Findings
Bugs ChipLab's AI agents found in open-source hardware. One agent finds and documents each bug against the specification; a different agent reproduces it from scratch before it is reported to the project's maintainers.
- Reports filed
- 21 15 public, 6 private
- Projects (public reports)
- 3
- In shipped silicon RTL
- 13 public reports
- Fixed upstream
- 0
Each report carries a CLAB reference; this page links to it as
findings.html#clab-2026-NNN. Security-relevant findings go through each project's private
disclosure channels; they are counted above but listed here only once the fix is public. Updated 09 October 2026, 17:31 UTC.
| Ref | Project | Finding | Status | Filed |
|---|---|---|---|---|
| CLAB-2026-001 | olofk/serv | Reading mie clears MTIE (csrr / csrrs / csrrc with x0 disables timer interrupts) olofk/serv/issues/173 | Open | 2026-10-08 |
| (fix for 001) | olofk/serv | serv_csr: Return MTIE when reading mie olofk/serv/pull/174 | Open | 2026-10-09 |
| CLAB-2026-002 | lowRISC/opentitan | shipped [rv_plic] Completion of a disabled source re-arms its gateway (RISC-V PLIC v1.0.0) lowRISC/opentitan/issues/31690 | Open | 2026-10-09 |
| CLAB-2026-003 | lowRISC/opentitan | shipped [hmac] Nonzero MSG_LENGTH_LOWER[2:0] on context restore prevents hmac_done (bits documented as ignored) lowRISC/opentitan/issues/31691 | Open | 2026-10-09 |
| CLAB-2026-004 | lowRISC/opentitan | shipped [spi_host] CONFIGOPTS change after a CSAAT segment to the same CS skips the CS-high boundary lowRISC/opentitan/issues/31692 | Open | 2026-10-09 |
| CLAB-2026-005 | lowRISC/opentitan | shipped [otbn] Loop back edge at the last IMEM word raises BAD_INSN_ADDR lowRISC/opentitan/issues/31693 | Open | 2026-10-09 |
| CLAB-2026-006 | lowRISC/opentitan | shipped [uart] RX timeout with TIMEOUT_CTRL.VAL=0 fires on every clock while the RX FIFO is empty lowRISC/opentitan/issues/31694 | Open | 2026-10-09 |
| CLAB-2026-007 | lowRISC/opentitan | shipped [uart] TX_DONE and STATUS.TXIDLE assert at the start of the STOP bit, one bit time early lowRISC/opentitan/issues/31695 | Open | 2026-10-09 |
| CLAB-2026-008 | lowRISC/opentitan | shipped [uart] Break detection adds up short lows separated by long idle-high gaps lowRISC/opentitan/issues/31696 | Open | 2026-10-09 |
| CLAB-2026-009 | lowRISC/opentitan | shipped [uart] A high pulse shorter than half a bit re-arms break detection lowRISC/opentitan/issues/31697 | Open | 2026-10-09 |
| CLAB-2026-010 | lowRISC/opentitan | shipped [i2c] Queued FMT commands still execute after BUS_TIMEOUT halts the controller lowRISC/opentitan/issues/31698 | Open | 2026-10-09 |
| CLAB-2026-011 | lowRISC/opentitan | shipped [i2c] Retry after arbitration loss sends a 5-bit address (bit_index not reset on arbitration abort) lowRISC/opentitan/issues/31699 | Open | 2026-10-09 |
| CLAB-2026-012 | lowRISC/opentitan | shipped [entropy_src] Repetition count tests count a phantom zero sample after enable (cutoff C reached after C-1 leading zeros) lowRISC/opentitan/issues/31700 | Open | 2026-10-09 |
| CLAB-2026-024 | Wren6991/Hazard3 | shipped [dm] sbcs.sbaccess resets to 0 (8-bit) instead of 2 (32-bit) when System Bus Access is enabled Wren6991/Hazard3/issues/50 | Open | 2026-10-09 |
| CLAB-2026-023 | Wren6991/Hazard3 | shipped [dm] A host write to data0 while an abstract command is busy changes data0 (spec: value unchanged) Wren6991/Hazard3/issues/51 | Open | 2026-10-09 |
| CLAB-2026-022 | Wren6991/Hazard3 | [alu] amominu.w / amomaxu.w store the signed min/max when Zbb is disabled (default A=1, Zbb=0) Wren6991/Hazard3/issues/52 | Open | 2026-10-09 |