test: Add reorg<->mempool invariants related to CVE-2025-62861 #36841

1. 
   instagibbs commented at 7:08 PM on November 11, 2026: member

   Adds a functional test for regression coverage, then a couple targeted invariance Assum()s. Finally, fuzz harness changes to give more coverage of reorg behavior.

   Future work could include harness with a real chain and chain tip, and package_eval improvements to catch ephemeral dust policy regressions more directly.

2. test: reorg doesn't sibling-evict a TRUC child with a descendant

   Catches a revert of the CVE-2025-62861 fix (#33504): the evicted child's descendant is left spending a missing output.

   d223122202
3. validation: Assume reorg re-add never removes mempool transactions bbcf3bc0e3
4. validation: Assume reorg re-add rejections don't depend on mempool policy 217050c22e
5. fuzz: tx_pool: re-add the mined block through MaybeUpdateMempoolForReorg

   Runs the real reorg path, so its Assumes catch a re-add that evicts or rejects on policy.

   155d88289d
6. fuzz: tx_pool: add rejected transactions to the reorged block

   Gives the reorg block topologies the mempool won't build, catching e.g. CVE-2025-62861 (TRUC sibling eviction on reorg).

   f19656b94b
7. DrahtBot added the label Tests on Nov 11, 2026
8. 
   DrahtBot commented at 7:08 PM on November 11, 2026: contributor

   <!--e57a25ab6845829454e8d69fc972939a-->

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   <!--006a51241073e994b41acfe9ec718e94-->

   External sites

   • Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36841
   • Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36841.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36841#author-ralph

   <!--021abf342d371248e50ceaed478a90ca-->

   Reviews

   See the guideline and AI policy for information on the review process.

   Type	Reviewers
   ACK	mercie-ux
   Concept ACK	darosior, ismaelsadeeq

   If your review is incorrectly listed, please copy-paste <code>&lt;!--meta-tag:bot-skip--&gt;</code> into the comment that the bot should ignore.

   <!--5faf32d7da4f0f540f40219e4f7537a3-->

9. fanquake added this to the milestone 33.0 on Nov 11, 2026
10. 
    darosior commented at 10:07 PM on November 11, 2026: member

    Concept ACK

11. 
    mercie-ux commented at 8:47 AM on November 12, 2026: contributor

    Tested ACK f19656b94bb4822d38e842f7b1929f4ca148a445

    Verified that with sibling eviction re-enabled during reorg, the new test fails while test_truc_reorg still passes.

12. DrahtBot requested review from darosior on Nov 12, 2026
13. 
    ismaelsadeeq commented at 7:53 AM on November 13, 2026: member

    Concept ACK

14. 
    javierpmateos commented at 5:34 PM on November 13, 2026: none

    Tested f19656b

    Built with -DABORT_ON_FAILED_ASSUME. mempool_truc.py passes, including the new test_truc_reorg_no_sibling_eviction test.

    I ran 1,200 iterations with my two-node randomized reorg test (4 seeds, 3 configurations). This covered BIP68, double-spends, TRUC, coinbase spends, reorgs up to 20 blocks, and the invalid-block case where cleanup runs at a lower intermediate tip. About 10k transactions were in the disconnected blocks. Neither Assume() failed.

    I also checked that the checks actually fire. Making the mempool size check fail caused an abort right away. Removing TX_MISSING_INPUTS or TX_PREMATURE_SPEND from the allowed rejection cases also caused aborts (the latter with the coinbase variants). Reverted everything after each check.

    I didn't run or review the fuzzing changes, and haven't covered all the rejection cases yet (cluster limits, non-standard, witness).

    Scripts: https://gist.github.com/javierpmateos/358865d350735dd76bcf821b1fe1cac4 (mempool_reorg_twonode_random.py)

Review Requested
darosior

Milestone
33.0