Research Window: 2026-10-15 13:30 ~ 2026-10-16 08:00 (Beijing Time, approx. 18.5 hours; the previous issue was a fault-recovery rerun with a cutoff later than usual, so this issue starts from its cutoff)

Sources: RT-Thread official news API, community forum article API, GitHub (org: RT-Thread main repo commits / PR / Issue / Releases, packages software package index, env tool repo, RT-Thread Studio SDK index, N32 device driver repo, GD32 vendor downstream, topic:rt-thread ecosystem search), Google News aggregation (multiple Chinese and English queries, via proxy), HN Algolia, industry media channel verification (see appendix source list for details)

Issue Index

  • I. Kernel and Version Updates
    • Kernel and driver fix merge batch: ofw hash table out-of-bounds fix and N32 timer completion landed (10-15)
    • lwip section content macro control proposal merged: three network stack commits closed out (10-15)
    • 9PFS exposes two defects in succession: ARMv7-A unaligned access causes kernel abort, getdents out-of-bounds read confirmed reproducible (10-15)
    • New proposal: DFS layer F_GETFL/F_SETFL and device control command code collision disambiguation (10-16)
    • Under-review proposal evaluation: ESP32-C6 SPI receives three line-level comments with author’s point-by-point response (10-15)
    • Under-review discussion: aarch64 GIC acknowledge path retention debate deepens (10-15)
    • Newcomer task activation: efm32 menuconfig support proposal opened (10-15)
    • Official news API sees no new entries for the fifty-seventh consecutive day (10-16)
  • II. Official and Community Events
  • III. Ecosystem and Vendor Adaptation
    • Community project: SiFli SF32LB525 (Huangshan Pi) board FreeDOS port released (10-15 ~ 10-16)
  • IV. Industry Applications
  • V. Summary and Trend Observations
    • Recent one-day trends (10-15 ~ 10-16)
    • Limitations and deduplication notes

I. Kernel and Version Dynamics

1.1 Kernel and Driver Fix Merge Batch: ofw Hash Table Out-of-Bounds Fix and N32 Timer Completion Landed (10-15)

Date: 2026-10-15 13:32 ~ 13:50 (merge time)　Source: PR #11845, PR #11812

Two community fixes were merged within the maintainer window. The first is a device tree ofw fix (#11845, 1 file +4/-2, merged by maintainer Rbb666): it corrects two out-of-bounds hazards in the phandle hash table — the allocation count is changed from max-min to max-min+1 (the lookup index is phandle-min, so when phandle takes the upper bound of the range it would originally access beyond the allocated region), and the expansion zeroing is changed to start from the end of the old table based on the old entry count (the original implementation did not subtract the starting value, so zeroing was incorrect when the starting phandle was not 1); the author validated at function level with 6 test cases under GCC using ASan/UBSan. The second is N32 timer completion (#11812, 39 files +3956/-105): it adds the previously missing clock source and ATIM/GTIM/BTIM instance table branches for N32H47x_48x and N32H49x (the two series share drv_tim.c but previously only the H7xx branch was implemented), changes the LPTIM tick to be derived from the real LSI, extends PWM and quadrature encoder synchronously, and adds ci-attach entries for the three boards that actually compile to the driver feature declarations, following up on #11800.

1.2 lwip Section Content Macro Control Proposal Merged: Three Network Stack Commits Concluded (10-15)

Date: 2026-10-15 13:04 ~ 13:28 (commit / merge time)　Source: PR #11815

The lwip section content macro control proposal (#11815) was finalized around the cutoff of the previous report: author rcitach pushed three final commits at 13:04 (wlan AP lifecycle and direct-receive path synchronization, lwip buffer option configuration and PBUF tailroom reservation, DHCP startup logic optimization), and it was merged at 13:28, totaling 6 files +188/-28. This case was closed in the previous issue as “under review, changes requested,” and is recorded here in its final merged state.

1.3 9PFS Exposes Two Defects in Succession: ARMv7-A Unaligned Access Causes Kernel Abort, getdents Out-of-Bounds Read Confirmed Reproducible (10-15)

Date: 2026-10-15 20:33 ~ 21:18 (comment / creation time)　Source: Issue #11868, Issue #11289

Contributor XueDugu advanced two 9PFS filesystem defect cases within the window. The first is a newly opened defect ticket #11868: the 64-bit value-fetch macro on the receive path dereferences the buffer with an ordinary pointer (get_rx_value64_of); under ARMv7-A, GCC generates LDRD which requires 8-byte alignment, while the struct size of 292 and the protocol constant of 42 make rx_buffer+42 always 6 mod 8 — any Tstat response (including a completely normal response) will trigger an alignment exception and kernel data abort in dfs_9pfs_open / dfs_9pfs_stat; the report traces back to the commit that introduced 9PFS in 2025-12, gives a CVSS 3.1 rating of 7.5 (remote denial of service) with a complete reproduction chain on QEMU vexpress-a9, and includes disassembly and addr2line verification. The second is #11289, opened in March (the getdents path trusting the stat/name lengths sent by the server, causing an out-of-bounds read), which was confirmed reproduced by the community on master (bsp/simulator + ASan) on the evening of 10-15; the root cause is that the received byte count is discarded and record boundaries are not validated. Both cases remain open.

1.4 New Proposal: DFS-Layer F_GETFL/F_SETFL and Device Control Command Code Collision Disambiguation (10-16)

Date: 2026-10-16 00:51 (creation time)　Source: PR #11869

Contributor CXSforHPU opened a DFS-layer disambiguation proposal (2 files +56/-15): POSIX’s F_GETFL(=3), F_SETFL(=4) collide numerically with RT-Thread’s
RT_DEVICE_CTRL_CONFIG(=3), RT_DEVICE_CTRL_CLOSE(=4), and the two command sets share the same integer argument, so drivers may misinterpret under the fcntl path — dfs_v2’s ioctl is pure pass-through, and drivers such as serial may even treat F_GETFL as CONFIG to reconfigure hardware when LWP is closed. The proposal does not change the command encoding, but instead disambiguates by argument form: command 3 with an argument is forwarded to the driver, without an argument returns file status flags per POSIX; command 4 without an argument is forwarded to the driver, with an argument goes to the upper-layer setting, with both dfs_v1 and dfs_v2 implementations modified in sync while preserving the socket notification path.

1.5 Under-Review Proposal Evaluation: ESP32-C6 SPI Receives Three Line-Level Comments with Point-by-Point Author Response (10-15)

Date: 2026-10-15 13:38 ~ 16:30 (review / response time)　Source: PR #11846

The ESP32-C6 SPI support proposal (#11846) received three line-level review comments from maintainer Rbb666: first, with DMA disabled, the IDF single-transfer limit is 64 bytes, while the driver still submits whole packets, so a 65-byte message will trigger an abort and should be transferred in segments or at least return an error code; second, when C3/C6 share ESP-IDF-latest, building C6 permanently rewrites gdma.c to a four-argument call, and subsequently building C3 will report too many arguments, so a target macro or separate copy should be used instead; third, the bit-width check occurs after the bus is successfully initialized, so a 16-bit request that fails and is retried at 8 bits will abort because the bus is already initialized, and the check should be done before requesting resources. The author responded that each item will be rectified (segmented sending within the driver, retaining two sets of calls by target macro with bidirectional build verification, and moving the bit-width check earlier), and agreed to remove the rewrite logic in the build script.

1.6 Under-Review Discussion: Debate Deepens Over Whether to Keep the aarch64 GIC Acknowledge Path (10-15)

Date: 2026-10-15 13:57 ~ 19:39 (comment time)　Source: PR #11860

An in-depth technical discussion emerged within the window for the aarch64 GIC fix proposal (#11860): author Xenithya explained that what was removed is a redundant GICD_ICPENDR clear-pending write before EOI — when the same edge source re-asserts a new event during interrupt handling (as in their NPU scenario: first reporting an AXI error then reporting completion), this write erases the re-latched pending and causes the new interrupt to be permanently lost, and provided measured data: keeping the write results in a completion interrupt loss in about 19~33 inferences, while after removal the pure interrupt path had zero failures across 480,000 inferences. Maintainer GuEe-GUI responded twice: the semantics of this function need to be understood in terms of GIC non-EOI mode, and the problem may also lie in how traps.c calls the interrupt acknowledge interface, suggesting that the trap path modification be verified in parallel. The proposal remains open.

1.7 Beginner Task Activated: efm32 menuconfig Support Proposal Opened (10-15)

Date: 2026-10-15 18:30 ~ 18:31 (comment / creation time)　Source: Issue #7530, PR #11867

The long-pending “menuconfig beginner task” defect ticket (#7530) was reactivated within the window: contributor ymj0440 claimed the efm32 subtask — adding the missing Kconfig and .config for bsp/efm32 (.config generated by reverse-deriving from rtconfig.h, with RT_USING_LWIP left disabled), enabling menuconfig configuration for this BSP, citing the precedents of sam7x and lm3s8962; the proposal (#11867, 2 files +408) was opened just 1 minute after the claim comment was posted at 18:30. The other BSP previously marked as pending in this ticket, rm48x50, already has configuration files in the mainline.

1.8 Official News Interface Shows No New Additions for the Fifty-Seventh Consecutive Day (10-16)

Date: 2026-10-16 (verification time)　Source: RT-Thread Official News Interface

The latest entry in the archive returned by the official news interface (rt_org category) is still 2026-06-17, with no new additions within the window, marking the fifty-seventh consecutive day of no updates; product and event information continues to be first released via the WeChat official account, community forum, and GitHub channels. The official website news list page is dynamically rendered on the front end and could not be directly verified this issue.

II. Official and Community Activities

No new entries were recorded on the official and community activities side within the window: the latest post on the community forum article interface is still the “舒衡智养” work post from the morning of 10-15 (already recorded in the previous issue), and there were no new articles on the media side within the window either.

III. Ecosystem and Vendor Adaptation

3.1 Community Project: SiFli SF32LB525 (Huangshan Pi) Board-Level FreeDOS Port Released (10-15 ~ 10-16)

Date: 2026-10-15 22:11 ~ 2026-10-16 03:08 (commit time)　Source: equence/sf8086

Community developer released the porting project sf8086: porting the 8086tiny emulator to the SiFli Technologies SF32LB525 (Huangshan Pi, Cortex-M33) development board based on RT-Thread, running FreeDOS directly on the board — the BIOS, boot floppy, and Turbo C 2.01 compilation toolchain all reside in firmware, with no dependence on external storage; the A: drive is a RAM disk rebuilt from flash on each boot (about 144 KB available), capable of running DOS tools such as EDIT, DEBUG, and ZIP; the RT-Thread shell and the DOS console share UART1 (including adaptation commits for serial arbitration, terminal key mapping, etc.). The project pushed 13 commits within the window, including an MS-DOS 6.22 boot disk build script and board-level running screenshots, with the repository tagged with topics such as rt-thread, sifli, sf32lb525, and freedos.

Other ecosystem channels remained silent within the window: the packages software package index (most recent merge 10-14), the Studio SDK index (most recent update 10-10), the env tool repository (most recent commit 10-09), the N32 device driver repository (most recent commit 10-14), and the GD32 vendor downstream all had no pushes within the window.

IV. Industry Applications

No new entries were recorded on the industry applications side within the window.

V. Summary and Trend Observations

5.1 Recent One-Day Trends (10-15 ~ 10-16)

  • 9PFS security audit becomes the focus of the window: The 9PFS filesystem stack exposed two defects in succession, one of which is a deterministically reproducible remote denial of service (CVSS 7.5, with a complete reproduction chain and disassembly evidence), indicating that the new component introduced at the end of 2025 is entering a concentrated audit period.
  • Merges maintain their pace: Three merges landed within the window (ofw hash table out-of-bounds fix, N32 timer completion, lwip macro control conclusion), all submitted by community contributors and merged by maintainers.
  • High density of review interaction: ESP32-C6 SPI received three line-level comments with point-by-point author responses; the aarch64 GIC proposal saw measured data at the level of hundreds of thousands of inferences and semantic discussion from maintainers.
  • Beginner task claimed: The menuconfig task ticket was reactivated after months of being pending, and an efm32 proposal was opened just 1 minute after being claimed.
  • Active board-level ecosystem community: The SiFli SF32LB525 board-level FreeDOS porting project completed 13 commits within the window, with the RT-Thread shell and DOS environment coexisting on the same serial port.
  • Official channels continue their silence: The official news interface has gone without updates through the fifty-seventh day; ecosystem repositories such as packages / Studio / env also had no pushes within the window.

5.2 Limitations and Deduplication Notes

  • This issue’s window starts from the previous issue’s supplementary cutoff (10-15 13:30), about 18.5 hours; proposals such as #11815 and #11812 that were under review/reopened in the previous issue were finalized around the cutoff and are recorded here in their final merged state (see 1.1 ~ 1.2).
  • Entries already recorded in the previous issue (the CIIF AI car retrospective, the “舒衡智养” work post, etc.) are not expanded upon in this issue; neither the forum article interface nor the Chinese side of Google News had any new valid articles within the window, and the English side had zero hits.
  • HN recheck had zero hits; the topic:rt-thread ecosystem search found 1 item within the window (sf8086, already recorded), and other general projects are not recorded.
  • The main repository releases / tags have no new versions (latest v5.3.0, released 09-10); the official website news list page is dynamically rendered on the front end and cannot be directly verified.
  • Among the aggregated candidates, one DAMO Academy interview article from riscv.org appeared, which upon verification is RISC-V-themed and unrelated to RT-Thread, so it was not recorded.

Appendix: Source Verification Table

Source Verification Result
RT-Thread official news API (rt_org) No new items in window; latest archived post still 06-17, marking the 57th consecutive day without updates
Community forum article API No new posts in window (latest post 10-15 08:32 was already covered in the previous issue)
Official website news list page Client-side dynamic rendering, cannot be directly verified (data same as official news API)
GitHub org: RT-Thread (main repo) Merged #11845, #11812 (see 1.1); #11815 landed around the cutoff (see 1.2); new defect ticket #11868 (see 1.3) and proposal #11869 (see 1.4); open review threads #11846, #11860, #11867 (see 1.5–1.7)
GitHub RT-Thread/packages and env No pushes in window (packages last merged 10-14; env last commit 10-09)
GitHub RT-Thread Studio component org sdk-index no pushes in window (last 10-10); no activity in other repos
GitHub RT-Thread-packages / N32 drivers, GD32 downstream No pushes in window (last commits 10-14 / 09-28)
GitHub topic:rt-thread ecosystem search 1 item in window, sf8086 (see 3.1), already covered
GitHub releases / tags No new releases on main repo (latest still v5.3.0 from 09-10)
Google News aggregation (Chinese and English, via proxy) No new valid Chinese articles in window; zero hits on English side
HN Algolia No related discussions in window

Complete Source List