Stack Canaries, HEAP canaries

docs/RUNE_OF_PERMANENCE_DESIGN.md

···
+# The Rune of Permanence - Read-Only Kernel Data Protection
+
+> *"The fundamental laws of the realm, once scribed at the Dawn of Awakening, are immutable. These crystalline structures, etched into the fabric of reality, cannot be altered—for to change them would be to rewrite the very physics of the world."*
+
+## Overview
+
+The Rune of Permanence is AethelOS's implementation of **kernel data protection through immutability**. After the kernel completes its initialization (the "Dawn of Awakening"), critical data structures are marked as read-only at the hardware level, preventing any runtime modification—even by the kernel itself.
+
+### The Philosophy
+
+In AethelOS, the kernel's foundational structures are not merely "protected"—they are **enchanted with permanence**. Once the realm awakens and its laws are established, those laws become as immutable as the laws of physics. The MMU (Memory Management Unit) acts as a guardian of reality itself, enforcing these constraints with hardware precision.
+
+Any attempt to modify a permanent structure is not a "security violation"—it is an attempt to **break the fabric of reality**, and the MMU denies it instantly with a page fault.
+
+---
+
+## Security Model
+
+### Threat: Data-Only Attacks
+
+Even with W^X (no executable data), attackers can still compromise a system by **corrupting data structures** rather than injecting code:
+
+#### Attack Vector 1: Function Pointer Overwrites
+
+```rust
+// Vulnerable dispatch table
+static mut SYSCALL_TABLE: [fn(); 256] = [ /* ... */ ];
+
+// Attacker exploits buffer overflow to overwrite entry:
+SYSCALL_TABLE[42] = attacker_function; // ← Redirect syscall!
+```
+
+**Impact:** Attacker gains arbitrary code execution by hijacking control flow through legitimate function pointers.
+
+#### Attack Vector 2: Security Policy Corruption
+
+```rust
+// Vulnerable security configuration
+static mut CAPABILITIES_ENABLED: bool = true;
+
+// Attacker overwrites this to disable security:
+CAPABILITIES_ENABLED = false; // ← Bypass capability checks!
+```
+
+**Impact:** Attacker disables security features by corrupting policy flags.
+
+#### Attack Vector 3: Critical Constant Corruption
+
+```rust
+// Vulnerable kernel configuration
+static mut MAX_THREADS: usize = 256;
+
+// Attacker sets this to 0:
+MAX_THREADS = 0; // ← Denial of service!
+```
+
+**Impact:** System becomes unstable or unusable.
+
+### Defense: The Rune of Permanence
+
+**After-Boot Immutability:**
+
+```
+┌─────────────────────────────────────────────┐
+│         Kernel Memory Layout                │
+├─────────────────────────────────────────────┤
+│  .text (code)        │ R-X │ ← Already W^X  │
+├─────────────────────────────────────────────┤
+│  .rodata (constants) │ R-- │ ← Already RO   │
+├─────────────────────────────────────────────┤
+│  .data (variables)   │ RW- │ ← Mutable      │
+├─────────────────────────────────────────────┤
+│  .rune (permanent)   │ RW- │ ← Boot phase   │
+│                      │  ↓  │                │
+│                      │ R-- │ ← After boot!  │
+└─────────────────────────────────────────────┘
+```
+
+**The `.rune` section** contains structures that:
+1. **Are initialized at boot** (writable during init)
+2. **Never change afterward** (read-only after init)
+3. **Are security-critical** (function pointers, policies, etc.)
+
+---
+
+## Implementation Strategy
+
+### Phase 1: Identify Permanent Structures
+
+Categorize kernel data by mutability:
+
+#### ✓ Permanent (Mark as `.rune`)
+
+**Function Pointer Tables:**
+- Syscall dispatch table
+- Interrupt handler table (IDT entries)
+- Virtual function tables (vtables)
+- Driver callback tables
+
+**Security Policies:**
+- Capability enforcement flags
+- W^X enforcement settings
+- ASLR configuration
+- Stack canary enforcement
+
+**Kernel Configuration:**
+- Thread limits (MAX_THREADS)
+- Memory layout constants (KERNEL_BASE)
+- Hardware resource limits
+
+**Immutable References:**
+- Static references to permanent structures
+- Global singletons initialized at boot
+
+#### ✗ Mutable (Keep as `.data`)
+
+**Runtime State:**
+- Current thread ID
+- Scheduler state
+- Memory allocator free lists
+- I/O buffers
+
+**Statistics:**
+- Thread counters
+- Memory usage metrics
+- Performance timers
+
+**Lock State:**
+- Mutex ownership
+- Semaphore counts
+
+---
+
+### Phase 2: Rust Language Support
+
+Rust provides excellent compile-time immutability, but we need **runtime immutability** after boot.
+
+#### Option A: `const` for Compile-Time Immutability
+
+```rust
+// Already immutable at compile time
+const KERNEL_VERSION: &str = "0.1.0-alpha";
+
+// Compiler places this in .rodata (read-only section)
+```
+
+**Limitation:** Can't initialize complex structures at runtime (e.g., generated entropy, hardware detection).
+
+#### Option B: `static` + Custom Section for Runtime Immutability
+
+```rust
+// Place in custom .rune section for post-boot protection
+#[link_section = ".rune"]
+static mut SYSCALL_TABLE: SyscallTable = SyscallTable::empty();
+
+// During boot: Initialize (writable)
+unsafe {
+    SYSCALL_TABLE.register(0, sys_read);
+    SYSCALL_TABLE.register(1, sys_write);
+    // ...
+}
+
+// After boot: Mark page as read-only
+unsafe {
+    seal_permanent_structures();
+}
+```
+
+**Advantages:**
+- Runtime initialization (can use hardware RNG, probe devices)
+- Explicit control over when immutability takes effect
+- Clear separation of permanent vs mutable data
+
+---
+
+### Phase 3: Memory Page Protection
+
+Use x86_64 page tables to enforce read-only protection at the hardware level.
+
+#### Page Table Entry Bits
+
+```
+┌───────────────────────────────────────────────┐
+│  Page Table Entry (x86_64)                    │
+├───────────────────────────────────────────────┤
+│  Bit 0: Present (P)         │ 1 = page valid  │
+│  Bit 1: Read/Write (RW)     │ 1 = writable    │ ← Clear this!
+│  Bit 2: User/Supervisor (US)│ 0 = kernel only │
+│  Bit 3: Write-Through (PWT) │                 │
+│  Bit 4: Cache Disable (PCD) │                 │
+│  Bit 5: Accessed (A)        │                 │
+│  Bit 6: Dirty (D)           │                 │
+│  Bit 7: Page Size (PS)      │                 │
+│  Bit 63: Execute Disable (NX)│ 1 = no execute │
+└───────────────────────────────────────────────┘
+```
+
+**To make a page read-only:**
+1. Find the page table entry (PTE) for the `.rune` section
+2. Clear bit 1 (Read/Write bit) → `RW = 0`
+3. Flush TLB (translation lookaside buffer) to apply change
+
+#### Implementation
+
+```rust
+// In mana_pool/page_tables.rs
+
+/// Seal the `.rune` section as read-only after boot
+///
+/// # Safety
+/// This MUST only be called once, after all permanent structures
+/// have been initialized. After this call, ANY writes to the .rune
+/// section will cause a page fault.
+pub unsafe fn seal_rune_section() {
+    extern "C" {
+        static __rune_start: u8;
+        static __rune_end: u8;
+    }
+
+    let start = &__rune_start as *const u8 as u64;
+    let end = &__rune_end as *const u8 as u64;
+
+    println!("◈ Sealing The Rune of Permanence...");
+    println!("  Range: 0x{:016x} - 0x{:016x}", start, end);
+
+    // Iterate over pages in the .rune section
+    let mut addr = start & !0xFFF; // Align to 4KB page boundary
+    while addr < end {
+        // Get page table entry for this address
+        let pte = get_pte_for_address(addr);
+
+        // Clear the Write bit (bit 1)
+        let mut entry = pte.read();
+        entry &= !(1 << 1); // Clear RW bit → read-only
+        pte.write(entry);
+
+        // Move to next page
+        addr += 0x1000; // 4KB page size
+    }
+
+    // Flush TLB to ensure changes take effect immediately
+    flush_tlb();
+
+    println!("  ✓ The Rune is sealed. Permanence enforced by the MMU.");
+}
+
+/// Flush the Translation Lookaside Buffer (TLB)
+///
+/// This forces the CPU to reload page table entries from memory,
+/// ensuring that our read-only protection takes effect immediately.
+#[inline(always)]
+fn flush_tlb() {
+    unsafe {
+        // Reloading CR3 flushes the entire TLB
+        core::arch::asm!(
+            "mov rax, cr3",
+            "mov cr3, rax",
+            out("rax") _,
+            options(nostack, preserves_flags)
+        );
+    }
+}
+```
+
+---
+
+### Phase 4: Linker Script Configuration
+
+Define the `.rune` section in our linker script so permanent structures are grouped together.
+
+#### Update `linker.ld`
+
+```ld
+SECTIONS
+{
+    . = 0x100000; /* Kernel starts at 1MB */
+
+    .text : ALIGN(4K) {
+        *(.text .text.*)
+    }
+
+    .rodata : ALIGN(4K) {
+        *(.rodata .rodata.*)
+    }
+
+    /* NEW: The Rune of Permanence section */
+    .rune : ALIGN(4K) {
+        PROVIDE(__rune_start = .);
+        *(.rune .rune.*)
+        PROVIDE(__rune_end = .);
+    }
+
+    .data : ALIGN(4K) {
+        *(.data .data.*)
+    }
+
+    .bss : ALIGN(4K) {
+        *(.bss .bss.*)
+    }
+}
+```
+
+**Key points:**
+- `.rune` section is page-aligned (4KB) for MMU protection
+- `__rune_start` and `__rune_end` symbols mark the boundaries
+- Placed between `.rodata` and `.data` for clarity
+
+---
+
+### Phase 5: Boot Sequence Integration
+
+Integrate sealing into the kernel boot process.
+
+#### Boot Flow
+
+```rust
+// In main.rs
+
+fn kernel_main() -> ! {
+    // Phase 1: Early initialization (mutable)
+    println!("◈ Dawn of Awakening - Kernel Initialization");
+
+    init_vga_buffer();
+    init_gdt();
+    init_idt();
+    init_pic();
+    init_timer();
+    init_mana_pool();
+
+    // Phase 2: Initialize permanent structures (still mutable)
+    println!("◈ Scribing the foundational runes...");
+
+    init_syscall_table();     // Populate function pointers
+    init_security_policy();   // Set capability flags
+    init_kernel_config();     // Set limits and constants
+
+    // Phase 3: Seal permanent structures (make read-only)
+    println!("◈ Invoking The Rune of Permanence...");
+    unsafe {
+        mana_pool::page_tables::seal_rune_section();
+    }
+    println!("  ✓ The foundational laws are now immutable.");
+
+    // Phase 4: Start scheduler (permanent structures are now protected)
+    println!("◈ Weaving the Loom of Fate...");
+    loom_of_fate::init();
+
+    // Phase 5: Enter userspace (if applicable)
+    // ...
+
+    loop {
+        // Main kernel loop
+    }
+}
+```
+
+**Critical Timing:**
+- **Before sealing:** Initialize all structures that go in `.rune`
+- **After sealing:** NEVER write to `.rune` - will cause page fault!
+
+---
+
+## Practical Example: Protecting the IDT
+
+The Interrupt Descriptor Table (IDT) is a prime target for attackers. Let's protect it with The Rune of Permanence.
+
+### Current Implementation (Vulnerable)
+
+```rust
+// In attunement/idt.rs
+
+// Mutable IDT in .data section (writable!)
+static mut IDT: InterruptDescriptorTable = InterruptDescriptorTable::new();
+
+pub fn init() {
+    unsafe {
+        // Set up interrupt handlers
+        IDT.breakpoint.set_handler_fn(breakpoint_handler);
+        IDT.page_fault.set_handler_fn(page_fault_handler);
+        // ...
+
+        // Load IDT
+        IDT.load();
+    }
+}
+```
+
+**Vulnerability:** Attacker with write-what-where primitive can overwrite IDT entries to hijack interrupts.
+
+### Protected Implementation (Permanent)
+
+```rust
+// In attunement/idt.rs
+
+// IDT in .rune section (read-only after boot!)
+#[link_section = ".rune"]
+static mut IDT: InterruptDescriptorTable = InterruptDescriptorTable::new();
+
+pub fn init() {
+    unsafe {
+        // During boot: Initialize IDT (still writable)
+        IDT.breakpoint.set_handler_fn(breakpoint_handler);
+        IDT.page_fault.set_handler_fn(page_fault_handler);
+        // ...
+
+        // Load IDT
+        IDT.load();
+
+        // NOTE: After seal_rune_section() is called,
+        // this IDT becomes read-only and cannot be modified!
+    }
+}
+```
+
+**Protection:**
+- Attacker can READ the IDT (see handler addresses) → Mitigated by ASLR
+- Attacker CANNOT WRITE to IDT → Hardware enforced (page fault)
+- Even kernel bugs can't accidentally corrupt IDT after boot
+
+---
+
+## Security Properties
+
+### ✓ Defense-in-Depth
+
+The Rune of Permanence complements existing protections:
+
+| Protection | Defense Against | Layer |
+|------------|----------------|-------|
+| **W^X** | Code injection | Data ≠ Code |
+| **ASLR** | Address prediction | Randomization |
+| **Capability Sealing** | Capability forgery | Cryptography |
+| **Weaver's Sigil** | Stack overflows | Stack canaries |
+| **Rune of Permanence** | Data corruption | Immutability |
+
+### ✓ Hardware Enforcement
+
+- **Not bypassable in software:** MMU enforces at CPU level
+- **No performance overhead:** Page permissions checked in hardware
+- **Fail-secure:** Write attempts cause immediate page fault
+
+### ✓ Comprehensive Coverage
+
+Protected structures include:
+- ✓ IDT (interrupt handlers)
+- ✓ GDT (segment descriptors)
+- ✓ Syscall dispatch table
+- ✓ Security policy flags
+- ✓ Kernel configuration constants
+- ✓ Function pointer tables
+
+### ⚠ Limitations
+
+**Not Protected:**
+- Runtime state (scheduler queues, memory allocators)
+- Performance statistics
+- Lock state
+
+**Attack Scenarios:**
+- **Physical memory access:** Attacker with DMA can modify memory
+  - **Mitigation:** Future IOMMU support
+- **Speculative execution bugs:** Spectre/Meltdown-class attacks
+  - **Mitigation:** CPU microcode updates, software mitigations
+- **Kernel exploits before sealing:** If attacker compromises kernel during boot
+  - **Mitigation:** Secure boot, measured boot
+
+---
+
+## Testing Strategy
+
+### Unit Tests
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_rune_section_exists() {
+        extern "C" {
+            static __rune_start: u8;
+            static __rune_end: u8;
+        }
+
+        let start = unsafe { &__rune_start as *const u8 as usize };
+        let end = unsafe { &__rune_end as *const u8 as usize };
+
+        assert!(end > start, "Rune section must have non-zero size");
+        assert!(start % 0x1000 == 0, "Rune section must be page-aligned");
+    }
+
+    #[test]
+    #[should_panic]
+    fn test_write_to_sealed_rune_causes_fault() {
+        #[link_section = ".rune"]
+        static mut TEST_VAR: u64 = 0;
+
+        unsafe {
+            // Initialize
+            TEST_VAR = 42;
+
+            // Seal
+            seal_rune_section();
+
+            // Attempt write (should page fault!)
+            TEST_VAR = 99; // ← PANIC!
+        }
+    }
+}
+```
+
+### Integration Tests
+
+```rust
+// In tests/permanence_test.rs
+
+#[test_case]
+fn test_idt_cannot_be_modified_after_boot() {
+    // Get IDT base address
+    let idtr = x86_64::instructions::tables::sidt();
+    let idt_base = idtr.base.as_ptr::<u8>();
+
+    // Attempt to write (should fail)
+    let result = std::panic::catch_unwind(|| unsafe {
+        core::ptr::write_volatile(idt_base, 0xFF);
+    });
+
+    assert!(result.is_err(), "Writing to IDT after sealing should panic");
+}
+```
+
+---
+
+## Implementation Phases
+
+### Phase 1: Linker Script (Week 1)
+- [ ] Add `.rune` section to `linker.ld`
+- [ ] Add `__rune_start` and `__rune_end` symbols
+- [ ] Verify section alignment (4KB pages)
+- [ ] Test that section is created and non-empty
+
+### Phase 2: Page Table Infrastructure (Week 1-2)
+- [ ] Implement `get_pte_for_address()` function
+- [ ] Implement `seal_rune_section()` function
+- [ ] Implement `flush_tlb()` function
+- [ ] Add debug logging for sealed pages
+- [ ] Test on dummy data before real structures
+
+### Phase 3: Move Critical Structures (Week 2-3)
+- [ ] Move IDT to `.rune` section
+- [ ] Move GDT to `.rune` section (if applicable)
+- [ ] Move syscall table to `.rune` (future)
+- [ ] Move security policy flags to `.rune`
+- [ ] Test each structure after migration
+
+### Phase 4: Boot Integration (Week 3)
+- [ ] Add sealing call to `kernel_main()`
+- [ ] Ensure all `.rune` structures initialized before sealing
+- [ ] Add boot message for sealing
+- [ ] Test that kernel boots successfully
+- [ ] Verify writes fail after sealing
+
+### Phase 5: Monitoring & Validation (Week 3-4)
+- [ ] Add page fault handler logging for .rune violations
+- [ ] Add Rune of Permanence status to `wards` command
+- [ ] Implement debug command to inspect page permissions
+- [ ] Create attack simulations (try to corrupt IDT, etc.)
+- [ ] Performance benchmarks (should be zero overhead)
+
+---
+
+## Eldarin Shell Integration
+
+### New Command: `permanence`
+
+Display protected structures and their status:
+
+```
+◈ The Rune of Permanence - Immutable Kernel Structures
+
+  Status: ✓ SEALED (hardware-enforced)
+  Protection: MMU Read-Only Pages
+
+  Protected Structures:
+    .rune section: 0x00120000 - 0x00124000 (16 KB)
+      Pages: 4 (all read-only)
+
+    ◈ Interrupt Descriptor Table (IDT)
+      Address: 0x00120000
+      Size: 4096 bytes
+      Status: ✓ Sealed (cannot modify handlers)
+
+    ◈ Global Descriptor Table (GDT)
+      Address: 0x00121000
+      Size: 256 bytes
+      Status: ✓ Sealed (cannot modify segments)
+
+    ◈ Security Policy
+      Address: 0x00121100
+      Status: ✓ Sealed
+        - Capability enforcement: ENABLED (permanent)
+        - W^X enforcement: ENABLED (permanent)
+        - Stack canaries: ENABLED (permanent)
+
+  Violations Detected: 0 (since boot)
+  Last Violation: None
+
+  The foundational laws remain unbroken. The Rune stands eternal.
+```
+
+### Update `wards` Command
+
+Add Rune of Permanence to the security overview:
+
+```rust
+// In wards_command.rs (Page 1)
+
+crate::println!("  Rune of Permanence (Immutable Structures): ✓ Active");
+crate::println!("    Protected: IDT, GDT, Security Policy");
+crate::println!("    Pages: 4 read-only");
+crate::println!();
+```
+
+---
+
+## Page Fault Handler Enhancement
+
+Detect writes to `.rune` section and provide helpful diagnostics:
+
+```rust
+// In attunement/idt_handlers.rs
+
+pub extern "x86-interrupt" fn page_fault_handler(
+    stack_frame: InterruptStackFrame,
+    error_code: PageFaultErrorCode,
+) {
+    use x86_64::registers::control::Cr2;
+
+    // Get the address that caused the fault
+    let fault_addr = Cr2::read().as_u64();
+
+    // Check if this was a write to the .rune section
+    extern "C" {
+        static __rune_start: u8;
+        static __rune_end: u8;
+    }
+    let rune_start = unsafe { &__rune_start as *const u8 as u64 };
+    let rune_end = unsafe { &__rune_end as *const u8 as u64 };
+
+    if fault_addr >= rune_start && fault_addr < rune_end {
+        if error_code.contains(PageFaultErrorCode::CAUSED_BY_WRITE) {
+            // Write to sealed section!
+            panic!(
+                "◈ RUNE VIOLATION: Attempt to modify permanent structure!\n\
+                 Address: 0x{:016x}\n\
+                 Section: .rune (read-only)\n\
+                 Error: Write to immutable memory after Dawn of Awakening\n\
+                 \n\
+                 The Rune of Permanence has been violated. The foundational \n\
+                 laws cannot be rewritten. The MMU denies this reality break.",
+                fault_addr
+            );
+        }
+    }
+
+    // Standard page fault handling...
+    panic!("Page fault at 0x{:016x}: {:?}", fault_addr, error_code);
+}
+```
+
+---
+
+## Future Enhancements
+
+### Incremental Sealing
+
+Instead of sealing everything at once, seal structures incrementally:
+
+```rust
+pub fn seal_idt() {
+    seal_range(&IDT as *const _ as u64, size_of::<IDT>());
+}
+
+pub fn seal_gdt() {
+    seal_range(&GDT as *const _ as u64, size_of::<GDT>());
+}
+```
+
+**Benefit:** More granular control, easier debugging.
+
+### Runtime Re-initialization (Emergency Mode)
+
+For debugging or emergency patches, temporarily unseal:
+
+```rust
+pub unsafe fn unseal_rune_section_emergency(auth_token: &EmergencyAuth) {
+    // Verify cryptographic auth token
+    if !verify_emergency_auth(auth_token) {
+        panic!("Unauthorized unseal attempt!");
+    }
+
+    // Log the event
+    log::warn!("EMERGENCY: Unsealing .rune section");
+
+    // Temporarily make writable
+    // ... (reverse the sealing process)
+}
+```
+
+**Use case:** Hot-patching critical vulnerabilities without reboot.
+
+### Signature Verification
+
+Before sealing, compute a cryptographic hash of `.rune` section:
+
+```rust
+pub fn seal_with_verification() {
+    // Compute hash before sealing
+    let hash = compute_rune_hash();
+
+    // Seal the section
+    seal_rune_section();
+
+    // Store hash in secure location
+    store_rune_hash(hash);
+}
+
+pub fn verify_rune_integrity() -> bool {
+    let current_hash = compute_rune_hash();
+    let stored_hash = retrieve_rune_hash();
+
+    constant_time_compare(&current_hash, &stored_hash)
+}
+```
+
+**Benefit:** Detect if `.rune` was modified before sealing (bootkit attack).
+
+---
+
+## References
+
+- **PaX CONSTIFY:** https://pax.grsecurity.net/docs/constify.txt
+- **Linux RODATA:** https://lwn.net/Articles/666550/
+- **x86_64 Paging:** Intel SDM Volume 3A, Chapter 4
+- **Rust Linker Scripts:** https://doc.rust-lang.org/rustc/codegen-options/index.html#link-args
+
+---
+
+*"The Rune of Permanence is etched not in ink, but in the silicon itself. It is enforced not by software, but by the immutable laws of the MMU. To break it is to break reality—and reality does not yield."*
+
+**Status:** 🚧 Design Complete, Implementation Pending
+**Priority:** High (Security Critical)
+**Estimated Effort:** 3-4 weeks
+**Dependencies:** Functional page table management

docs/WEAVERS_SIGIL_DESIGN.md

···
+# The Weaver's Sigil - Stack Canary Protection Design
+
+> *"Each thread weaves its own fate, and marks it with a sigil of purity. Should that mark be corrupted, the thread knows its fate has been tampered with by chaotic forces."*
+
+## Overview
+
+The Weaver's Sigil is AethelOS's implementation of **stack canary protection**, a runtime defense against buffer overflow attacks that attempt to overwrite return addresses on the stack.
+
+### The Philosophy
+
+In AethelOS, each thread is a strand in the Loom of Fate. When a thread begins weaving a new spell (calling a function), it places a unique **magical sigil** on its own thread of fate (the stack). This sigil is:
+
+- **Personal**: Unique per-thread to prevent cross-thread attacks
+- **Secret**: Unknown to userspace, preventing predictable overwrites
+- **Immutable**: Any change indicates corruption
+
+Before completing the spell (returning from the function), the thread inspects its sigil. If corrupted, the thread immediately enters **quarantine** (panic), containing the damage before it spreads.
+
+---
+
+## Security Model
+
+### Threat: Stack Buffer Overflows
+
+**Attack Vector:**
+```
+Stack Layout (grows downward):
+┌─────────────────┐ ← High addresses
+│  Return Address │ ← Attacker wants to overwrite this!
+├─────────────────┤
+│  Saved RBP      │
+├─────────────────┤
+│  Local Buffer   │ ← Overflow starts here
+└─────────────────┘ ← Low addresses
+```
+
+If an attacker can overflow `Local Buffer`, they can:
+1. Overwrite the saved return address
+2. Redirect execution to attacker-controlled code
+3. Gain arbitrary code execution
+
+### Defense: The Weaver's Sigil
+
+**Protected Stack Layout:**
+```
+Stack Layout (grows downward):
+┌─────────────────┐ ← High addresses
+│  Return Address │ ← Protected by canary below
+├─────────────────┤
+│  Saved RBP      │
+├─────────────────┤
+│ CANARY (8 bytes)│ ← The Weaver's Sigil! Random, secret value
+├─────────────────┤
+│  Local Buffer   │ ← Overflow must corrupt canary to reach return address
+└─────────────────┘ ← Low addresses
+```
+
+**Function Prologue (Entry):**
+```rust
+// 1. Load thread-local canary
+let canary = current_thread().sigil;
+
+// 2. Push canary onto stack
+push(canary);
+
+// 3. Continue with normal prologue (save RBP, allocate locals, etc.)
+```
+
+**Function Epilogue (Exit):**
+```rust
+// 1. Load canary from stack
+let stack_canary = pop_canary();
+
+// 2. Compare with thread-local canary
+if stack_canary != current_thread().sigil {
+    panic!("◈ SIGIL CORRUPTED: Stack overflow detected!");
+}
+
+// 3. Continue with normal epilogue (restore RBP, return)
+```
+
+---
+
+## Implementation Strategy
+
+### Phase 1: Infrastructure (Canary Storage)
+
+**Per-Thread Canary Storage:**
+
+Each `Thread` structure stores its unique Weaver's Sigil:
+
+```rust
+// In loom_of_fate/mod.rs
+pub struct Thread {
+    // ... existing fields ...
+
+    /// The Weaver's Sigil - unique per-thread stack canary
+    /// This value is secret and should never be exposed to userspace
+    pub(crate) sigil: u64,
+}
+```
+
+**Canary Generation:**
+
+Use existing entropy infrastructure (ChaCha8Rng with RDTSC):
+
+```rust
+// In loom_of_fate/mod.rs
+impl Thread {
+    pub fn new(entry_point: fn() -> !, priority: ThreadPriority) -> Self {
+        // Generate unique sigil for this thread
+        let sigil = {
+            let mut rng = mana_pool::entropy::ChaCha8Rng::from_hardware_fast();
+            let high = rng.next_u32() as u64;
+            let low = rng.next_u32() as u64;
+            (high << 32) | low
+        };
+
+        Thread {
+            // ... other fields ...
+            sigil,
+        }
+    }
+}
+```
+
+**Thread-Local Access:**
+
+Provide fast access to current thread's sigil:
+
+```rust
+// In loom_of_fate/mod.rs
+
+/// Get the current thread's Weaver's Sigil (stack canary)
+///
+/// # Safety
+/// This function is unsafe because it accesses thread-local state.
+/// It MUST only be called from kernel code, never exposed to userspace.
+#[inline(always)]
+pub unsafe fn get_current_sigil() -> u64 {
+    get_loom().lock().current_thread().sigil
+}
+```
+
+---
+
+### Phase 2: Compiler Integration
+
+Rust doesn't natively support stack canaries for custom targets like `x86_64-aethelos.json`. We have two approaches:
+
+#### Option A: LLVM Stack Protector (Preferred)
+
+Enable LLVM's built-in stack protector in our target JSON:
+
+```json
+{
+  "llvm-target": "x86_64-unknown-none",
+  "target-endian": "little",
+  "target-pointer-width": "64",
+  "features": "-mmx,-sse,+soft-float",
+  "disable-redzone": true,
+  "panic-strategy": "abort",
+
+  "stack-probes": {
+    "kind": "inline-or-call",
+    "min-llvm-version-for-inline": [16, 0, 0]
+  },
+
+  "// NEW": "Enable LLVM stack protector",
+  "stack-protector": "strong"
+}
+```
+
+**Stack Protector Modes:**
+- `"basic"` - Protect functions with buffers > 8 bytes
+- `"strong"` - Protect all functions with local arrays or address-taken locals
+- `"all"` - Protect ALL functions (performance overhead)
+
+**For AethelOS:** Use `"strong"` mode for security without protecting trivial functions.
+
+**Implement `__stack_chk_fail`:**
+
+LLVM expects a symbol `__stack_chk_fail` to be called when canary check fails:
+
+```rust
+// In lib.rs or boot.rs
+
+/// Stack canary failure handler
+/// Called by LLVM when a stack corruption is detected
+#[no_mangle]
+pub extern "C" fn __stack_chk_fail() -> ! {
+    // Log the corruption
+    serial_println!("◈ FATAL: The Weaver's Sigil has been corrupted!");
+    serial_println!("   Stack overflow detected. Thread integrity compromised.");
+
+    // Get current thread info for debugging
+    unsafe {
+        if let Some(thread) = loom_of_fate::get_current_thread_debug_info() {
+            serial_println!("   Thread: #{} ({})", thread.id, thread.name);
+            serial_println!("   Stack: 0x{:016x} - 0x{:016x}",
+                thread.stack_bottom, thread.stack_top);
+        }
+    }
+
+    // Panic with stack trace
+    panic!("Stack canary violation - buffer overflow detected!");
+}
+```
+
+**Implement `__stack_chk_guard`:**
+
+LLVM uses a global symbol `__stack_chk_guard` as the canary value. We need to provide this and populate it per-thread:
+
+```rust
+// In lib.rs
+
+/// Global stack canary value (thread-local via TLS)
+/// LLVM uses this symbol for stack protection
+#[no_mangle]
+pub static mut __stack_chk_guard: u64 = 0xDEADBEEF_CAFEBABE; // Placeholder
+
+/// Initialize stack canary for current thread
+/// Called when switching to a new thread
+pub unsafe fn init_thread_canary(thread_sigil: u64) {
+    core::ptr::write_volatile(&mut __stack_chk_guard, thread_sigil);
+}
+```
+
+**Thread Context Switch Integration:**
+
+Update scheduler to set canary when switching threads:
+
+```rust
+// In loom_of_fate/mod.rs - schedule() function
+
+fn schedule(&mut self) {
+    // ... existing scheduling logic ...
+
+    let next_thread = self.find_next_thread();
+
+    // Update stack canary for new thread
+    unsafe {
+        crate::init_thread_canary(next_thread.sigil);
+    }
+
+    // ... continue with context switch ...
+}
+```
+
+---
+
+#### Option B: Manual Instrumentation (Fallback)
+
+If LLVM stack protector doesn't work, we manually instrument critical functions:
+
+**Macro for Protected Functions:**
+
+```rust
+/// Macro to add stack canary protection to a function
+///
+/// Usage:
+/// ```
+/// #[stack_protected]
+/// fn vulnerable_function(buffer: &mut [u8]) {
+///     // ... potentially unsafe buffer operations ...
+/// }
+/// ```
+#[macro_export]
+macro_rules! stack_protected {
+    (fn $name:ident($($args:tt)*) -> $ret:ty $body:block) => {
+        fn $name($($args)*) -> $ret {
+            // Prologue: Save canary on stack
+            let __sigil = unsafe { $crate::loom_of_fate::get_current_sigil() };
+
+            // Execute function body
+            let __result = (|| $body)();
+
+            // Epilogue: Check canary
+            let __current_sigil = unsafe { $crate::loom_of_fate::get_current_sigil() };
+            if __sigil != __current_sigil {
+                panic!("Stack canary violation in {}", stringify!($name));
+            }
+
+            __result
+        }
+    };
+}
+```
+
+**Usage:**
+
+```rust
+stack_protected! {
+    fn parse_user_input(buffer: &mut [u8; 256]) -> Result<Command, ParseError> {
+        // Function is now protected by stack canary
+        // ...
+    }
+}
+```
+
+---
+
+### Phase 3: Kernel Integration
+
+**1. Boot Initialization:**
+
+```rust
+// In main.rs
+
+fn kernel_main() {
+    // ... existing init ...
+
+    // Initialize Weaver's Sigil protection
+    println!("◈ Weaving protective sigils...");
+    unsafe {
+        // Set initial canary for boot thread
+        let boot_sigil = 0xBADC0FFE_DEADBEEF; // Random initial value
+        crate::init_thread_canary(boot_sigil);
+    }
+    println!("  ✓ The Weaver's Sigil protects the kernel");
+
+    // ... continue boot ...
+}
+```
+
+**2. Thread Creation:**
+
+```rust
+// In loom_of_fate/mod.rs
+
+impl LoomOfFate {
+    pub fn spawn(&mut self, entry: fn() -> !, priority: ThreadPriority)
+        -> Result<ThreadId, LoomError> {
+
+        // Create thread (generates unique sigil)
+        let thread = Thread::new(entry, priority);
+
+        serial_println!("◈ New thread sigil: 0x{:016x}", thread.sigil);
+
+        // ... rest of spawn logic ...
+    }
+}
+```
+
+**3. Context Switch:**
+
+Already covered above - update `__stack_chk_guard` on every context switch.
+
+---
+
+### Phase 4: Userspace Protection (Future)
+
+When userspace processes are implemented:
+
+1. **Separate Canaries:** Each process has its own canary namespace
+2. **Syscall Barrier:** Kernel saves/restores `__stack_chk_guard` on syscall entry/exit
+3. **ASLR Integration:** Combine with ASLR for layered defense
+
+---
+
+## Security Properties
+
+### ✓ Defense-in-Depth
+
+The Weaver's Sigil complements existing AethelOS protections:
+
+| Protection | Defense Against | Status |
+|------------|----------------|--------|
+| **W^X** | Code injection | ✅ Active |
+| **ASLR** | Return-to-libc, ROP | ✅ Active |
+| **Capability Sealing** | Capability forgery | ✅ Active |
+| **Opaque Handles** | Direct capability manipulation | ✅ Active |
+| **Weaver's Sigil** | Stack buffer overflows | 🚧 Planned |
+
+### ✓ Entropy Quality
+
+- **Per-Thread:** Each thread has unique canary (64-bit)
+- **Source:** ChaCha8Rng seeded from RDTSC
+- **Renewal:** New canary on every thread creation
+- **Secret:** Never exposed to userspace
+
+### ✓ Performance
+
+- **LLVM Mode:** Negligible overhead (~1-3% for "strong" mode)
+- **Manual Mode:** Only protected functions pay cost
+- **Context Switch:** Single write to `__stack_chk_guard` (fast)
+
+### ⚠ Limitations
+
+**Not Defeated By:**
+- Blind overwrites (canary is random)
+- Partial overwrites (full 8 bytes checked)
+- Thread confusion (per-thread canaries)
+
+**Can Be Bypassed If:**
+- Attacker can read canary (info leak) → Mitigated by ASLR + secret storage
+- Attacker can write to arbitrary memory (skips canary check) → W^X prevents code injection
+- Attacker can corrupt heap metadata (not stack) → Future: heap canaries
+
+---
+
+## Testing Strategy
+
+### Unit Tests
+
+```rust
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_canary_generation() {
+        let thread1 = Thread::new(test_fn, ThreadPriority::Normal);
+        let thread2 = Thread::new(test_fn, ThreadPriority::Normal);
+
+        // Each thread should have unique sigil
+        assert_ne!(thread1.sigil, thread2.sigil);
+
+        // Sigils should be non-zero
+        assert_ne!(thread1.sigil, 0);
+        assert_ne!(thread2.sigil, 0);
+    }
+
+    #[test]
+    #[should_panic(expected = "Stack canary violation")]
+    fn test_canary_detection() {
+        // Simulate stack overflow by corrupting __stack_chk_guard
+        unsafe {
+            let original = __stack_chk_guard;
+            __stack_chk_guard = 0xDEADBEEF; // Corrupt!
+            __stack_chk_fail(); // Should panic
+        }
+    }
+}
+```
+
+### Integration Tests
+
+```rust
+// In tests/stack_overflow_test.rs
+
+#[test_case]
+fn test_stack_overflow_detection() {
+    // Create function with buffer overflow vulnerability
+    #[stack_protected]
+    fn vulnerable_function() {
+        let mut buffer = [0u8; 16];
+
+        // Simulate overflow (writes past buffer end)
+        unsafe {
+            core::ptr::write_bytes(buffer.as_mut_ptr(), 0xFF, 64);
+        }
+
+        // Should panic before reaching here
+    }
+
+    // Test should catch panic
+    let result = panic::catch_unwind(|| vulnerable_function());
+    assert!(result.is_err());
+}
+```
+
+---
+
+## Implementation Phases
+
+### Phase 1: Infrastructure (Week 1)
+- [ ] Add `sigil` field to `Thread` struct
+- [ ] Implement canary generation in `Thread::new()`
+- [ ] Add `get_current_sigil()` function
+- [ ] Write unit tests
+
+### Phase 2: LLVM Integration (Week 1-2)
+- [ ] Update `x86_64-aethelos.json` with `"stack-protector": "strong"`
+- [ ] Implement `__stack_chk_fail()` handler
+- [ ] Implement `__stack_chk_guard` global
+- [ ] Add `init_thread_canary()` function
+- [ ] Test compilation with canaries enabled
+
+### Phase 3: Scheduler Integration (Week 2)
+- [ ] Update context switch to set `__stack_chk_guard`
+- [ ] Update thread creation to initialize canary
+- [ ] Add boot-time canary initialization
+- [ ] Test thread switching preserves canaries
+
+### Phase 4: Validation & Monitoring (Week 2-3)
+- [ ] Add Weaver's Sigil status to `wards` command
+- [ ] Implement canary violation logging
+- [ ] Add debug command to inspect thread sigils
+- [ ] Performance benchmarks
+
+### Phase 5: Documentation (Week 3)
+- [ ] Update DESIGN.md with Weaver's Sigil section
+- [ ] Update CLAUDE.md with canary guidelines
+- [ ] Add security audit checklist
+- [ ] Create attack simulation tests
+
+---
+
+## Eldarin Shell Integration
+
+### New Command: `sigils`
+
+Display active Weaver's Sigils for debugging:
+
+```
+◈ The Weaver's Sigils - Stack Canary Protection
+
+  Mode: LLVM Strong (all functions with buffers)
+  Status: ✓ ACTIVE
+
+  Active Sigils:
+    Thread #0 (Boot):     0xDEADBEEF_CAFEBABE
+    Thread #1 (Shell):    0x12345678_9ABCDEF0
+    Thread #2 (Worker):   0xFEDCBA98_76543210
+    Thread #3 (Idle):     0xABCDEF01_23456789
+
+  Violations Detected: 0 (since boot)
+  Last Violation: None
+
+  The sigils remain pure. The threads weave in harmony.
+```
+
+### Update `wards` Command
+
+Add Weaver's Sigil to security status:
+
+```rust
+// In wards_command.rs
+
+pub fn show_wards_page(page: usize) {
+    match page {
+        0 => {
+            // ... existing W^X, ASLR output ...
+
+            // Weaver's Sigil Status
+            crate::println!("  Stack Canary Protection (Weaver's Sigil): ✓ Active");
+            crate::println!("    Mode: LLVM Strong (all functions with buffers)");
+            crate::println!("    Violations detected: 0");
+            crate::println!();
+
+            // ... rest of page ...
+        }
+    }
+}
+```
+
+---
+
+## Future Enhancements
+
+### Heap Canaries
+
+Extend sigil concept to heap allocations:
+
+```rust
+pub struct HeapObject {
+    size: usize,
+    sigil_prefix: u64,  // Before allocation
+    data: [u8],
+    sigil_suffix: u64,  // After allocation
+}
+```
+
+### Sigil Renewal
+
+Periodically refresh canaries to limit attack windows:
+
+```rust
+pub fn renew_sigil(thread: &mut Thread) {
+    thread.sigil = generate_new_canary();
+    unsafe {
+        if thread.id == current_thread_id() {
+            init_thread_canary(thread.sigil);
+        }
+    }
+}
+```
+
+### Safe Stack
+
+Separate safety-critical stack data (return addresses, saved registers) from unsafe data (buffers):
+
+```
+┌─────────────────┐
+│   Safe Stack    │ ← Return addresses, canaries
+│  (Protected)    │
+├─────────────────┤
+│  Unsafe Stack   │ ← Buffers, local variables
+│  (Unprotected)  │
+└─────────────────┘
+```
+
+---
+
+## References
+
+- **PaX STACKLEAK:** https://pax.grsecurity.net/docs/stackleak.txt
+- **GCC Stack Protector:** https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html
+- **LLVM SafeStack:** https://clang.llvm.org/docs/SafeStack.html
+- **Microsoft Control Flow Guard:** https://docs.microsoft.com/en-us/windows/win32/secbp/control-flow-guard
+
+---
+
+*"The Weaver's Sigil is not merely a guard—it is a promise. A promise that each thread's fate remains its own, untainted by the chaos of corruption."*
+
+**Status:** 🚧 Design Complete, Implementation Pending
+**Priority:** High (Security Critical)
+**Estimated Effort:** 2-3 weeks
+**Dependencies:** Existing entropy infrastructure (ChaCha8Rng)

heartwood/src/drivers/ata.rs

···
     /// Detect and initialize primary master drive (drive 0)
     /// Based on r3 kernel's ATA driver: https://github.com/Narasimha1997/r3
     pub fn detect_primary_master() -> Option<Self> {
-        Self::detect_drive(ATA_PRIMARY_BASE, 0)
+        unsafe { Self::detect_drive(ATA_PRIMARY_BASE, 0) }
     }
 
     /// Detect and initialize primary slave drive (drive 1)
     pub fn detect_primary_slave() -> Option<Self> {
-        Self::detect_drive(ATA_PRIMARY_BASE, 1)
+        unsafe { Self::detect_drive(ATA_PRIMARY_BASE, 1) }
     }
 
     /// Internal function to detect a drive on a specific bus and drive number
-    fn detect_drive(bus: u16, drive: u8) -> Option<Self> {
-
-        unsafe {
-            // Serial marker: 'A' = Starting detection
-            Self::debug_char(b'A');
+    ///
+    /// SAFETY: Performs raw I/O port access to detect and initialize ATA drives.
+    unsafe fn detect_drive(bus: u16, drive: u8) -> Option<Self> {
+        // Serial marker: 'A' = Starting detection
+        Self::debug_char(b'A');
 
-            // Step 0: Disable interrupts on ATA controller
-            // Write to Device Control Register (0x3F6): set nIEN bit (bit 1)
-            outb(0x3F6, 0x02);  // Disable interrupts
+        // Step 0: Disable interrupts on ATA controller
+        // Write to Device Control Register (0x3F6): set nIEN bit (bit 1)
+        outb(0x3F6, 0x02);  // Disable interrupts
 
-            // Step 1: Select drive (0xA0 = master, 0xB0 = slave)
-            let drive_select = 0xA0 | ((drive & 1) << 4);
-            outb(bus + ATA_REG_DRIVE, drive_select);
+        // Step 1: Select drive (0xA0 = master, 0xB0 = slave)
+        let drive_select = 0xA0 | ((drive & 1) << 4);
+        outb(bus + ATA_REG_DRIVE, drive_select);
 
             // Step 2: Wait 400ns for drive selection to settle
             for _ in 0..4 {
···
 
                 // Check for error bit
                 if (status & ATA_STATUS_ERR) != 0 {
+                    let error = inb(bus + ATA_REG_ERROR);
                     Self::debug_char(b'!');  // Error
                     Self::debug_hex(status);
+                    Self::debug_char(b'E');  // Error register
+                    Self::debug_hex(error);
                     return None;
                 }
 
···
             // If sector count is 0, use a default
             let sectors = if sectors > 0 { sectors } else { 2048 };
 
-            // Serial marker: 'Z' = Success!
-            Self::debug_char(b'Z');
+        // Serial marker: 'Z' = Success!
+        Self::debug_char(b'Z');
 
-            Some(AtaDrive {
-                bus,
-                drive,
-                sectors,
-                sector_size: 512,
-            })
-        }
+        Some(AtaDrive {
+            bus,
+            drive,
+            sectors,
+            sector_size: 512,
+        })
     }
 
     /// Write a debug string to COM1 serial port
+    ///
+    /// SAFETY: Must be called from unsafe context. Performs raw I/O port access.
     fn debug_str(s: &[u8]) {
-        unsafe {
-            for &byte in s {
-                while (inb(0x3FD) & 0x20) == 0 {}
-                outb(0x3F8, byte);
-            }
+        for &byte in s {
+            while (inb(0x3FD) & 0x20) == 0 {}
+            outb(0x3F8, byte);
         }
     }
 
     /// Write a debug character to COM1 serial port with compact prefix
+    ///
+    /// SAFETY: Must be called from unsafe context. Performs raw I/O port access.
     fn debug_char(c: u8) {
         // Use compact format: "*X " - write directly without waiting
         // to avoid potential conflicts with ATA port access
-        unsafe {
-            outb(0x3F8, b'*');
-            outb(0x3F8, c);
-            outb(0x3F8, b' ');
-        }
+        outb(0x3F8, b'*');
+        outb(0x3F8, c);
+        outb(0x3F8, b' ');
     }
 
     /// Write a byte as two hex digits to serial port
+    ///
+    /// SAFETY: Must be called from unsafe context. Performs raw I/O port access.
     fn debug_hex(value: u8) {
         const HEX: &[u8] = b"0123456789ABCDEF";
-        unsafe {
-            let high = (value >> 4) & 0x0F;
-            let low = value & 0x0F;
+        let high = (value >> 4) & 0x0F;
+        let low = value & 0x0F;
 
-            // Write directly without waiting
-            outb(0x3F8, b'=');
-            outb(0x3F8, b'0');
-            outb(0x3F8, b'x');
-            outb(0x3F8, HEX[high as usize]);
-            outb(0x3F8, HEX[low as usize]);
-        }
+        // Write directly without waiting
+        outb(0x3F8, b'=');
+        outb(0x3F8, b'0');
+        outb(0x3F8, b'x');
+        outb(0x3F8, HEX[high as usize]);
+        outb(0x3F8, HEX[low as usize]);
     }
 
     /// Send IDENTIFY command to drive
···
     /// Read a single sector (28-bit LBA)
     /// Read a single sector using PIO mode
     /// Based on r3 kernel's read_sectors_lba28()
-    fn read_sector_pio(&self, lba: u64) -> Result<Vec<u8>, BlockDeviceError> {
+    ///
+    /// SAFETY: Performs raw I/O port access to read sectors from ATA drive.
+    unsafe fn read_sector_pio(&self, lba: u64) -> Result<Vec<u8>, BlockDeviceError> {
         if lba >= self.sectors {
             return Err(BlockDeviceError::InvalidSector);
         }
 
-        unsafe {
-            // Wait for drive to not be busy
-            let mut timeout = 0;
+        // Wait for drive to not be busy
+        let mut timeout = 0;
             loop {
                 let status = inb(self.bus + ATA_REG_STATUS);
                 if status & ATA_STATUS_BSY == 0 {
···
             }
 
             // Convert to Vec<u8>
-            let mut buffer = Vec::with_capacity(512);
-            for word in data.iter() {
-                buffer.push((word & 0xFF) as u8);
-                buffer.push((word >> 8) as u8);
-            }
+        let mut buffer = Vec::with_capacity(512);
+        for word in data.iter() {
+            buffer.push((word & 0xFF) as u8);
+            buffer.push((word >> 8) as u8);
+        }
 
-            Ok(buffer)
-        }
+        Ok(buffer)
     }
 
     /// Wait for drive to not be busy (with timeout)
···
     }
 
     fn read_sector(&self, sector: u64) -> Result<Vec<u8>, BlockDeviceError> {
-        self.read_sector_pio(sector)
+        unsafe { self.read_sector_pio(sector) }
     }
 
     fn read_sectors(&self, start_sector: u64, count: u32) -> Result<Vec<u8>, BlockDeviceError> {

heartwood/src/eldarin.rs

···
         "preempt" => cmd_preempt(args),
         "uptime" => cmd_uptime(),
         "wards" => cmd_wards(),            // Security wards (ASLR, W^X)
+        "sigils" => cmd_sigils(),          // Weaver's Sigils (stack canaries)
         // Filesystem commands (Eldarin naming)
         "reveal" => cmd_vfs_ls(args),      // vfs-ls → reveal
         "recite" => cmd_vfs_cat(args),     // vfs-cat → recite
···
     // Test 1: Check filesystem info
     crate::println!();
     crate::println!("  3. Testing filesystem metadata...");
-    crate::println!("     Volume label: {}", fat32.bpb.volume_label);
-    crate::println!("     Filesystem: {}", fat32.bpb.fs_type);
+    crate::println!("     Volume label: {}",
+        core::str::from_utf8(&fat32.bpb.volume_label).unwrap_or("INVALID").trim_end());
+    crate::println!("     Filesystem: {}",
+        core::str::from_utf8(&fat32.bpb.fs_type).unwrap_or("INVALID").trim_end());
     crate::println!("     Bytes per sector: {}", fat32.bpb.bytes_per_sector);
     crate::println!("     Cluster size: {} bytes", fat32.bpb.cluster_size());
 
···
 
 /// VFS LS - List directory contents
 fn cmd_vfs_ls(args: &str) {
-    use crate::vfs::{FileSystem, Path};
+    use crate::vfs::Path;
     use crate::vfs::global as vfs_global;
 
     let path = if args.is_empty() { "/" } else { args.trim() };
···
 
 /// VFS CAT - Display file contents
 fn cmd_vfs_cat(args: &str) {
-    use crate::vfs::{FileSystem, Path};
+    use crate::vfs::Path;
     use crate::vfs::global as vfs_global;
 
     if args.is_empty() {
···
     // Delegate to the paged wards command with capability testing
     crate::wards_command::cmd_wards();
 }
+
+/// SIGILS - Display The Weaver's Sigils (stack canaries)
+fn cmd_sigils() {
+    crate::sigils_command::cmd_sigils();
+}

heartwood/src/lib.rs

···
 pub mod rtl;  // Runtime library with memcpy, etc.
 pub mod eldarin;  // The Eldarin Shell
 pub mod wards_command;  // Security wards command
+pub mod sigils_command;  // Weaver's Sigils command
+pub mod stack_protection;  // Stack canary runtime (LLVM support)
 pub mod irq_safe_mutex;  // Interrupt-safe mutex primitive
 pub mod vfs;  // Virtual File System layer
 pub mod drivers;  // Hardware device drivers

heartwood/src/loom_of_fate/scheduler.rs

···
             let from_ctx_ptr = &mut self.threads[from_idx].context as *mut ThreadContext;
             let to_ctx_ptr = &self.threads[to_idx].context as *const ThreadContext;
 
+            // Update The Weaver's Sigil (stack canary) for the new thread
+            // SECURITY: This MUST happen before the context switch so that
+            // LLVM-generated code in the new thread uses the correct canary
+            let next_sigil = self.threads[to_idx].sigil;
+            unsafe {
+                crate::stack_protection::set_current_canary(next_sigil);
+            }
+
             // Update current thread ID
             self.current_thread = Some(next_id);
             self.context_switches += 1;

heartwood/src/loom_of_fate/thread.rs

···
     #[allow(dead_code)]
     pub(crate) stack_top: u64,
 
+    /// The Weaver's Sigil - unique per-thread stack canary
+    /// This secret value protects against stack buffer overflows
+    /// It should NEVER be exposed to userspace
+    pub(crate) sigil: u64,
+
     // Harmony tracking
     pub(crate) resource_usage: ResourceUsage,
     pub(crate) harmony_score: f32,
···
         // Create initial context for this thread
         let context = ThreadContext::new(entry_point as u64, stack_top);
 
+        // Generate unique Weaver's Sigil (stack canary) for this thread
+        let sigil = Self::generate_sigil();
+
         // DEBUG: Verify context was created correctly
         crate::println!("  Thread::new - id={}, entry={:#x}, stack_top={:#x}, context.rsp={:#x}",
                        id.0, entry_point as u64, stack_top, context.rsp);
+        crate::println!("  Weaver's Sigil: 0x{:016x}", sigil);
 
         Self {
             id,
···
             context,
             stack_bottom,
             stack_top,
+            sigil,
             resource_usage: ResourceUsage::default(),
             harmony_score: 1.0, // Start in perfect harmony
             time_slices_used: 0,
             yields: 0,
             last_run_time: 0,
         }
+    }
+
+    /// Generate a unique Weaver's Sigil (stack canary) for this thread
+    ///
+    /// Uses ChaCha8 RNG seeded from hardware (RDTSC) to generate
+    /// a cryptographically strong 64-bit random value.
+    ///
+    /// # Security
+    /// This value MUST remain secret and never be exposed to userspace.
+    fn generate_sigil() -> u64 {
+        use crate::mana_pool::entropy::ChaCha8Rng;
+
+        let mut rng = ChaCha8Rng::from_hardware_fast();
+        let high = rng.next_u32() as u64;
+        let low = rng.next_u32() as u64;
+        (high << 32) | low
     }
 
     /// Get a mutable reference to the thread's context

heartwood/src/main.rs

···
     unsafe { mana_pool::sealing::init(); }
     println!("  ✓ Capability sealing ready (HMAC-SHA256)");
 
+    // Initialize The Weaver's Sigil (stack canary protection)
+    println!("◈ Weaving the protective sigils...");
+    unsafe {
+        // Set initial canary for boot thread
+        // This will be updated per-thread by the scheduler during context switches
+        use mana_pool::entropy::ChaCha8Rng;
+        let mut rng = ChaCha8Rng::from_hardware_fast();
+        let boot_sigil = ((rng.next_u32() as u64) << 32) | (rng.next_u32() as u64);
+        heartwood::stack_protection::set_current_canary(boot_sigil);
+    }
+    println!("  ✓ The Weaver's Sigil active (stack canary: LLVM strong mode)");
+    println!("    Protecting all functions with buffers or address-taken locals");
+
     // Initialize the Nexus (IPC)
     unsafe { serial_out(b'E'); }
     println!("◈ Opening the Nexus...");
···
     loom_of_fate::init();
     unsafe { serial_out(b'H'); }
     println!("  ✓ Loom ready");
+
+    // Initialize heap canaries (after thread creation to avoid early boot issues)
+    unsafe {
+        mana_pool::heap_canaries::init();
+    }
+    println!("  ✓ Heap canaries active (pre/post allocation protection)");
 
     // Initialize the Attunement Layer
     unsafe { serial_out(b'I'); }

heartwood/src/mana_pool/buddy.rs

···
 
     /// Allocate a block of at least `size` bytes
     ///
-    /// Returns the address of the allocated block, or None if out of memory
+    /// Returns the address of the allocated block (user data, after pre-canary),
+    /// or None if out of memory.
+    ///
+    /// Memory layout:
+    /// ```
+    /// [PRE_CANARY (8B)] [USER DATA (size)] [POST_CANARY (8B)]
+    /// ^                  ^
+    /// block address      returned address
+    /// ```
     pub fn allocate(&mut self, size: usize) -> Option<usize> {
         if size == 0 {
             return None;
         }
 
+        // Check if heap canaries are enabled
+        let canaries_enabled = super::heap_canaries::are_enabled();
+
+        // Add space for heap canaries only if enabled
+        let total_size = if canaries_enabled {
+            size + super::heap_canaries::TOTAL_CANARY_OVERHEAD
+        } else {
+            size
+        };
+
         // Find the order needed for this size
-        let needed_order = self.size_to_order(size);
+        let needed_order = self.size_to_order(total_size);
         if needed_order > MAX_ORDER {
             return None; // Allocation too large
         }
···
         // Split block if it's larger than needed
         self.split_block(block, alloc_order, needed_order);
 
-        Some(block.as_ptr() as usize)
+        let block_addr = block.as_ptr() as usize;
+
+        // Write heap canaries around the allocation (only if enabled)
+        if canaries_enabled {
+            unsafe {
+                super::heap_canaries::write_canaries(block_addr, size);
+            }
+            // Return pointer to user data (after pre-canary)
+            Some(block_addr + super::heap_canaries::CANARY_SIZE)
+        } else {
+            // Return block address directly (no canary offset)
+            Some(block_addr)
+        }
     }
 
     /// Deallocate a block
···
     /// # Safety
     ///
     /// The caller must ensure:
-    /// - `addr` was returned by a previous call to `allocate`
-    /// - `size` matches the size passed to `allocate`
+    /// - `addr` was returned by a previous call to `allocate` (points to user data)
+    /// - `size` matches the size passed to `allocate` (user data size, not including canaries)
     /// - The block has not already been deallocated
     pub unsafe fn deallocate(&mut self, addr: usize, size: usize) {
         if size == 0 {
             return;
         }
 
-        let order = self.size_to_order(size);
+        // Check if heap canaries are enabled
+        let canaries_enabled = super::heap_canaries::are_enabled();
+
+        let (block_addr, total_size) = if canaries_enabled {
+            // Calculate the actual block address (before pre-canary)
+            let blk_addr = addr - super::heap_canaries::CANARY_SIZE;
+
+            // Verify heap canaries before deallocation
+            if !super::heap_canaries::verify_canaries(blk_addr, size) {
+                panic!("◈ HEAP CORRUPTION: Canary violation detected during deallocation!\n\
+                       \n\
+                       Address: 0x{:016x}\n\
+                       Size: {} bytes\n\
+                       \n\
+                       The Weaver's Sigil has detected heap buffer overflow.\n\
+                       This allocation's protective canaries were corrupted.", addr, size);
+            }
+
+            // Calculate total size including canaries
+            (blk_addr, size + super::heap_canaries::TOTAL_CANARY_OVERHEAD)
+        } else {
+            // No canaries - addr is the block address, size is actual size
+            (addr, size)
+        };
+
+        let order = self.size_to_order(total_size);
         if order > MAX_ORDER {
             return;
         }
 
-        // Create a block at this address
-        let block = Block::new(addr);
+        // Create a block at the actual block address
+        let block = Block::new(block_addr);
 
         // Try to coalesce with buddy
         self.coalesce_and_free(block, order);

heartwood/src/mana_pool/heap_canaries.rs

···
+//! Heap Canaries - The Weaver's Sigil for Heap Protection
+//!
+//! Protects heap allocations from buffer overflows by placing canary values
+//! before and after each allocation. If a buffer overflow occurs, it will
+//! corrupt a canary, which is detected when the memory is freed.
+//!
+//! ## Philosophy
+//! Just as threads are protected by the Weaver's Sigil on the stack,
+//! heap allocations are guarded by sigils woven into the fabric of memory.
+//! Each allocation is wrapped in protective marks that reveal corruption.
+
+use crate::mana_pool::entropy::ChaCha8Rng;
+use core::sync::atomic::{AtomicU64, Ordering};
+
+/// Size of each canary (8 bytes)
+pub const CANARY_SIZE: usize = 8;
+
+/// Total overhead per allocation (pre-canary + post-canary)
+pub const TOTAL_CANARY_OVERHEAD: usize = CANARY_SIZE * 2;
+
+/// Global canary secret (XORed with allocation address for uniqueness)
+static CANARY_SECRET: AtomicU64 = AtomicU64::new(0);
+
+/// Statistics for heap canary violations
+static VIOLATIONS_DETECTED: AtomicU64 = AtomicU64::new(0);
+
+/// Enable/disable heap canary checking
+static CANARIES_ENABLED: AtomicU64 = AtomicU64::new(0);
+
+/// Check if heap canaries are currently enabled
+#[inline(always)]
+pub fn are_enabled() -> bool {
+    CANARIES_ENABLED.load(Ordering::Acquire) != 0
+}
+
+/// Initialize heap canary system
+///
+/// # Safety
+/// Must be called exactly once during kernel initialization
+pub unsafe fn init() {
+    // Generate a random canary secret
+    let mut rng = ChaCha8Rng::from_hardware_fast();
+    let secret = ((rng.next_u32() as u64) << 32) | (rng.next_u32() as u64);
+    CANARY_SECRET.store(secret, Ordering::Relaxed);
+
+    // Enable heap canaries
+    CANARIES_ENABLED.store(1, Ordering::Release);
+}
+
+/// Generate a canary value for a specific allocation address
+///
+/// The canary is unique per-allocation by XORing the secret with the address.
+/// This prevents an attacker from learning the canary from one allocation
+/// and using it to bypass protection in another.
+#[inline(always)]
+pub fn generate_canary(addr: usize) -> u64 {
+    let secret = CANARY_SECRET.load(Ordering::Relaxed);
+    secret ^ (addr as u64)
+}
+
+/// Write canaries around an allocation
+///
+/// Memory layout:
+/// ```
+/// [PRE_CANARY][USER DATA][POST_CANARY]
+///  8 bytes     size bytes  8 bytes
+/// ```
+///
+/// # Safety
+/// - `addr` must point to valid memory with at least `size + TOTAL_CANARY_OVERHEAD` bytes
+/// - Memory must be writable
+pub unsafe fn write_canaries(addr: usize, size: usize) {
+    let canary = generate_canary(addr);
+
+    // Write pre-canary before user data
+    let pre_canary_ptr = addr as *mut u64;
+    core::ptr::write_volatile(pre_canary_ptr, canary);
+
+    // Write post-canary after user data
+    let post_canary_ptr = (addr + CANARY_SIZE + size) as *mut u64;
+    core::ptr::write_volatile(post_canary_ptr, canary);
+}
+
+/// Verify canaries and detect heap corruption
+///
+/// Returns true if canaries are intact, false if corrupted
+///
+/// # Safety
+/// - `addr` must point to the start of an allocation (including pre-canary)
+/// - Memory must be readable
+pub unsafe fn verify_canaries(addr: usize, size: usize) -> bool {
+    // Skip verification if canaries not enabled yet (during early boot)
+    if CANARIES_ENABLED.load(Ordering::Acquire) == 0 {
+        return true;
+    }
+
+    let expected_canary = generate_canary(addr);
+
+    // Check pre-canary
+    let pre_canary_ptr = addr as *const u64;
+    let pre_canary = core::ptr::read_volatile(pre_canary_ptr);
+
+    // Check post-canary
+    let post_canary_ptr = (addr + CANARY_SIZE + size) as *const u64;
+    let post_canary = core::ptr::read_volatile(post_canary_ptr);
+
+    if pre_canary != expected_canary {
+        log_violation(addr, size, "PRE-CANARY", expected_canary, pre_canary);
+        return false;
+    }
+
+    if post_canary != expected_canary {
+        log_violation(addr, size, "POST-CANARY", expected_canary, post_canary);
+        return false;
+    }
+
+    true
+}
+
+/// Log a canary violation
+unsafe fn log_violation(_addr: usize, _size: usize, _location: &str, _expected: u64, _found: u64) {
+    // Track violation count
+    // Detailed logging is done in the panic message when deallocation fails
+    VIOLATIONS_DETECTED.fetch_add(1, Ordering::Relaxed);
+}
+
+/// Get the number of heap canary violations detected since boot
+pub fn violations_count() -> u64 {
+    VIOLATIONS_DETECTED.load(Ordering::Relaxed)
+}
+
+/// Get the current canary secret (for debugging only)
+///
+/// # Security Warning
+/// This should NEVER be exposed to userspace!
+pub fn get_canary_secret() -> u64 {
+    CANARY_SECRET.load(Ordering::Relaxed)
+}

heartwood/src/mana_pool/mod.rs

···
 pub mod entropy;  // Random number generation for ASLR
 pub mod aslr;     // Address Space Layout Randomization
 pub mod sealing;  // Cryptographic capability sealing
+pub mod heap_canaries;  // Heap buffer overflow protection
 
 pub use object_manager::{ObjectManager, ObjectHandle, ObjectType, ObjectInfo};
 pub use capability::{Capability, CapabilityRights, CapabilityId, SealedCapability};

heartwood/src/mana_pool/sealing.rs

···
 ///! - **Kernel-Only**: Secret key never leaves kernel space
 
 use core::mem::MaybeUninit;
-use crate::mana_pool::entropy::{HardwareRng, ChaCha8Rng};
+use crate::mana_pool::entropy::ChaCha8Rng;
 
 /// Capability sealer using HMAC-SHA256
 pub struct CapabilitySealer {

heartwood/src/sigils_command.rs

···
+/// SIGILS - Display The Weaver's Sigils (stack canaries) for all threads
+///
+/// This command shows the unique stack canary values protecting each thread.
+/// Each sigil is a 64-bit cryptographically random value that guards against
+/// buffer overflow attacks.
+
+pub fn cmd_sigils() {
+    use crate::loom_of_fate::{without_interrupts, ThreadState};
+    use alloc::vec::Vec;
+
+    crate::println!("◈ The Weaver's Sigils - Stack Canary Protection");
+    crate::println!();
+
+    crate::println!("  Status: ✓ ACTIVE (Phase 2: LLVM stack protection)");
+    crate::println!("  Mode: LLVM strong mode + per-thread canaries");
+    crate::println!("  Protection: All functions with buffers or address-taken locals");
+    crate::println!();
+
+    // Show current global canary value
+    let current_canary = crate::stack_protection::get_current_canary();
+    crate::println!("  Current __stack_chk_guard: 0x{:016x}", current_canary);
+    crate::println!();
+
+    // Get thread information
+    without_interrupts(|| {
+        unsafe {
+            let loom = crate::loom_of_fate::get_loom().lock();
+
+            // Collect threads (not fading)
+            let threads: Vec<_> = loom.threads.iter()
+                .filter(|t| !matches!(t.state, ThreadState::Fading))
+                .collect();
+
+            crate::println!("  Active Sigils ({} threads):", threads.len());
+            crate::println!();
+
+            for thread in threads {
+                let state_str = match thread.state {
+                    ThreadState::Weaving => "Weaving",
+                    ThreadState::Resting => "Resting",
+                    ThreadState::Tangled => "Tangled",
+                    ThreadState::Fading => "Fading",
+                };
+
+                let priority_str = match thread.priority {
+                    crate::loom_of_fate::ThreadPriority::Critical => "Critical",
+                    crate::loom_of_fate::ThreadPriority::High => "High",
+                    crate::loom_of_fate::ThreadPriority::Normal => "Normal",
+                    crate::loom_of_fate::ThreadPriority::Low => "Low",
+                    crate::loom_of_fate::ThreadPriority::Idle => "Idle",
+                };
+
+                crate::println!("    Thread #{} [{}|{}]",
+                    thread.id.0, state_str, priority_str);
+                crate::println!("      Sigil: 0x{:016x}", thread.sigil);
+                crate::println!();
+            }
+
+            // Verify uniqueness
+            let mut sigils: Vec<u64> = loom.threads.iter()
+                .filter(|t| !matches!(t.state, ThreadState::Fading))
+                .map(|t| t.sigil)
+                .collect();
+
+            let original_len = sigils.len();
+            sigils.sort_unstable();
+            sigils.dedup();
+            let unique_len = sigils.len();
+
+            if original_len == unique_len {
+                crate::println!("  ✓ All sigils are unique ({} distinct values)", unique_len);
+            } else {
+                crate::println!("  ✗ WARNING: {} duplicate sigils detected!",
+                    original_len - unique_len);
+            }
+
+            crate::println!();
+            crate::println!("  Protection Status:");
+            crate::println!("    [✓] Per-thread storage      - Active");
+            crate::println!("    [✓] Cryptographic generation - Active");
+            crate::println!("    [✓] Stack canary placement  - Active (LLVM inserts at function entry)");
+            crate::println!("    [✓] Overflow detection      - Active (LLVM checks before return)");
+            crate::println!();
+            crate::println!("  Phase 2 Complete: LLVM stack-protector (strong mode) is active.");
+            crate::println!("  All functions with buffers or address-taken locals are protected.");
+        }
+    });
+
+    // Heap Canary Status
+    crate::println!();
+    crate::println!("  Heap Protection (Buffer Overflow Detection):");
+    crate::println!("    [✓] Pre-allocation canaries  - Active (8 bytes before each allocation)");
+    crate::println!("    [✓] Post-allocation canaries - Active (8 bytes after each allocation)");
+
+    let violations = crate::mana_pool::heap_canaries::violations_count();
+    if violations == 0 {
+        crate::println!("    [✓] Violations detected      - None (heap integrity maintained)");
+    } else {
+        crate::println!("    [✗] Violations detected      - {} (HEAP CORRUPTION!)", violations);
+    }
+
+    crate::println!();
+    crate::println!("The sigils remain pure and distinct.");
+    crate::println!("Stack and heap are guarded by the Weaver's protective marks.");
+}

heartwood/src/stack_protection.rs

···
+//! Stack Protection Runtime Support
+//!
+//! This module provides the runtime support required by LLVM's stack protector.
+//! When `-fstack-protector` is enabled, LLVM generates code that:
+//! 1. Reads from `__stack_chk_guard` at function entry
+//! 2. Places the value on the stack (the canary)
+//! 3. Checks the value before function return
+//! 4. Calls `__stack_chk_fail()` if the canary was corrupted
+
+use core::sync::atomic::{AtomicU64, Ordering};
+
+/// Global stack canary value (thread-local via context switch)
+///
+/// LLVM-generated code reads this value at function entry and checks it
+/// at function exit. We update this value on every context switch to use
+/// the current thread's unique Weaver's Sigil.
+///
+/// # Security
+/// This value changes per-thread, making it harder for attackers to
+/// predict the canary. However, an attacker with arbitrary read can
+/// still extract it, which is why we combine this with ASLR and other
+/// defenses.
+#[no_mangle]
+pub static __stack_chk_guard: AtomicU64 = AtomicU64::new(0xDEADBEEF_CAFEBABE);
+
+/// Stack canary failure handler
+///
+/// This function is called by LLVM-generated code when a stack canary
+/// check fails, indicating that a buffer overflow has corrupted the stack.
+///
+/// # Behavior
+/// This function NEVER returns. It logs diagnostic information and then
+/// panics to prevent the corrupted thread from continuing execution.
+///
+/// # Safety
+/// This function is called by compiler-generated code in a potentially
+/// corrupted context. We must not trust any stack-allocated data and
+/// should minimize operations that might use corrupted state.
+#[no_mangle]
+pub extern "C" fn __stack_chk_fail() -> ! {
+    // Log the violation (use serial port directly to avoid stack operations)
+    unsafe {
+        log_canary_violation();
+    }
+
+    // Panic with a clear message
+    panic!("◈ STACK CANARY VIOLATION: The Weaver's Sigil has been corrupted!\n\
+           \n\
+           A buffer overflow has been detected. The thread's stack canary\n\
+           was overwritten, indicating memory corruption. Execution cannot\n\
+           continue safely.\n\
+           \n\
+           This protection prevented the overflow from hijacking control flow.\n\
+           The Weaver's Sigil stands vigilant.");
+}
+
+/// Log diagnostic information about the canary violation
+///
+/// This function is called from `__stack_chk_fail()` to provide debugging
+/// information about which thread detected the corruption.
+///
+/// # Safety
+/// Must be called with interrupts disabled to avoid corruption of diagnostic
+/// output. Avoids using the stack as much as possible.
+unsafe fn log_canary_violation() {
+    // Print to VGA (safer than serial which might use stack)
+    crate::println!("\n╔════════════════════════════════════════════════════════╗");
+    crate::println!("║  ⚠  STACK CANARY VIOLATION DETECTED  ⚠              ║");
+    crate::println!("╚════════════════════════════════════════════════════════╝");
+    crate::println!();
+    crate::println!("  The Weaver's Sigil has been corrupted!");
+    crate::println!("  A buffer overflow has overwritten the stack canary.");
+    crate::println!();
+
+    // Try to get current thread info (might fail if stack is corrupted)
+    // Note: We can't use catch_unwind in no_std, so if this fails, we'll panic anyway
+    if let Some(thread_id) = crate::loom_of_fate::current_thread() {
+        crate::println!("  Thread ID: {}", thread_id.0);
+    } else {
+        crate::println!("  Thread ID: <unable to determine>");
+    }
+
+    crate::println!();
+    crate::println!("  Expected canary: 0x{:016x}", __stack_chk_guard.load(Ordering::Relaxed));
+    crate::println!("  Actual canary:   <corrupted>");
+    crate::println!();
+    crate::println!("  This overflow was BLOCKED by The Weaver's Sigil.");
+    crate::println!("  Execution halted before control flow hijacking.");
+    crate::println!();
+
+    // Increment violation counter (if we have one in the future)
+    // CANARY_VIOLATIONS.fetch_add(1, Ordering::Relaxed);
+}
+
+/// Initialize the stack canary for a thread
+///
+/// This function should be called during context switch to update
+/// `__stack_chk_guard` with the current thread's unique sigil.
+///
+/// # Arguments
+/// * `sigil` - The thread's unique Weaver's Sigil (64-bit random value)
+///
+/// # Safety
+/// This function must be called during context switch, with interrupts
+/// disabled, to avoid race conditions where LLVM-generated code reads
+/// a canary from one thread while executing another thread's code.
+#[inline(always)]
+pub unsafe fn set_current_canary(sigil: u64) {
+    __stack_chk_guard.store(sigil, Ordering::Relaxed);
+}
+
+/// Get the current canary value
+///
+/// This is primarily for debugging and testing. Production code should
+/// not need to read this value directly (LLVM-generated code handles it).
+///
+/// # Returns
+/// The current value of `__stack_chk_guard`
+#[inline(always)]
+pub fn get_current_canary() -> u64 {
+    __stack_chk_guard.load(Ordering::Relaxed)
+}
+
+/// Test helper: Simulate a stack canary violation
+///
+/// This function is used in tests to verify that canary checking works.
+/// DO NOT call this in production code!
+#[cfg(test)]
+pub fn simulate_violation() -> ! {
+    __stack_chk_fail()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_canary_get_set() {
+        unsafe {
+            set_current_canary(0x1234567890ABCDEF);
+        }
+        assert_eq!(get_current_canary(), 0x1234567890ABCDEF);
+
+        unsafe {
+            set_current_canary(0xFEDCBA0987654321);
+        }
+        assert_eq!(get_current_canary(), 0xFEDCBA0987654321);
+    }
+
+    #[test]
+    fn test_canary_default() {
+        // Default value should be non-zero (our placeholder)
+        let default = get_current_canary();
+        assert_ne!(default, 0, "Canary should have non-zero default");
+    }
+
+    #[test]
+    #[should_panic(expected = "STACK CANARY VIOLATION")]
+    fn test_stack_chk_fail_panics() {
+        simulate_violation();
+    }
+}

heartwood/src/vfs/fat32/bpb.rs

···
     pub fsinfo_sector: u16,
     /// Backup boot sector location (usually 6, 0xFFFF if not present)
     pub backup_boot_sector: u16,
-    /// Volume label (11 characters, space-padded)
-    pub volume_label: String,
-    /// Filesystem type string (should be "FAT32   ")
-    pub fs_type: String,
+    /// Volume label (11 bytes, space-padded)
+    pub volume_label: [u8; 11],
+    /// Filesystem type string (8 bytes, should be "FAT32   ")
+    pub fs_type: [u8; 8],
     /// Cached FSInfo data (if available)
     pub fsinfo: Option<FSInfo>,
 }
···
         // Backup boot sector at offset 50 (usually 6)
         let backup_boot_sector = u16::from_le_bytes([boot_sector[50], boot_sector[51]]);
 
-        // Volume label at offset 71 (11 bytes)
-        let volume_label = core::str::from_utf8(&boot_sector[71..82])
-            .unwrap_or("INVALID    ")
-            .trim_end()
-            .to_string();
+        // Volume label at offset 71 (11 bytes) - copy directly, no String allocation
+        let mut volume_label = [0u8; 11];
+        volume_label.copy_from_slice(&boot_sector[71..82]);
 
         // Filesystem type at offset 82 (8 bytes, should be "FAT32   ")
-        let fs_type = core::str::from_utf8(&boot_sector[82..90])
-            .unwrap_or("UNKNOWN ")
-            .trim_end()
-            .to_string();
+        let mut fs_type = [0u8; 8];
+        fs_type.copy_from_slice(&boot_sector[82..90]);
 
         // Validate it's actually FAT32
-        if !fs_type.starts_with("FAT32") {
+        if !fs_type.starts_with(b"FAT32") {
             return Err("Filesystem type is not FAT32");
         }
 
···
     /// 2. If that fails, try the backup boot sector (if specified)
     /// 3. Parse FSInfo (if present and valid)
     pub fn from_device(device: &dyn BlockDevice) -> Result<Self, &'static str> {
+        // Debug: entering from_device
+        unsafe {
+            core::arch::asm!("out dx, al", in("dx") 0x3F8u16, in("al") b'A', options(nomem, nostack));
+        }
+
         // Try primary boot sector first
         let boot_sector_result = device.read_sector(0);
+
+        // Debug: read_sector returned
+        unsafe {
+            core::arch::asm!("out dx, al", in("dx") 0x3F8u16, in("al") b'B', options(nomem, nostack));
+        }
 
         let (boot_sector, used_backup) = match boot_sector_result {
             Ok(data) => {

heartwood/src/vfs/fat32/mod.rs

···
     /// * `Ok(Fat32)` - Successfully mounted FAT32 filesystem
     /// * `Err(FsError)` - Invalid or corrupted filesystem
     pub fn new(device: Box<dyn BlockDevice>) -> Result<Self, FsError> {
+        // Debug: entering Fat32::new
+        unsafe {
+            core::arch::asm!("out dx, al", in("dx") 0x3F8u16, in("al") b'1', options(nomem, nostack));
+        }
+
         let bpb = Fat32Bpb::from_device(&*device)
             .map_err(|_| FsError::IoError)?;
+
+        // Debug: BPB parsed successfully
+        unsafe {
+            core::arch::asm!("out dx, al", in("dx") 0x3F8u16, in("al") b'2', options(nomem, nostack));
+        }
 
         Ok(Self { device, bpb })
     }

heartwood/src/wards_command.rs

···
                             crate::println!("    ✓ Derived capability ID: {}", derived_id.raw());
 
                             // Store for page 2
-                            unsafe {
-                                STORED_CAP_ID = Some(cap_id);
-                                STORED_DERIVED_ID = Some(derived_id);
-                            }
+                            STORED_CAP_ID = Some(cap_id);
+                            STORED_DERIVED_ID = Some(derived_id);
                         }
                         Err(e) => {
                             crate::println!("    ✗ Derivation failed: {:?}", e);

heartwood/x86_64-aethelos.json

···
   "code-model": "kernel",
   "relocation-model": "static",
   "position-independent-executables": false,
-  "static-position-independent-executables": false
+  "static-position-independent-executables": false,
+  "supports-stack-protector": true
 }