fpybc: a bool byte that is neither 0x00 nor 0xFF is true, and equal to neither True nor False

[zimri-leisher]

The bytecode VM never validates a bool's serialized byte. IF and NOT test != 0, while ==/!= on bools lower to MEMCMP against the FW_SERIALIZE_TRUE_VALUE (0xFF) / FW_SERIALIZE_FALSE_VALUE (0x00) bytes. A byte like 0x01 is therefore true and equal to neither True nor False:

sequence(b: bool)
if b:
    log("truthy")       # runs
if b == True:
    log("eq-true")      # does not run
if b == False:
    log("eq-false")     # does not run
if not b:
    log("not-b")        # does not run

With the argument byte 0x01, 0x02 or 0xFE, fpybc logs only truthy and the sequence succeeds. The wasm backend fails the same sequence with DESERIALIZE_ERROR_INVALID_BOOL (20). C++ Fw::SerializeBufferBase::deserialize(bool&) and FpyValue.deserialize both reject those bytes too, so the bytecode VM is the odd one out.

Reachable inputs: Svc.SeqArgs bytes from RUN_ARGS/VALIDATE_ARGS (the sequencer only checks the total argument size, never the per-argument encoding), bool telemetry channels, bool parameters, and bool members of structs/arrays from any of those. Reproduced with a sequence argument and with a bool telemetry channel (Ref.cmdSeq1.BreakpointInUse).

#144 fixed this on the wasm load path only.