[Soundness] Daily Validation Report - February 4, 2026

[github-actions[bot]]

Summary

• Issues processed: 11
• Test cases extracted: 4
• Unable to execute tests: 4 (environment limitation)
• Pending extraction: 7

⚠️ Environment Limitation

The automated soundness bug detector cannot currently run Z3 to validate issues due to missing build environment:

• ❌ No build tools (gcc, g++, make)
• ❌ No pip/pip3 for package installation
• ❌ No pre-built Z3 binary in PATH
• ❌ Network proxy blocking external downloads

Recommendation: The workflow environment needs one of:

1. Pre-built Z3 binary added to the runner
2. Build tools installed (gcc, g++, make, python3-dev)
3. Python pip enabled to install z3-solver package

🔴 Critical Priority Issues

Issue #8477: Incremental mode + QF_NRA soundness regression

Status: Test extracted, awaiting execution
Labels: no-repro
Test case: /tmp/soundness-tests/issue-8477.smt2

Problem: Z3 reports incorrect unsat for the second check-sat in incremental mode.

Expected: sat sat
Z3 >=4.15.0 reports: sat unsat ❌

Regression timeline:

• ✅ Versions 4.10.x - 4.12.2: Correct
• ❌ Versions 4.12.3 - 4.12.6: Broken
• ✅ Versions 4.13.2 - 4.14.1: Fixed
• ❌ Versions 4.15.0+: Broken again (current regression)

(declare-fun a () Real)
(declare-fun b () Real)
(check-sat)
(assert (< 0 a))
(assert (= (- b) (* a (+ a b))))
(assert (= 1 (+ (* a a) (* b b))))
(check-sat)

🔗 #8477

---

Issue #8345: Can prove FALSE via incremental solving

Status: Identified (has attachment, needs download)
Labels: Floats

Problem: Z3 can prove false when using floating-point conversions with incremental mode (push/pop), violating fundamental soundness.

Details: Related to to_fp, int2bv, and Real conversions. Works incorrectly with incremental solving but reports unknown without push/pop.

Attachment: https://github.com/user-attachments/files/24861903/tmp.smt2.txt

🔗 #8345

🟠 High Priority Issues

Issue #8397: Real logic soundness (unrelated to floats)

Status: Test extracted, awaiting execution
Assignee: @levnach
Commit: 105bc0f

Problem: Z3 reports sat where cvc5 correctly reports unsat.

Expected: unsat
Z3 reports: sat (with model_validate=true)

(declare-fun a () Real)
(declare-fun b () Real)
; ... [25+ Real variables]
(assert (forall ((j Real)) ...))
(assert (forall ((k Real)) ...))
(check-sat)

🔗 #8397

---

Issue #8183: IEEE 754 violation in RNE/RNA rounding

Status: Test extracted, awaiting execution
Labels: Floats
Commit: eca8e192

Problem: Z3 incorrectly returns unsat for satisfiable Real-to-FP conversions with RNE/RNA rounding modes on overflow.

Expected: sat (per IEEE 754-2008 Section 7.4)
Z3 reports: unsat ❌

Root cause: RNE (Round to Nearest Even) and RNA (Round to Nearest Away) should carry overflows to infinity, but Z3 fails to do so. Works correctly with RTN (Round Toward Negative).

(set-logic ALL)
(declare-fun x () Real)
(assert 
  (not 
    (<= 0.0 
      (ite (fp.isInfinite ((_ to_fp 8 24) RNE x)) 
           x 
           0.0
      )
    )
  )
)
(check-sat)

🔗 #8183

---

Issue #8023: String logic soundness

Status: Test extracted, awaiting execution
Commit: 11fb5c7

Problem: Z3 reports unsat for satisfiable string constraints.

Expected: sat (cvc5 confirms with --check-models)
Z3 reports: unsat (with model_validate=true)

(declare-fun a () String)
(assert (str.<= (str.replace a (str.substr a (str.indexof (str.at a 0) a 1) (+ 1 1)) a) ""))
(check-sat)

🔗 #8023

---

Issue #2650: NRA formula with invalid model

Status: Previously identified
Labels: bug, nlsat

Problem: Z3 reports sat with a model that doesn't satisfy the constraints.

Expected: unsat OR valid model
Z3 reports: sat with invalid model

🔗 #2650

📋 Pending Analysis

The following issues need test case extraction and analysis:

Floating-Point Issues

• Refutational Soundness issue  #7135: Refutational Soundness issue (Floats)

Horn Clause Issues

• Potential Horn soundness issue #6471: Potential Horn soundness issue (Horn)
• Soundness bug in HORN logic #4008: Soundness bug in HORN logic (Horn)
• Issues with models of Horn clauses #5920: Issues with models of Horn clauses (Horn)
• Spacer unsoundness regarding CHCs involving inductively defined datatypes #7611: Spacer unsoundness with CHCs and datatypes (Horn)

Other

• Quantified BV formula, significant performance regression #2075: Quantified BV performance regression (may not be soundness)

🔍 Patterns Observed

1. Incremental solving issues: Multiple bugs (soundness issue when combining incremental mode and QF_NRA #8477, Soundness issue by converting from bit representation to fp to Real #8345) specifically occur or worsen with push/pop operations
2. Floating-point conversions: Several issues ([Refutational Soundness Bug] Incorrect UNSAT in Real-to-FP conversion with RNE/RNA overflow #8183, Soundness issue by converting from bit representation to fp to Real #8345) involve Real ↔ FP conversions
3. Regression in 4.15.x: Issue soundness issue when combining incremental mode and QF_NRA #8477 regressed in the latest release series
4. Cross-solver validation: Issues confirmed against cvc5 (Soundness issue in Real (seemingly unrelated to Float) #8397, Soundness issue in string logic #8023, [Refutational Soundness Bug] Incorrect UNSAT in Real-to-FP conversion with RNE/RNA overflow #8183)

📌 Recommendations

Immediate Actions

1. Configure workflow environment to enable test execution
2. Prioritize soundness issue when combining incremental mode and QF_NRA #8477 - active regression in latest releases (4.15.x)
3. Review Soundness issue by converting from bit representation to fp to Real #8345 - can prove false (most severe soundness violation)

Testing Strategy

1. Add regression tests for incremental mode with QF_NRA
2. Expand IEEE 754 compliance tests for RNE/RNA rounding
3. Cross-validate string theory operations against SMT-LIB2 spec
4. Test Real arithmetic with quantifiers more thoroughly

Process Improvements

1. Enable automated reproduction when environment is configured
2. Add bisection capability to identify regression points
3. Track soundness issues separately from performance/usability bugs
4. Consider continuous validation against other SMT solvers (cvc5, etc.)

---

This report was generated automatically by the Z3 Soundness Bug Detector workflow.
Test cases extracted but not executed due to missing Z3 binary in environment.

AI generated by Soundness Bug Detector

• expires on Feb 11, 2026, 12:02 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-02-11T12:02:10.699Z.

Closed by Workflow