C news and engineering summaries

The Assembly Hall of Shame is a project by Christopher Domas that identifies the slowest possible single instructions on x86 architectures. By deliberately triggering microcode assists, hardware traps, or saturating PCIe fabric with high-latency MMIO transactions, it reveals extreme performance penalties, with the record-holding 'fxrstor64' instruction taking over 198 billion cycles to complete.

Dirty Frag is a critical local privilege escalation (LPE) vulnerability affecting major Linux distributions. It exploits weaknesses in the kernel's network sub-systems (specifically AF_ALG/XFRM and AF_RXRPC) to gain root access. Because the disclosure embargo was breached, no official emergency patches currently exist, making the system highly vulnerable.

llama.cpp adds a GPU cache for MoE experts stored in host memory. MUL_MAT_ID operations on host experts run on the GPU through an LRU cache, so only misses are uploaded; it targets batches of up to 32 tokens, while larger batches use regular offload, and different expert layouts get separate banks. Enable it with --moe-cache-mib N; tests found 10% of total expert size effective. On Qwen3.8-Flash-Next Q4_0, speedups reached 1.62x on RTX 4090 and 2.20x on RTX 5090.

Writing USB drivers is accessible without deep kernel knowledge, thanks to userspace libraries like libusb. This guide explains USB enumeration, endpoints, and descriptors using an Android phone in Fastboot mode. By understanding device identification and transfer types (Control, Bulk, Interrupt, Isochronous), developers can create functional drivers in userspace, mirroring simple network socket communication.

A commercial web product, marketyour.games, was built and deployed in C using CGI on OpenBSD with httpd and SQLite. It provides accounts, search, folders, Stripe payments, Postmark email, progressive enhancement, and no JavaScript, while compiling assets into one statically linked binary. The stack uses libcurl, libsodium, and vendored libcjson, with each request spawning a process and deployments requiring only file replacement. The author values its simplicity, security, debugging, and minimal supply chain, but notes that CGI requires custom utilities for common web tasks.

Android 17 September 2026 builds contain a bionic libc regression in `wcscspn()` and `wcspbrk()`: with reject sets of at least two characters all below U+0100, both incorrectly stop at the first haystack character ≥ U+0100. The table-based scan treats that character as a match, breaking Unicode text handling; `wcsspn()` remains correct. Pixel 7 and 8a are affected, and Visual Pinball required plain-loop workarounds. Public June sources do not contain the regression.

cs341-illinois/coursebook is an open-source introductory systems programming textbook for the University of Illinois Urbana-Champaign’s CS 341 course. Written in C for Linux-oriented instruction, it improves on an earlier wikibook with more rigorous, cited content, a glossary, extended reading, and automated PDF, Markdown, and HTML exports.

This project details the creation of an NTP-synchronized analog clock using a WEMOS D1 Mini ESP8266 module. By modifying a standard quartz movement, specifically the Lavet stepping motor, the creator enables the ESP32 to drive the clock hands via bipolar pulses. The system connects to a Network Time Protocol server every 15 minutes to maintain high accuracy and automatically adjusts for daylight savings time. To solve the issue of position tracking during power failures, the project utilizes a Microchip 47L04 EERAM IC to store the hand positions in real-time. Additionally, the ESP8266 serves a web interface for initial configuration and status monitoring, utilizing technologies like SVG and HTML Canvas to visualize the clock's readout.

Modern Windows apps, often built on memory-heavy web frameworks, have lost the unique visual identity of the Win32 era. This technical analysis explores how raw Win32 API enables non-rectangular, custom-shaped, and animated windows. While challenging to implement, this low-level control offers a powerful alternative to generic, bloated desktop software, restoring creative freedom to application interface design.

Box3D is a new open-source 3D physics engine built in C17, designed as a 3D extension of the established Box2D. Developed to meet the specific performance and architectural needs of the game The Legend of California, it features triangle mesh collision, height-field collision, and multi-threading support, providing a specialized solution for complex game physics.

W1700K SDR turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver, capturing raw 14-bit complex IQ from its MediaTek MT7996 radio at up to 320 Msps and streaming it over 10 GbE to a Linux host. Custom firmware, built without MediaTek code, supports arbitrary LO tuning, multiple bands, gain and filters. Host tools provide shared streaming, roll-off correction, recording, and browser spectrum/waterfall visualization, operating without fixed channels.

In Linux, /proc/<pid>/mem acts as a file interface for a process's virtual memory. By using pread() or pwrite() with specific offsets, developers can directly read or modify another process's memory. This elegant approach provides a simpler alternative to the complex ptrace() system calls for tasks like memory analysis and data recovery.

Cilly is a new Rust compiler backend that translates Rust code into C, enabling Rust development on obscure hardware or platforms that lack native LLVM or GCC support. By generating platform-specific C code through intelligent introspection, it bridges the gap for architectures like Plan9, offering a solution to the bootstrap paradox and expanding Rust's reach.

The NetHack DevTeam has released NetHack 5.0.0, introducing major architectural updates including C99 standard compliance, improved cross-compiling support, and a transition to Lua-based processing for compilers. This release is incompatible with previous save files. Developers welcome bug reports and pull requests to further refine this new version.

Developing a game for the N64 in 2026 is possible by porting a C engine to use Libdragon. By leveraging efficient raycasting, custom rendering pipelines, and hardware-specific optimizations for the N64's memory and coprocessors, it is possible to achieve stable performance. The process involves using modern toolchains and real hardware for development, culminating in physical distribution.

Salvatore has released an ambitious open-source project that implements the FLUX.2-klein-4B diffusion model entirely in C. The key innovation is the total removal of the Python stack, requiring no PyTorch, CUDA, or heavy runtime dependencies. Remarkably, the codebase was developed in a single weekend using Claude Code and Claude Max, marking the author's first project with zero human-written lines of code. The software supports text-to-image and image-to-image generation with optional MPS and BLAS acceleration for performance. It features an integrated Qwen3-4B text encoder and manages memory by releasing the encoder after use to maintain an 8GB footprint during diffusion. This project serves as a demonstration of how modern AI can assist in creating high-performance, accessible inference systems from scratch.

This 16-byte x86 DOS assembly program, created for the Outline Demoparty, generates a Sierpinski fractal on screen while simultaneously outputting it as audio via the PC speaker. By manipulating VGA memory and using cellular automaton logic, the code produces complex mathematical patterns and gritty bytebeat sounds, demonstrating advanced sizecoding techniques and hardware-level interaction in real-mode DOS.

The Zig development log for 2026 highlights significant updates, including a reworked build system for faster performance, LLVM backend incremental compilation, and a redesigned type resolution system. Key additions include experimental evented I/O implementations, improved package management with local caching, and a strategic migration to native Windows APIs, alongside ongoing efforts to replace vendored libc with Zig-native implementations.

Researchers discovered a critical heap buffer overflow in NGINX's ngx_http_rewrite_module, enabling unauthenticated remote code execution. The vulnerability stems from a mismatch in buffer size calculation versus data copying when handling the is_args flag. Exploitation leverages heap feng shui to redirect memory pointers and trigger system commands, requiring updates to patched versions.

GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel vulnerability causing privilege escalation via a dangling pointer in rtmutex. By triggering a specific deadlock path, an attacker can reclaim kernel stack memory to forge structures, hijacking execution flow to achieve root access. Users are advised to upgrade to the latest LTS kernel release.