java-topology/whitepaper/outreach/pachi.md

Pachi — CWE-362 Disclosure Brief (pachi-0001)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Race condition in tree_expand_node() where is_expanded flag is reset with a plain (non-atomic) assignment on allocation failure, despite being acquired with __sync_lock_test_and_set() (atomic test-and-set). A racing thread can re-acquire the lock during the non-atomic reset, causing double-expansion and node corruption.

The Defect

pachi-0001 (PATCHED — HIGH): uct/tree.c:740

// Acquisition — atomic:
if (__sync_lock_test_and_set(&node->is_expanded, 1))
    return;  // another thread already expanding

// Release on alloc failure — NOT atomic:
tree_node_t *first_child = tree_alloc_node(t, consider.moves + 1);
if (!first_child) {
    node->is_expanded = false;  // plain write — CWE-362
    return;
}

The plain assignment node->is_expanded = false lacks release semantics. A racing thread can observe is_expanded == false between the failed allocation and the write, re-enter expansion, and corrupt the children pointer and sibling chain.

Impact

Pachi is a strong open-source Go/Baduk engine using UCT (Monte Carlo tree search) with multi-threaded tree expansion. Under memory pressure (tree node pool exhaustion), the race window opens. Double-expansion corrupts the search tree, producing incorrect move evaluations or crashes. Tournament play and analysis with high thread counts amplify the risk.

The Fix

Replace the plain assignment with __atomic_store_n using release semantics, symmetric with the __sync_lock_test_and_set acquisition:

// Before
node->is_expanded = false;

// After — CWE-362 fix: atomic release matching atomic acquisition
__atomic_store_n(&node->is_expanded, 0, __ATOMIC_RELEASE);

Patch

Fix available: defects/pachi/patch/pachi-0001-atomic-is-expanded.patch

Single-file patch in uct/tree.c.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a tracking reference.
2. Assess severity — race condition under memory pressure in multi-threaded tree search.
3. Coordinate a disclosure date — we target 90 days from first contact.
4. We will credit the Pachi team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.