[Issue Backlog] Backlog Analysis - February 25, 2026

[github-actions[bot]]

Executive Summary

• Total open issues analyzed: 147
• Issues recommended for closure: 0 (conservative approach - need maintainer review)
• Critical soundness bugs needing attention: 10
• Performance regressions: 8
• Issues commented on: 1 (issue intblast ubv_to_int bug #8763)

---

Key Findings

1. Critical Soundness Bug Surge

There has been a significant increase in soundness bug reports in January-February 2026, primarily from fuzzing efforts by @wingsyuyi-satori. These are high-priority issues:

Recent Floating Point Issues (All from @wingsyuyi-satori)

• [Refutational Soundness Bug] Incorrect UNSAT in Real-to-FP conversion with RNE/RNA overflow #8183: Refutational soundness bug in Real-to-FP conversion with RNE/RNA rounding modes (incorrect UNSAT)
• Incorrect model in mixed FP/Real logic triggered by extra string constraint #8185: Incorrect model in mixed FP/Real logic triggered by extra string constraint
• Incorrect model with (_ FloatingPoint 2 24) and fp.to_real #8169: Incorrect model with custom FloatingPoint sort (2,24) and fp.to_real
• All three are assigned but have not been fixed yet
• Maintainer comment (on Incorrect model with (_ FloatingPoint 2 24) and fp.to_real #8169): "feel free to tone down the FP fuzzing unless you have fixes"

String Theory Issues

• Incorrect model with :produce-proofs true involving String Theory and UF #8194: Incorrect model with :produce-proofs true involving String Theory and UF
• Soundness issue in string logic #8023: Soundness issue in string logic (8 comments, ongoing discussion)
• Both issues involve interaction between string operations and proof generation

Bit-Vector Integer Blasting

• intblast ubv_to_int bug #8763: NEW (opened Feb 24) - intblast ubv_to_int bug with compound expressions
  • User provides detailed analysis and proposed fix
  • Affects smt.bv.solver=2 (int-blasting mode)
  • Has a working fix: https://github.com/bagnalla/z3/tree/bugfix/intblast-ubv-to-int-bvadd-bridge
  • Component: src/smt/intblast_solver.cpp

SAT Solver Configuration

• Wrong verdict with (set-option :sat.smt true) #7990: Wrong verdict with (set-option :sat.smt true) - incremental inprocessing unsoundly deletes clauses
  • Component: src/sat/ SAT solver with incremental inprocessing

Spacer/CHC

• Spacer returns sat instead of expected unsat, and fails model validation on a specific input #7730: Spacer returns sat instead of unsat with model validation failure (assigned to @agurfinkel)
  • Component: src/muz/spacer/ Horn clause solver

---

2. Performance Regression Pattern

A notable pattern of performance regressions has emerged in versions 4.15.x:

Pinpointed Regressions

• Z3 Regression: solver.check() returns 'unknown' instead of 'sat' #8740: Regression between 4.15.4 → 4.15.8 returning 'unknown' instead of 'sat'
  • Bisected to commit 7395152 ("factor out coi, use polynomial elaboration for nlsat")
  • Comment from @levnach: "Not sure how to fix it"
  • This needs immediate attention - confirmed regression with known cause
  • Component: src/math/lp/nra_solver.cpp, nlsat polynomial elaboration

General Performance Issues in 4.15.x

• Massive performance regression in 4.15.4.0 apparently due to lock contention #8019: Massive performance regression in 4.15.4.0 due to lock contention (4 comments)
• Infinite loop/performance regression in Z3 4.15.3 #7991: Infinite loop/performance regression in 4.15.3 (14 comments, active discussion)
• Performance degradation in Z3 on QF_SLIA instances with fixed-length strings and prefix/suffix constraints #8096: Performance degradation on QF_SLIA with fixed-length strings
• Observe both compute and memory regression when upgrade to 4.15.3 from 4.14.1 #7800: Compute and memory regression upgrading from 4.14.1 to 4.15.3

---

3. Build System Issues

Two open build issues related to OCaml bindings:

• OCaml bindings don't install with cmake build system #7684: OCaml bindings don't install with cmake build system (18 comments, ongoing)
• cmake target z3_add_install_tactic_rule always rebuild when building the ocaml-binding #7816: cmake target always rebuilds when building OCaml bindings

---

Issue Triage Observations

Well-Documented Issues: Most recent soundness bugs include:

• Minimal reproducible SMT-LIB2 examples
• Z3 version information
• Comparison with cvc5 for validation
• Some include proposed fixes or detailed root cause analysis

Issues Needing Maintainer Response:

• Many critical soundness bugs have been assigned but lack maintainer comments
• Z3 Regression: solver.check() returns 'unknown' instead of 'sat' #8740 has a bisected regression but no fix direction
• Several floating-point issues acknowledged but deprioritized

---

Recommendations for Maintainers

Immediate Priority (P0)

1. Z3 Regression: solver.check() returns 'unknown' instead of 'sat' #8740: Investigate regression from commit 7395152 - breaking previously working queries
2. intblast ubv_to_int bug #8763: Review and potentially merge the proposed fix for intblast ubv_to_int
3. Wrong verdict with (set-option :sat.smt true) #7990: SAT solver soundness issue with incremental inprocessing

High Priority (P1)

4. [Refutational Soundness Bug] Incorrect UNSAT in Real-to-FP conversion with RNE/RNA overflow #8183, Incorrect model in mixed FP/Real logic triggered by extra string constraint #8185, Incorrect model with (_ FloatingPoint 2 24) and fp.to_real #8169: Floating-point soundness bugs (can be batched)
5. Incorrect model with :produce-proofs true involving String Theory and UF #8194, Soundness issue in string logic #8023: String theory soundness issues with proof generation

Medium Priority (P2)

6. Spacer returns sat instead of expected unsat, and fails model validation on a specific input #7730: Spacer soundness issue (already assigned)
7. Performance regressions in 4.15.x series (Infinite loop/performance regression in Z3 4.15.3 #7991, Massive performance regression in 4.15.4.0 apparently due to lock contention #8019, Performance degradation in Z3 on QF_SLIA instances with fixed-length strings and prefix/suffix constraints #8096)
8. OCaml build system issues (OCaml bindings don't install with cmake build system #7684, cmake target z3_add_install_tactic_rule always rebuild when building the ocaml-binding #7816)

---

Notable Patterns

1. Proof Generation Interaction: Issues Incorrect model with :produce-proofs true involving String Theory and UF #8194 and Incorrect model in mixed FP/Real logic triggered by extra string constraint #8185 both show soundness problems triggered specifically when :produce-proofs true is enabled

2. Theory Combination: Several bugs (Incorrect model in mixed FP/Real logic triggered by extra string constraint #8185, Incorrect model with :produce-proofs true involving String Theory and UF #8194) involve unexpected interactions between theories (FP+Real+String, String+UF)

3. Version 4.15.x Stability: Multiple regressions introduced in 4.15.x series suggest this version may need a stability-focused release

4. Active Fuzzing: @wingsyuyi-satori is actively fuzzing Z3 and finding real bugs, but maintainer requested reducing FP fuzzing volume

---

Components Affected (Summary)

Component	Issues	Type
src/smt/intblast_solver.cpp	#8763	Soundness
src/ast/fpa/ (Floating Point)	#8183, #8185, #8169	Soundness
src/ast/seq_decl_plugin.cpp (Strings)	#8194, #8023	Soundness
src/sat/ (SAT solver)	#7990	Soundness
src/muz/spacer/ (Spacer/CHC)	#7730	Soundness
src/math/lp/nra_solver.cpp (NRA/nlsat)	#8740	Regression
String theory (QF_SLIA)	#8096	Performance
OCaml build system	#7684, #7816	Build

---

Automated by Issue Backlog Processor - runs every 2 days
Previous run: 2026-02-24T17:10:00Z (179 issues)
Current run: 2026-02-25T00:16:45Z (147 issues)

AI generated by Issue Backlog Processor

• expires on Mar 4, 2026, 12:22 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-03-04T00:22:17.685Z.

Closed by Workflow