h\"\n+#include \"bpf_test_utils.h\"\n+\n+int classifier_0(struct __sk_buff *skb);\n+int classifier_1(struct __sk_buff *skb);\n+\n+struct {\n+\t__uint(type, BPF_MAP_TYPE_PROG_ARRAY);\n+\t__uint(max_entries, 2);\n+\t__uint(key_size, sizeof(__u32));\n+\t__array(values, void (void));\n+} jmp_table SEC(\".maps\") = {\n+\t.values = {\n+\t\t[0] = (void *) \u0026classifier_0,\n+\t\t[1] = (void *) \u0026classifier_1,\n+\t},\n+};\n+\n+struct {\n+\t__uint(type, BPF_MAP_TYPE_ARRAY);\n+\t__uint(max_entries, 1);\n+\t__uint(key_size, sizeof(__u32));\n+\t__uint(value_size, sizeof(__u32));\n+} arraymap SEC(\".maps\");\n+\n+__auxiliary\n+SEC(\"tc\")\n+int classifier_0(struct __sk_buff *skb)\n+{\n+\treturn 0;\n+}\n+\n+static __noinline\n+int subprog_tail1(struct __sk_buff *skb)\n+{\n+\tint ret = 0;\n+\n+\tbpf_tail_call_static(skb, \u0026jmp_table, 1);\n+\tbarrier_var(ret);\n+\treturn ret;\n+}\n+\n+__auxiliary\n+SEC(\"tc\")\n+int classifier_1(struct __sk_buff *skb)\n+{\n+\tint ret;\n+\n+\tret = subprog_tail1(skb);\n+\t__sink(ret);\n+\treturn 0;\n+}\n+\n+static __noinline\n+int subprog_tail0(struct __sk_buff *skb)\n+{\n+\tint ret;\n+\n+\tret = subprog_tail1(skb);\n+\tbarrier_var(ret);\n+\treturn ret;\n+}\n+\n+static __noinline\n+int callback_loop_1(int index, void **cb_ctx)\n+{\n+\tint ret = 0;\n+\n+\tbpf_tail_call_static(*cb_ctx, \u0026jmp_table, 0);\n+\tbarrier_var(ret);\n+\treturn ret;\n+}\n+\n+static __noinline\n+int callback_loop_2(int index, void **cb_ctx)\n+{\n+\tint ret;\n+\n+\tret = subprog_tail1(*cb_ctx);\n+\tbarrier_var(ret);\n+\treturn ret ? 1 : 0;\n+}\n+\n+static __noinline\n+int callback_for_each(void *map, __u32 *key, __u64 *val, void **cb_ctx)\n+{\n+\tint ret;\n+\n+\tret = subprog_tail0(*cb_ctx);\n+\tbarrier_var(ret);\n+\treturn ret ? 1 : 0;\n+}\n+/* callback involving tail call directly is rejected */\n+SEC(\"tc\")\n+__failure __msg(\"callback unexpected regs 1\")\n+int tailcall_direct_callback(struct __sk_buff *skb)\n+{\n+\tclobber_regs_stack();\n+\n+\tbpf_loop(1, callback_loop_1, \u0026skb, 0);\n+\treturn 0;\n+}\n+\n+/* callback involving 1 subprog with tail call is rejected */\n+SEC(\"tc\")\n+__failure __msg(\"cannot tail call within callback\")\n+int tailcall_bpf2bpf_callback_1(struct __sk_buff *skb)\n+{\n+\tclobber_regs_stack();\n+\n+\tbpf_loop(1, callback_loop_2, \u0026skb, 0);\n+\treturn 0;\n+}\n+\n+/* callback involving 2 subprogs with tail call is rejected */\n+SEC(\"tc\")\n+__failure __msg(\"cannot tail call within callback\")\n+int tailcall_bpf2bpf_callback_2(struct __sk_buff *skb)\n+{\n+\tclobber_regs_stack();\n+\n+\tbpf_for_each_map_elem(\u0026arraymap, callback_for_each, \u0026skb, 0);\n+\treturn 0;\n+}\n+\n+char __license[] SEC(\"license\") = \"GPL\";\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "check_max_stack_depth_subprog",
    "check_max_stack_depth"
  ],
  "Reasoning": "The patch modifies the BPF verifier to reject tail calls within any callback (not just exception callbacks). This is a functional change in the core BPF verifier logic that affects program validation and execution flow.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 06f397b5e30faaec3ba0f08f1e127f197ee36f63
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Jul 12 03:48:49 2026 +0000

    syz-cluster: applied patch under review

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 03e2202cca13d5..3f6c8b8fc04d08 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5258,10 +5258,6 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
 		if (verifier_bug_if(sidx < 0, env, "callee not found at insn %d", next_insn))
 			return -EFAULT;
 		if (subprog[sidx].is_async_cb) {
-			if (subprog[sidx].has_tail_call) {
-				verifier_bug(env, "subprog has tail_call and async cb");
-				return -EFAULT;
-			}
 			/* async callbacks don't increase bpf prog stack size unless called directly */
 			if (!bpf_pseudo_call(insn + i))
 				continue;
@@ -5302,8 +5298,8 @@ static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,
 	 */
 	if (tail_call_reachable) {
 		for (tmp = idx; tmp >= 0; tmp = dinfo[tmp].caller) {
-			if (subprog[tmp].is_exception_cb) {
-				verbose(env, "cannot tail call within exception cb\n");
+			if (subprog[tmp].is_cb) {
+				verbose(env, "cannot tail call within callback\n");
 				return -EINVAL;
 			}
 			if (subprog[tmp].stack_arg_cnt) {
diff --git a/tools/testing/selftests/bpf/prog_tests/tailcalls.c b/tools/testing/selftests/bpf/prog_tests/tailcalls.c
index a5a226d0104cd2..c66037162da5ae 100644
--- a/tools/testing/selftests/bpf/prog_tests/tailcalls.c
+++ b/tools/testing/selftests/bpf/prog_tests/tailcalls.c
@@ -12,6 +12,7 @@
 #include "tailcall_cgrp_storage_no_storage.skel.h"
 #include "tailcall_cgrp_storage.skel.h"
 #include "tailcall_sleepable.skel.h"
+#include "tailcall_callback.skel.h"
 
 /* test_tailcall_1 checks basic functionality by patching multiple locations
  * in a single program for a single tail call slot with nop->jmp, jmp->nop
@@ -1901,6 +1902,11 @@ static void test_tailcall_sleepable(void)
 	tailcall_sleepable__destroy(skel);
 }
 
+static void test_tailcall_callback(void)
+{
+	RUN_TESTS(tailcall_callback);
+}
+
 void test_tailcalls(void)
 {
 	if (test__start_subtest("tailcall_1"))
@@ -1967,4 +1973,5 @@ void test_tailcalls(void)
 		test_tailcall_cgrp_storage_no_storage_leaf();
 	if (test__start_subtest("tailcall_cgrp_storage_no_storage_bridge"))
 		test_tailcall_cgrp_storage_no_storage_bridge();
+	test_tailcall_callback();
 }
diff --git a/tools/testing/selftests/bpf/progs/tailcall_callback.c b/tools/testing/selftests/bpf/progs/tailcall_callback.c
new file mode 100644
index 00000000000000..504d8e7a69969e
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/tailcall_callback.c
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_misc.h"
+#include "bpf_test_utils.h"
+
+int classifier_0(struct __sk_buff *skb);
+int classifier_1(struct __sk_buff *skb);
+
+struct {
+	__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
+	__uint(max_entries, 2);
+	__uint(key_size, sizeof(__u32));
+	__array(values, void (void));
+} jmp_table SEC(".maps") = {
+	.values = {
+		[0] = (void *) &classifier_0,
+		[1] = (void *) &classifier_1,
+	},
+};
+
+struct {
+	__uint(type, BPF_MAP_TYPE_ARRAY);
+	__uint(max_entries, 1);
+	__uint(key_size, sizeof(__u32));
+	__uint(value_size, sizeof(__u32));
+} arraymap SEC(".maps");
+
+__auxiliary
+SEC("tc")
+int classifier_0(struct __sk_buff *skb)
+{
+	return 0;
+}
+
+static __noinline
+int subprog_tail1(struct __sk_buff *skb)
+{
+	int ret = 0;
+
+	bpf_tail_call_static(skb, &jmp_table, 1);
+	barrier_var(ret);
+	return ret;
+}
+
+__auxiliary
+SEC("tc")
+int classifier_1(struct __sk_buff *skb)
+{
+	int ret;
+
+	ret = subprog_tail1(skb);
+	__sink(ret);
+	return 0;
+}
+
+static __noinline
+int subprog_tail0(struct __sk_buff *skb)
+{
+	int ret;
+
+	ret = subprog_tail1(skb);
+	barrier_var(ret);
+	return ret;
+}
+
+static __noinline
+int callback_loop_1(int index, void **cb_ctx)
+{
+	int ret = 0;
+
+	bpf_tail_call_static(*cb_ctx, &jmp_table, 0);
+	barrier_var(ret);
+	return ret;
+}
+
+static __noinline
+int callback_loop_2(int index, void **cb_ctx)
+{
+	int ret;
+
+	ret = subprog_tail1(*cb_ctx);
+	barrier_var(ret);
+	return ret ? 1 : 0;
+}
+
+static __noinline
+int callback_for_each(void *map, __u32 *key, __u64 *val, void **cb_ctx)
+{
+	int ret;
+
+	ret = subprog_tail0(*cb_ctx);
+	barrier_var(ret);
+	return ret ? 1 : 0;
+}
+/* callback involving tail call directly is rejected */
+SEC("tc")
+__failure __msg("callback unexpected regs 1")
+int tailcall_direct_callback(struct __sk_buff *skb)
+{
+	clobber_regs_stack();
+
+	bpf_loop(1, callback_loop_1, &skb, 0);
+	return 0;
+}
+
+/* callback involving 1 subprog with tail call is rejected */
+SEC("tc")
+__failure __msg("cannot tail call within callback")
+int tailcall_bpf2bpf_callback_1(struct __sk_buff *skb)
+{
+	clobber_regs_stack();
+
+	bpf_loop(1, callback_loop_2, &skb, 0);
+	return 0;
+}
+
+/* callback involving 2 subprogs with tail call is rejected */
+SEC("tc")
+__failure __msg("cannot tail call within callback")
+int tailcall_bpf2bpf_callback_2(struct __sk_buff *skb)
+{
+	clobber_regs_stack();
+
+	bpf_for_each_map_elem(&arraymap, callback_for_each, &skb, 0);
+	return 0;
+}
+
+char __license[] SEC("license") = "GPL";

gemini-3.1-pro-preview

null

null

							input: 3800
							output: 38
							thoughts: 214
						

**Analyzing a BPF Verifier Patch**

Okay, so I'm looking at this patch that tweaks `kernel/bpf/verifier.c`, specifically the `check_max_stack_depth_subprog` function. It seems there's been some crucial logic changed here. I see they've removed a check for `subprog[sidx].has_tail_call` within that `if (subprog[sidx].is_async_cb)` block. That's immediately interesting – I'll need to understand the implications of that removal. Then, there’s a change within the `tail_call_reachable` section. The conditional `if (subprog[tmp].is_exception_cb)` has been broadened to `if (subprog[tmp].is_cb)`. Hmm, so we're no longer just concerned with exception callbacks; *any* callback is now subject to this restriction.

This means the verifier will now reject tail calls from *any* callback function. Effectively, it's restricting the use of tail calls within callbacks. Looking at the error message change – from "cannot tail call within exception cb\n" to "cannot tail call within callback\n" – further confirms this. It’s a definite functional change to the BPF verifier. To understand the full impact, I need to see the context surrounding `check_max_stack_depth_subprog` and how callbacks are handled in general. Time to dive into the code and see what's what.

{
  "Expression": "check_max_stack_depth_subprog",
  "PathPrefix": "kernel/bpf/verifier.c"
}

{
  "Output": "kernel/bpf/verifier.c=5137=struct bpf_subprog_call_depth_info {\n--\nkernel/bpf/verifier.c-5146- */\nkernel/bpf/verifier.c:5147:static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,\nkernel/bpf/verifier.c-5148-\t\t\t\t\t struct bpf_subprog_call_depth_info *dinfo,\n--\nkernel/bpf/verifier.c=5340=static int check_max_stack_depth(struct bpf_verifier_env *env)\n--\nkernel/bpf/verifier.c-5372-\t\t\tpriv_stack_supported = !i \u0026\u0026 priv_stack_mode == PRIV_STACK_ADAPTIVE;\nkernel/bpf/verifier.c:5373:\t\t\tret = check_max_stack_depth_subprog(env, i, dinfo,\nkernel/bpf/verifier.c-5374-\t\t\t\t\tpriv_stack_supported);\n"
}

gemini-3.1-pro-preview

null

null

							input: 4640
							output: 35
							thoughts: 158
						

**My Initial Assessment of the BPF Verifier Patch**

Okay, so this patch is a functional modification to the BPF verifier, specifically within `kernel/bpf/verifier.c`. It's tweaking `check_max_stack_depth_subprog`, which in turn feeds into `check_max_stack_depth`. The core of the change seems to be preventing tail calls from occurring within callbacks, like those used in `bpf_loop` or `bpf_for_each_map_elem`. My immediate thought? This warrants serious fuzzing. A change this fundamental to the verification process is ripe for subtle bugs or unexpected interactions.

Time to identify the key focus areas for my fuzzing campaign. `check_max_stack_depth_subprog` immediately jumps out as a prime target, and of course, I'll need to look closely at `check_max_stack_depth` as well, given the direct relationship. I need to dig a little deeper, though. Are there other related functions, perhaps those directly interacting with the callbacks mentioned? That seems like the logical next step in scoping this for a targeted approach.

{
  "Expression": "check_max_stack_depth",
  "PathPrefix": "kernel/bpf/verifier.c"
}

{
  "Output": "kernel/bpf/verifier.c=5137=struct bpf_subprog_call_depth_info {\n--\nkernel/bpf/verifier.c-5146- */\nkernel/bpf/verifier.c:5147:static int check_max_stack_depth_subprog(struct bpf_verifier_env *env, int idx,\nkernel/bpf/verifier.c-5148-\t\t\t\t\t struct bpf_subprog_call_depth_info *dinfo,\n--\nkernel/bpf/verifier.c-5339-\nkernel/bpf/verifier.c:5340:static int check_max_stack_depth(struct bpf_verifier_env *env)\nkernel/bpf/verifier.c-5341-{\n--\nkernel/bpf/verifier.c-5372-\t\t\tpriv_stack_supported = !i \u0026\u0026 priv_stack_mode == PRIV_STACK_ADAPTIVE;\nkernel/bpf/verifier.c:5373:\t\t\tret = check_max_stack_depth_subprog(env, i, dinfo,\nkernel/bpf/verifier.c-5374-\t\t\t\t\tpriv_stack_supported);\n--\nkernel/bpf/verifier.c=20042=int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,\n--\nkernel/bpf/verifier.c-20231-\tif (ret == 0)\nkernel/bpf/verifier.c:20232:\t\tret = check_max_stack_depth(env);\nkernel/bpf/verifier.c-20233-\n"
}

gemini-3.1-pro-preview

null

null

							input: 5490
							output: 31
							thoughts: 54
						

Here's my take on the thought process, as if it were my own:

**Analyzing Stack Depth Constraints in BPF Programs**

Alright, let's zero in on those key function symbols, `check_max_stack_depth_subprog` and `check_max_stack_depth`. I need to figure out how the stack depth limits are being handled. First things first, I'll confirm that the BPF verifier is even enabled. That would be tied to `CONFIG_BPF_SYSCALL`, right? Gotta make sure that foundational piece is in place before I dive into the specifics of these stack depth checks. Then I can really dig into those symbols.

no matches

{
  "Expression": "config BPF_SYSCALL",
  "PathPrefix": "init/Kconfig"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 5733
							output: 27
							thoughts: 16
						

Okay, let's dive into this. Here's my thought process on this:

**Locating the Definition of `BPF_SYSCALL`**

Right, so I need to find out where `BPF_SYSCALL` is actually defined. It's a key element in understanding how this whole BPF system interacts with the kernel's system call interface, but I need to pinpoint the definition to fully grasp the mechanics and context. This is the starting point for understanding how this piece fits into the greater puzzle. Knowing the origin of this symbol will allow me to assess how it's being used, what data structures it might relate to, and ultimately, its role in the system. Let's start the hunt.

{
  "Expression": "config BPF_SYSCALL",
  "PathPrefix": ""
}

{
  "Output": "kernel/bpf/Kconfig=25=menu \"BPF subsystem\"\nkernel/bpf/Kconfig-26-\nkernel/bpf/Kconfig:27:config BPF_SYSCALL\nkernel/bpf/Kconfig-28-\tbool \"Enable bpf() system call\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 6013
							output: 103
							thoughts: 144
						

**My Assessment of the BPF Verifier Change**

Okay, so this is about the `BPF_SYSCALL` configuration, got it. The patch's core impact is that it's altering the BPF verifier to disallow tail calls within callbacks. That's a definite functional change in the verifier itself. Worth fuzzing this, absolutely. I'll need to focus my fuzzing efforts on the `check_max_stack_depth_subprog` and `check_max_stack_depth` symbols specifically, as those are likely where the new restrictions are implemented. I'll need to ensure `BPF_SYSCALL` is enabled for my tests, of course.

I'll quickly double-check if there are any other configs that might be relevant, just to be thorough. The tests themselves seem to be using `bpf_tail_call_static`, `bpf_loop`, and `bpf_for_each_map_elem`. Those are all pretty standard BPF features, nothing immediately concerning there. I will set the results to show my testing in progress.

{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "check_max_stack_depth_subprog",
    "check_max_stack_depth"
  ],
  "Reasoning": "The patch modifies the BPF verifier to reject tail calls within any callback (not just exception callbacks). This is a functional change in the core BPF verifier logic that affects program validation and execution flow.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "BPF_SYSCALL"
  ],
  "FocusSymbols": [
    "check_max_stack_depth_subprog",
    "check_max_stack_depth"
  ],
  "Reasoning": "The patch modifies the BPF verifier to reject tail calls within any callback (not just exception callbacks). This is a functional change in the core BPF verifier logic that affects program validation and execution flow.",
  "WorthFuzzing": true
}