@@ -15,7 +15,7 @@ Everything below here is machine-generated.  Good luck.
 
 Goal: find ≥100 real bugs in the x86 path through the default LLVM pass pipeline.
 
-**Status: 152 reproducible bugs (well past the 100 goal). 253 total catalog entries (~100 are source-confirmed only). 484+ pending candidate notes in `candidates/` not yet promoted.**
+**Status: 145 reproducible bugs (well past the 100 goal). 246 total catalog entries (~100 are source-confirmed only). 484+ pending candidate notes in `candidates/` not yet promoted.**
 
 Breakdown by repro kind:
 - crash (4): #071, #218, #222, #227
@@ -25,7 +25,7 @@ Breakdown by repro kind:
 - mir-diff (20): #124, #125, #196–#199, #208–#210, #213, #226, #231, #237, #238, #239, …
 - opt-diff (~110): all others
 
-Most reproducible bugs fall in: metadata loss (`!nontemporal`, `!invariant.load`, `!alias.scope`, `!range`, FMF, `samesign`, syncscope, `!unpredictable`, `!prof`), poison/refinement violations (#136/187/188/194/195/206/207/233/236/247/248/251/252/253), and PGO corruptions (#215, #216, #232).
+Most reproducible bugs fall in: metadata loss (`!nontemporal`, `!invariant.load`, `!alias.scope`, `!range`, FMF, `samesign`, syncscope, `!unpredictable`, `!prof`), poison/refinement violations (#136/187/188/194/195/206/207/233/236/248/251/252/253), and PGO corruptions (#215, #216, #232).
 
 
 ## Tools
@@ -158,18 +158,13 @@ Most reproducible bugs fall in: metadata loss (`!nontemporal`, `!invariant.load`
 | 109 | [109-memcpyopt-memsetmemcpy-drops-volatile-memset](bugs/109-memcpyopt-memsetmemcpy-drops-volatile-memset/) | MemCpyOpt processMemSetMemCpyDependence | volatile memset followed by memcpy: original deleted, replacement non-volatile (and equal-size case deletes outright) | confirmed (opt diff) |
 | 110 | [110-gisel-usube-inverted-borrow-sub128](bugs/110-gisel-usube-inverted-borrow-sub128/) | X86 GISel selectUAddSub (G_USUBE) | i128 sub: `setb; cmpb $1` inverts borrow → sbb adds 1 to high half | repro (runtime, GISel-only — `-global-isel` not default) |
 | 111 | [111-lower-atomic-drops-volatile-rmw-cmpxchg](bugs/111-lower-atomic-drops-volatile-rmw-cmpxchg/) | Transforms/Utils/LowerAtomic | `lower-atomic` lowers `atomicrmw volatile`/`cmpxchg volatile` into non-volatile load+store; volatile/ordering/syncscope dropped | repro (opt diff, pass not in default x86 pipeline) |
-| 112 | [112-fp-round-of-fp-extend-elides-snan-quieting](bugs/112-fp-round-of-fp-extend-elides-snan-quieting/) | DAGCombiner visitFP_ROUND | `(float)(double)x` round-trip folded to identity without FMF; IEEE-754 mandates sNaN→qNaN quieting on each convertFormat | confirmed (asm) |
 | 113 | [113-avx512-mask-arith-ss-sd-round-cur-direction-mxcsr](bugs/113-avx512-mask-arith-ss-sd-round-cur-direction-mxcsr/) | X86InstCombineIntrinsic | mask scalar `add/sub/mul/div.ss/sd.round` with rounding=4 (CUR_DIRECTION) folded to plain fadd, losing MXCSR-set rounding | confirmed (opt diff) |
 | 114 | [114-gvnsink-merges-volatile-stores](bugs/114-gvnsink-merges-volatile-stores/) | GVNSink ValueTable | volatile is included in expression hash; two equivalent volatile stores merged across branches into one sunk store | confirmed (opt diff) |
-| 115 | [115-simplifyfpbinop-snan-quieting-bypass-fmul](bugs/115-simplifyfpbinop-snan-quieting-bypass-fmul/) | SelectionDAG::simplifyFPBinop | `fmul X,1.0` / `fdiv X,1.0` fold to bare `retq` with no `nnan` check; sNaN bit-pattern + exception elided | confirmed (asm) |
-| 116 | [116-simplifyfpbinop-snan-quieting-bypass-fadd-neg0](bugs/116-simplifyfpbinop-snan-quieting-bypass-fadd-neg0/) | SelectionDAG::simplifyFPBinop | `fadd X,-0.0` / `fsub X,+0.0` likewise fold to `retq` (sister of #115) | confirmed (asm) |
-| 117 | [117-fdiv-neg1-snan-passthrough-via-xorps](bugs/117-fdiv-neg1-snan-passthrough-via-xorps/) | DAGCombiner visitFDIV→visitFMUL→visitFSUB | `fdiv X,-1.0` lowers to bare `xorps sign-mask` (no `divsd`); in-source FIXME at line 19057 | confirmed (asm) |
 | 118 | [118-sroa-drops-atomic-ordering](bugs/118-sroa-drops-atomic-ordering/) | Transforms/Scalar/SROA | predicate `if (LI.isVolatile()) NewLI->setAtomic(...)` should be `isAtomic()`; atomic seq_cst load/store reduced to plain access | confirmed (opt diff) |
 | 119 | [119-simplifycfg-merge-cond-stores-drops-atomic](bugs/119-simplifycfg-merge-cond-stores-drops-atomic/) | SimplifyCFG mergeConditionalStores | filters via `isUnordered()` (which accepts Unordered atomic) then emits plain `CreateStore`; atomic Unordered → plain store, racy access becomes UB | confirmed (opt diff) |
 | 120 | [120-simplifycfg-sink-merges-volatile-stores](bugs/120-simplifycfg-sink-merges-volatile-stores/) | SimplifyCFG SinkCommonCodeFromPredecessors | two volatile stores in mutually-exclusive branches sunk into one select+volatile-store; static count 2→1 violates LangRef volatile invariant | confirmed (opt diff) |
 | 121 | [121-simplifycfg-hoist-merges-volatile-loads](bugs/121-simplifycfg-hoist-merges-volatile-loads/) | SimplifyCFG hoistCommonCodeFromSuccessors | two volatile loads in mutually-exclusive branches hoisted to one unconditional volatile load | confirmed (opt diff) |
 | 122 | [122-simplifycfg-hoist-merges-seqcst-atomic-loads](bugs/122-simplifycfg-hoist-merges-seqcst-atomic-loads/) | SimplifyCFG hoistCommonCodeFromSuccessors | two `seq_cst` atomic loads in branches hoisted to one unconditional load; conditional→unconditional changes C++ S total order | confirmed (opt diff) |
-| 123 | [123-instcombine-constfold-nnan-ninf-returns-nan-inf-not-poison](bugs/123-instcombine-constfold-nnan-ninf-returns-nan-inf-not-poison/) | InstCombine ConstantFoldFPInstOperands | nnan/ninf FP op with NaN/Inf result folds to NaN/Inf constant instead of `poison` (LangRef: nnan+NaN result → poison) | confirmed (opt diff) |
 | 124 | [124-atomic-expand-load-to-cmpxchg-drops-volatile-syncscope](bugs/124-atomic-expand-load-to-cmpxchg-drops-volatile-syncscope/) | AtomicExpandPass expandAtomicLoadToCmpXchg | i128 atomic-volatile load with `singlethread` syncscope → cmpxchg without volatile + system-scope | confirmed (mir diff) |
 | 125 | [125-atomic-expand-store-to-xchg-drops-volatile-syncscope](bugs/125-atomic-expand-store-to-xchg-drops-volatile-syncscope/) | AtomicExpandPass expandAtomicStoreToXChg | i128 atomic-volatile store with `singlethread` → cmpxchg loop without volatile + system-scope; also inserts a bare non-volatile load of the dst | confirmed (mir diff) |
 | 126 | [126-licm-promote-drops-syncscope](bugs/126-licm-promote-drops-syncscope/) | LICM promoteLoopAccessesToScalars | preheader load and exit-block store dropped from `syncscope("singlethread")` to default System scope | confirmed (opt diff) |
@@ -202,7 +197,6 @@ Most reproducible bugs fall in: metadata loss (`!nontemporal`, `!invariant.load`
 | 153 | [153-dse-dominating-condition-drops-nontemporal](bugs/153-dse-dominating-condition-drops-nontemporal/) | DSE dominating-condition store merging | dropped `!nontemporal` on merged stores | confirmed (opt diff) |
 | 154 | [154-simplifycfg-sink-merges-two-volatile-seqcst-atomicrmw](bugs/154-simplifycfg-sink-merges-two-volatile-seqcst-atomicrmw/) | SimplifyCFG SinkCommonCodeFromPredecessors | volatile seq_cst `atomicrmw` instructions in mutually-exclusive branches sunk into one (sibling of #152) | confirmed (opt diff) |
 | 155 | [155-frexp-i64-libcall-stack-slot-overrun](bugs/155-frexp-i64-libcall-stack-slot-overrun/) | TargetLowering expandMultipleResultFPLibCall | `llvm.frexp.f64.i64` allocates 8-byte slot, libcall writes 4 (int), load reads 8 — uninitialized upper 4 bytes (info leak + wrong value) | confirmed (asm) |
-| 156 | [156-instcombine-fcmp-nnan-with-nan-folds-to-bool](bugs/156-instcombine-fcmp-nnan-with-nan-folds-to-bool/) | InstCombine fcmp w/ nnan + NaN constant | should be `poison` per LangRef nnan rules; instead folds to `true`/`false` | confirmed (opt diff) |
 | 157 | [157-dse-redundant-stores-of-existing-values-drops-nontemporal](bugs/157-dse-redundant-stores-of-existing-values-drops-nontemporal/) | DSE eliminateRedundantStoresOfExistingValues | `isIdenticalToWhenDefined` ignores metadata; merging two identical stores drops `!nontemporal` (different code path from #149/#153) | confirmed (opt diff) |
 | 158 | [158-sroa-memcpy-split-overrides-load-tbaa-nontemporal](bugs/158-sroa-memcpy-split-overrides-load-tbaa-nontemporal/) | SROA visitMemTransferInst split path | per-load `!tbaa`/`!nontemporal`/`!invariant.load` dropped + memcpy's broader TBAA substituted onto user loads | confirmed (opt diff) |
 | 159 | [159-sroa-phi-speculate-picks-aa-from-one-user](bugs/159-sroa-phi-speculate-picks-aa-from-one-user/) | SROA PHI speculation | AA tag picked from one user of the speculated PHI, applied to merged load — wrong for other users | confirmed (opt diff) |
@@ -293,7 +287,6 @@ Most reproducible bugs fall in: metadata loss (`!nontemporal`, `!invariant.load`
 | 244 | [244-scev-expander-drops-inrange-inbounds-on-gep](bugs/244-scev-expander-drops-inrange-inbounds-on-gep/) | SCEVExpander::expandAddToGEP | synthesized `%scevgep = getelementptr i8, ...` loses `inbounds` AND `inrange(-8, 24)` from source GEP | confirmed (opt diff) |
 | 245 | [245-instcombine-unpack-aggregate-drops-nontemporal-extra](bugs/245-instcombine-unpack-aggregate-drops-nontemporal-extra/) | InstCombine unpackStoreToAggregate | full enumeration of dropped kinds: `!nontemporal`, `!access_group`, `!invariant.group`, `!mem_parallel_loop_access`, `!DIAssignID` | confirmed (opt diff) |
 | 246 | [246-constantfolding-ldexp-i64-exponent-narrowed-to-int](bugs/246-constantfolding-ldexp-i64-exponent-narrowed-to-int/) | ConstantFolding.cpp:3715 ldexp i64 | `ldexp(1.0, i64 4294967330)` folded to `2^34` (i64→int narrowing wraps); expected `+inf` per LangRef | confirmed (opt diff) |
-| 247 | [247-constantfolding-bitcast-vector-poison-lane-folds-to-zero](bugs/247-constantfolding-bitcast-vector-poison-lane-folds-to-zero/) | ConstantFolding.cpp:79 foldConstVectorToAPInt | `bitcast <i16 0, i16 poison> to i32` treats poison lane as 0; downstream `icmp eq , 0` folds to `true` instead of poison | confirmed (opt diff) |
 | 248 | [248-instcombine-foldSelectIntoOp-ninf-mispropagated-to-new-select](bugs/248-instcombine-foldSelectIntoOp-ninf-mispropagated-to-new-select/) | InstCombineSelect.cpp:631 foldSelectIntoOp | `select c, fmul ninf(x,y), x` → `fmul (select ninf c, y, 1.0), x`; for `x=0,y=+inf,c=true` source returns NaN but new select returns +inf → poison | confirmed (opt diff) |
 | 249 | [249-function-attrs-ignores-operand-bundles](bugs/249-function-attrs-ignores-operand-bundles/) | FunctionAttrs.cpp:1903-1948 InstrBreaksNoFree/NoSync/NonThrowing | predicates use `CallBase::hasFnAttr` which ignores operand bundles; caller with `[ "side_effects"() ]` on leaf still infers `nofree nosync nounwind willreturn` | confirmed (opt diff) |
 | 250 | [250-simplifycfg-mergeConditionalStoreToAddress-drops-pstore-metadata](bugs/250-simplifycfg-mergeConditionalStoreToAddress-drops-pstore-metadata/) | SimplifyCFG.cpp:4409 mergeConditionalStoreToAddress | asymmetric combineMetadata + `SI->copyMetadata(*QStore)` drops PStore-only `!nontemporal`/`!tbaa`/...; `!invariant.group` special-case can taint merged store | confirmed (opt diff) |
 
@@ -1,6 +1,8 @@
 # Triage by Severity (upstream-impact focused)
 
-253 catalog entries. 152 reproducible at default x86 -O2. ~100 source-confirmed only. Tiers below assigned by user-visible impact when the bug fires. Within each tier the bugs are ordered by "report-first" priority.
+246 catalog entries. 145 reproducible at default x86 -O2. ~100 source-confirmed only. Tiers below assigned by user-visible impact when the bug fires. Within each tier the bugs are ordered by "report-first" priority.
+
+(7 S2 entries previously listed have been removed: four pure sNaN-quieting losses (112, 115, 116, 117) — known LLVM limitation, not worth filing — and three "poison → concrete value" folds (123, 156, 247), which the LangRef explicitly permits: *"It is correct to replace a poison value with an undef value or any value of the type."*)
 
 ---
 
@@ -29,7 +31,7 @@ End-user observable wrong-value miscompiles. Highest non-crash severity.
 | **233** | ConstantFolding `llvm.fmuladd` folded as FMA, x86 lowers as `mulsd;addsd` | same IR yields `2^-104` (compile-time fold) vs `0.0` (runtime). Real value divergence visible by toggling constness. |
 | **003 / 110** | X86 GISel UADDE / USUBE inverted carry on multi-word add/sub | wrong upper word — only fires with `-global-isel` (NOT default on x86) |
 
-## S2 — Alive2-falsifiable poison/refinement miscompiles (~22) — turns defined value into poison, or over-infers a flag that makes downstream code poison
+## S2 — Alive2-falsifiable poison/refinement miscompiles (~20) — turns defined value into poison, or over-infers a flag that makes downstream code poison
 
 These are the strongest correctness-class non-runtime bugs. Several are already-known patterns getting independent confirmation; others are net-new.
 
@@ -48,23 +50,11 @@ These are the strongest correctness-class non-runtime bugs. Several are already-
 | **234** | InstSimplify strict-FP `constrained.fadd nnan` fold | drops FE_INVALID exception side-effect (strict-FP semantics violated) |
 | **236** | InstCombineSimplifyDemanded `ashr exact → lshr exact` | for `%x=-1`, source returns 255; target returns poison (anti-refinement) |
 | **246** | ConstantFolding `ldexp.f64.i64(1.0, 4294967330)` | folds to `2^34` instead of `+inf`; sibling of #011 in const-fold rather than libcall expand |
-| **247** | ConstantFolding `bitcast <i16 0, i16 poison> to i32` | treats poison lane as 0 — downstream `icmp eq , 0` → `true` instead of `poison` |
 | **248** | InstCombine `foldSelectIntoOp` ninf mis-propagation | `select c, fmul ninf(x,y), x` → `fmul (select ninf c, y, 1.0), x`; for x=0,y=+inf,c=true source returns NaN, new select returns +inf → poison |
 | **251** | CVP undef-tainted lattice | `select i1 %cmp, i64 undef, i64 1` taints lattice → CVP adds `range(i64 1,3)` AND `add nuw nsw`; both unsound for undef=INT_MAX (matches upstream #114902) |
 | **252** | JumpThreading `unfoldSelectInstr` branches on poison | original uses `freeze`; after JT, freeze is gone and `br i1 %maybe_poison` → UB |
 | **253** | InstCombine `foldAddLikeCommutative` | `or disjoint (add nsw A,5), (B&250)` → `add nsw A, (or B,5)`; disjoint only proves no unsigned carry, not signed — for a=100,b=130 source returns -21, target → poison |
 
-**Codegen sNaN-quieting losses (Alive2-falsifiable, IEEE-754 mandate):**
-
-| # | Bug |
-|---|-----|
-| **112** | `(float)(double)x` folded to identity without `nnan`; IEEE-754 requires quieting on every convertFormat |
-| **115** | DAG `simplifyFPBinop` `fmul X,1.0`/`fdiv X,1.0` folded to bare `ret` with no `nnan` check |
-| **116** | Same for `fadd X,-0.0`/`fsub X,+0.0` |
-| **117** | `fdiv X,-1.0` → bare `xorps sign-mask` (no `divsd`); in-source FIXME |
-| **123** | InstCombine ConstantFoldFPInstOperands: `nnan`/`ninf` op with NaN/Inf result folds to NaN/Inf constant instead of `poison` per LangRef |
-| **156** | InstCombine `fcmp nnan` with NaN constant folds to `true`/`false` instead of `poison` |
-
 **SeparateConstOffsetFromGEP, mem2reg, LICM (default O2 — UB-injection):**
 
 | # | Bug |
@@ -165,7 +155,7 @@ Mostly missed-optimizations downstream: `!nontemporal`, `!tbaa`, `!range`, `!inv
 - `JumpThreading` only forwards MD_prof (#214, #260–#263, #670)
 - `SDAG memcpy/memmove/memset getMemcpyLoadsAndStores` series (#208–#210, #460–#462, #510)
 
-(Full list: bugs #022, #023, #091, #103, #132, #133, #145, #146, #147, #149, #150, #153, #157, #163, #164, #165, #167, #168, #169, #170, #171, #172, #176, #177, #178, #179, #180, #183, #189, #196–#214, #228–#230, #237, #239, #241–#247, #250, #439, #460–#462, #485, #486, #489, …)
+(Full list: bugs #022, #023, #091, #103, #132, #133, #145, #146, #147, #149, #150, #153, #157, #163, #164, #165, #167, #168, #169, #170, #171, #172, #176, #177, #178, #179, #180, #183, #189, #196–#214, #228–#230, #237, #239, #241–#246, #250, #439, #460–#462, #485, #486, #489, …)
 
 ## S7 — Source-confirmed / latent (~100)
 
@@ -189,11 +179,10 @@ Annotated with upstream-issue status as of 2026-05-21:
 | **206** | `fmod(NaN)` → poison via mis-named `IsNoNan` | No duplicate. **Novel.** | File |
 | **207** | `fdim(±Inf,±Inf)` → qNaN | No duplicate. **Novel.** | File |
 | **236** | ashr exact → lshr exact anti-refinement | No duplicate. **Novel** (in-tree test `ashr_can_be_lshr` bakes in the buggy output and needs updating with the fix) | File |
-| **247** | `bitcast <i16 0, i16 poison>` poison-lane→0 | No duplicate. **Novel.** | File |
 | **251** | CVP undef-tainted lattice | **Duplicate**: open issue [#114902](https://github.com/llvm/llvm-project/issues/114902), still open and unfixed | Comment on existing issue with our `add nuw nsw` additional case |
 | **240** | X86 stack-probe skips one-page alloca | No duplicate. **Novel** (security mitigation defeated under `-fstack-clash-protection`) | File |
 | **253** | InstCombine `foldAddLikeCommutative` over-infers nsw from `or disjoint` | No duplicate. **Novel.** | File |
 
-**Net actionable**: 10 novel issues to file + 2 to comment on existing. The 2 duplicates (#071 #251) are both already known, so they don't need new issues — adding our reproducers as comments still has value.
+**Net actionable**: 9 novel issues to file + 2 to comment on existing. The 2 duplicates (#071 #251) are both already known, so they don't need new issues — adding our reproducers as comments still has value.
 
 Then in S3 batch, the most upstream-friendly cluster is the **shared-helper class** of fixes — see `ROOT_CAUSE_PATCHES.md`: 7 PRs in ~225 lines of code close ~40 of the ~85 S6 metadata-loss bugs.