Broken conditional

Concept

A broken conditional is a category of realistic hardware (RTL) bug characterized by incorrect conditional statements, such as missing cases or wrong conditions in `if`/`case` constructs, that lead to improper handling of exceptional cases or architecturally-visible misbehavior. In the ENCARSIA survey of open-source RISC-V CPU bug fixes, 66 of 177 relevant bugs (37%) were classified as broken conditionals.

First seen 7/13/2026

Last seen 7/13/2026

Evidence 7 chunks

Wiki v1

WIKI

Broken Conditional

Definition

A broken conditional is a class of realistic RTL (Register-Transfer Level) hardware bug in which a conditional statement — typically an if, case, or other conditional assignment — is constructed incorrectly. In the ENCARSIA study's bug taxonomy, broken conditionals are distinguished from signal mix-ups: they specifically concern the conditions guarding assignments rather than the values assigned. The bugs arise from designers:

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

1 connections

bug injection part of → 95% 2e

Broken conditionals are one of two categories of bugs that ENCARSIA injects.

LINKED ENTITIES

1 links

bug injection PART_OF Extracted graph relationship

CITATIONS

7 sources

7 citations — click to expand

[1] Broken conditionals are defined as issues arising from improper handling of exceptional cases or operations allowed only in a specific privilege mode, distinct from signal mix-ups. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[2] In the Encarsia survey of 177 relevant bug fixes across Ibex, CVA6, Rocket, BOOM, HACK@DAC'19 and HACK@DAC'21, 66 (37%) were broken conditionals and 111 (63%) were signal mix-ups. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[3] Broken conditionals in Yosys are represented as multiplexer trees, where they correspond to a missing branch or an incorrectly derived select signal. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[4] ENCARSIA injects broken conditionals via table transformations: removing rows models forgotten cases, turning select signals into X models insufficient constraints, and turning X into specific values models mistakenly placed constraints; these cover the entirety of broken-conditional bugs in the survey. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[5] The classification boundary places bugs that modify conditions (missing cases, wrong conditions) into broken conditionals and bugs that affect only the assigned values into signal mix-ups; bugs touching both may be classified as both. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[6] All architecturally observable bugs in the survey (including broken conditionals) could impact security, because attackers can deliberately create conditions where the bug yields an attacker-chosen architectural effect; forgotten privilege checks can create access-control vulnerabilities. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection

[7] When evaluated on ENCARSIA-injected bugs, DifuzzRTL, ProcessorFuzz and Cascade respectively detected 41.67%, 41.67% and 40% of the bugs within 24 hours. Encarsia: Evaluating CPU Fuzzers via Automatic Bug Injection