C news and engineering summaries

Dirty Frag is a critical local privilege escalation (LPE) vulnerability affecting major Linux distributions. It exploits weaknesses in the kernel's network sub-systems (specifically AF_ALG/XFRM and AF_RXRPC) to gain root access. Because the disclosure embargo was breached, no official emergency patches currently exist, making the system highly vulnerable.

Writing USB drivers is accessible without deep kernel knowledge, thanks to userspace libraries like libusb. This guide explains USB enumeration, endpoints, and descriptors using an Android phone in Fastboot mode. By understanding device identification and transfer types (Control, Bulk, Interrupt, Isochronous), developers can create functional drivers in userspace, mirroring simple network socket communication.

This project details the creation of an NTP-synchronized analog clock using a WEMOS D1 Mini ESP8266 module. By modifying a standard quartz movement, specifically the Lavet stepping motor, the creator enables the ESP32 to drive the clock hands via bipolar pulses. The system connects to a Network Time Protocol server every 15 minutes to maintain high accuracy and automatically adjusts for daylight savings time. To solve the issue of position tracking during power failures, the project utilizes a Microchip 47L04 EERAM IC to store the hand positions in real-time. Additionally, the ESP8266 serves a web interface for initial configuration and status monitoring, utilizing technologies like SVG and HTML Canvas to visualize the clock's readout.

Modern Windows apps, often built on memory-heavy web frameworks, have lost the unique visual identity of the Win32 era. This technical analysis explores how raw Win32 API enables non-rectangular, custom-shaped, and animated windows. While challenging to implement, this low-level control offers a powerful alternative to generic, bloated desktop software, restoring creative freedom to application interface design.

Box3D is a new open-source 3D physics engine built in C17, designed as a 3D extension of the established Box2D. Developed to meet the specific performance and architectural needs of the game The Legend of California, it features triangle mesh collision, height-field collision, and multi-threading support, providing a specialized solution for complex game physics.

In Linux, /proc/<pid>/mem acts as a file interface for a process's virtual memory. By using pread() or pwrite() with specific offsets, developers can directly read or modify another process's memory. This elegant approach provides a simpler alternative to the complex ptrace() system calls for tasks like memory analysis and data recovery.

Cilly is a new Rust compiler backend that translates Rust code into C, enabling Rust development on obscure hardware or platforms that lack native LLVM or GCC support. By generating platform-specific C code through intelligent introspection, it bridges the gap for architectures like Plan9, offering a solution to the bootstrap paradox and expanding Rust's reach.

The NetHack DevTeam has released NetHack 5.0.0, introducing major architectural updates including C99 standard compliance, improved cross-compiling support, and a transition to Lua-based processing for compilers. This release is incompatible with previous save files. Developers welcome bug reports and pull requests to further refine this new version.

Salvatore has released an ambitious open-source project that implements the FLUX.2-klein-4B diffusion model entirely in C. The key innovation is the total removal of the Python stack, requiring no PyTorch, CUDA, or heavy runtime dependencies. Remarkably, the codebase was developed in a single weekend using Claude Code and Claude Max, marking the author's first project with zero human-written lines of code. The software supports text-to-image and image-to-image generation with optional MPS and BLAS acceleration for performance. It features an integrated Qwen3-4B text encoder and manages memory by releasing the encoder after use to maintain an 8GB footprint during diffusion. This project serves as a demonstration of how modern AI can assist in creating high-performance, accessible inference systems from scratch.

This 16-byte x86 DOS assembly program, created for the Outline Demoparty, generates a Sierpinski fractal on screen while simultaneously outputting it as audio via the PC speaker. By manipulating VGA memory and using cellular automaton logic, the code produces complex mathematical patterns and gritty bytebeat sounds, demonstrating advanced sizecoding techniques and hardware-level interaction in real-mode DOS.

Researchers discovered a critical heap buffer overflow in NGINX's ngx_http_rewrite_module, enabling unauthenticated remote code execution. The vulnerability stems from a mismatch in buffer size calculation versus data copying when handling the is_args flag. Exploitation leverages heap feng shui to redirect memory pointers and trigger system commands, requiring updates to patched versions.

GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel vulnerability causing privilege escalation via a dangling pointer in rtmutex. By triggering a specific deadlock path, an attacker can reclaim kernel stack memory to forge structures, hijacking execution flow to achieve root access. Users are advised to upgrade to the latest LTS kernel release.

Branch mispredictions hinder CPU performance by forcing pipeline restarts. By replacing conditional branches with branchless alternatives—such as using conditional increment instructions—developers can maintain linear control flow. Although branchless code may involve redundant memory writes, the performance gains on modern architectures are significant when dealing with unpredictable, large datasets.

The Zig development log for 2026 highlights significant updates, including a reworked build system for faster performance, LLVM backend incremental compilation, and a redesigned type resolution system. Key additions include experimental evented I/O implementations, improved package management with local caching, and a strategic migration to native Windows APIs, alongside ongoing efforts to replace vendored libc with Zig-native implementations.

Spinel is a self-hosting compiler that transforms Ruby code into standalone native C binaries. By using whole-program type inference and generating optimized C, it eliminates runtime dependencies and achieves significant performance gains, averaging 11.6x faster than standard CRuby on benchmarks. It supports a robust subset of Ruby, including Fibers, Bigint, and NFA regexps.

Developer Dante Leoncini successfully ported Half-Life to the Nokia N95, a 2007 Symbian-based smartphone. The game runs at 30 FPS with added Bluetooth mouse and keyboard support. This accomplishment highlights the capability of legacy mobile hardware, using a native Symbian build rather than emulation to achieve performance comparable to 1990s desktop PCs.

A comprehensive benchmark of Python optimization techniques, ranging from version upgrades to C-integrations and JAX. The analysis demonstrates that while Python is fundamentally limited by dynamic dispatch, developers can achieve 1.4x to 1,633x speedups using tools like Mypyc, Numba, Rust, and JAX for compute-heavy or data-processing tasks.

The Rust ecosystem faces challenges with crate composition and evolution due to coherence and orphan rules. These rules, while necessary for soundness and preventing duplicate implementations, hinder the replacement of foundational crates. The author proposes a long-term shift toward 'incoherent traits' using named implementations and explicit trait bound parameters to bypass current limitations.

Ghostling is a minimalist terminal demo implementing the libghostty C API and Raylib for rendering. It demonstrates how to integrate the high-performance, accurate terminal emulation and VT sequence parsing found in Ghostty into custom applications. The project highlights the flexibility of libghostty, which provides a renderer-agnostic core capable of supporting advanced terminal features in diverse environments.

In this technical analysis, the author shares practical techniques for using C as a target language for compilers and generators. Central to the discussion is the use of 'static inline' functions to enable efficient data abstraction without performance penalties, ensuring that abstraction costs are eliminated during compilation. The author also advocates for avoiding implicit integer conversions by using explicit cast functions and leveraging single-member structs to wrap raw pointers, which aids in type safety and memory management. Furthermore, the summary covers manual register allocation for handling complex ABIs and tail calls, and the reliability of modern compilers in optimizing 'memcpy' for unaligned memory access. While acknowledging limitations like lack of stack control and debugging difficulties, the author highlights that well-structured generated C code can be nearly bug-free once it successfully type-checks.