Detect Go’s silent arithmetic bugs with go-panikint

src/binary-exploitation/integer-overflow-and-underflow.md

@@ -379,11 +379,42 @@ clang -O0 -Wall -Wextra -std=c11 -D_FORTIFY_SOURCE=0 \
 - [https://8ksec.io/arm64-reversing-and-exploitation-part-8-exploiting-an-integer-overflow-vulnerability/](https://8ksec.io/arm64-reversing-and-exploitation-part-8-exploiting-an-integer-overflow-vulnerability/)
   - Only 1B is used to store the size of the password so it's possible to overflow it and make it think it's length of 4 while it actually is 260 to bypass the length check protection and overwrite in the stack the next local variable and bypass both protections
 
+## Go integer overflow detection with go-panikint
+
+Go wraps integers silently. [go-panikint](https://github.com/trailofbits/go-panikint) is a forked Go toolchain that injects SSA overflow checks so wrapped arithmetic immediately calls `runtime.panicoverflow()` (panic + stack trace).
+
+**Why use it**
+
+- Makes overflow/truncation reachable in fuzzing/CI because arithmetic wraps now crash.
+- Useful around user-controlled pagination, offsets, quotas, size calculations, or access-control math (e.g., `end := offset + limit` on `uint64` wrapping small).
+
+**Build & use**
+
+```bash
+git clone https://github.com/trailofbits/go-panikint
+cd go-panikint/src && ./make.bash
+export GOROOT=/path/to/go-panikint
+./bin/go test -fuzz=FuzzOverflowHarness
+```
+
+Run this forked `go` binary for tests/fuzzing to surface overflows as panics.
+
+**Noise control**
+
+- Truncation checks (casts to smaller ints) can be noisy.
+- Suppress intentional wrap-around via source-path filters or inline `// overflow_false_positive` / `// truncation_false_positive` comments.
+
+**Real-world pattern**
+
+go-panikint revealed a Cosmos SDK `uint64` pagination overflow: `end := pageRequest.Offset + pageRequest.Limit` wrapped past `MaxUint64`, returning empty results. Instrumentation turned the silent wrap into a panic that fuzzers could minimize.
+
 ## ARM64
 
 This **doesn't change in ARM64** as you can see in [**this blog post**](https://8ksec.io/arm64-reversing-and-exploitation-part-8-exploiting-an-integer-overflow-vulnerability/).
 
-{{#include ../banners/hacktricks-training.md}}
-
+## References
 
+- [Detect Go’s silent arithmetic bugs with go-panikint](https://blog.trailofbits.com/2025/12/31/detect-gos-silent-arithmetic-bugs-with-go-panikint/)
+- [go-panikint (compiler fork)](https://github.com/trailofbits/go-panikint)
 
+{{#include ../banners/hacktricks-training.md}}