Initial draft.

Author: Lichtso

proposals/XXXX-syscall-parameter-address-restrictions.md

@@ -0,0 +1,75 @@
+---
+simd: '0459'
+title: Syscall Parameter Address Restrictions
+authors:
+  - Alexander Meißner (Anza)
+category: Standard
+type: Core
+status: Review
+created: 2026-01-30
+feature: TBD
+supersedes: 0219
+---
+
+## Summary
+
+Syscall parameter related changes split off from SIMD-0219.
+
+## Motivation
+
+In a recent meeting between the Agave and Firedancer core developers it was
+decided that SIMD-0219 should be split into two feature gates.
+
+## New Terminology
+
+None.
+
+## Detailed Design
+
+### Additional changes
+
+`InstructionError::InvalidRealloc` must be thrown if the caller requested an
+account length which does not fit the payload address space of the account.
+This check must occur after the  address of the account length is translated
+but before the address of the account payload is translated.
+
+All sites in the CPI code which perform guest to host address translation first
+and then perform pointer arithmetic on the host must be swapped such that they
+perform pointer arithmetic in the virtual address space first followed by the
+address translation second. This specifically affects the account length field.
+
+The CU charging for the account length must be moved to occur after the address
+translation of the account length field.
+
+### Changes inherited from SIMD-0219
+
+- The following pointers must be on the stack or heap,
+meaning their virtual address is inside `0x200000000..0x400000000`,
+otherwise `SyscallError::InvalidPointer` must be thrown:
+  - The destination address of all sysvar related syscalls
+  - The pointer in the array of `&[AccountInfo]` / `SolAccountInfo*`
+  - The `AccountInfo::data` field,
+  which is a `RefCell<&[u8]>` in `sol_invoke_signed_rust`
+  - The `AccountInfo::lamports` field,
+  which is a `RefCell<&u64>` in `sol_invoke_signed_rust`
+- The following pointers must point to what was originally serialized in the
+input regions by the program runtime,
+otherwise `SyscallError::InvalidPointer` must be thrown:
+  - `AccountInfo::key` / `SolAccountInfo::key`
+  - `AccountInfo::owner` / `SolAccountInfo::owner`
+  - `AccountInfo::lamports` / `SolAccountInfo::lamports`
+  - `AccountInfo::data::ptr` / `SolAccountInfo::data`
+
+## Alternatives Considered
+
+Leaving SIMD-0219 as is.
+
+## Impact
+
+Splitting SIMD-0219 should have no impact on dApp developers or validators.
+The additional changes have been tested to not cause any existing dApps to
+behave differently.
+
+## Security Considerations
+
+None.