mold 🦠: A Modern Linker in Rust 🦀
This report summarizes scanner evidence for rui314/mold, a Rust project with 17,707 GitHub stars. SynthScan examined 152,973 lines of code across 1594 source files, recording 508 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 9.3 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 425 finding(s).
Are imports declared and package/API names verified? 83 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 508 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 508 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | elf/symbol.rs | 1145 | ctx.got.hdr.shdr.sh_addr.get() | CODE |
| CRITICAL⚡ | elf/symbol.rs | 1156 | ctx.got.hdr.shdr.sh_addr.get() | CODE |
| CRITICAL⚡ | elf/symbol.rs | 1161 | ctx.got.hdr.shdr.sh_addr.get() | CODE |
| CRITICAL⚡ | elf/symbol.rs | 1166 | ctx.got.hdr.shdr.sh_addr.get() | CODE |
| CRITICAL⚡ | elf/symbol.rs | 1173 | return ctx.plt.hdr.shdr.sh_addr.get() + E::plt_entry_offset(ctx, idx); | CODE |
| CRITICAL⚡ | elf/symbol.rs | 1175 | ctx.pltgot.hdr.shdr.sh_addr.get() | CODE |
| CRITICAL | elf/passes.rs | 2767 | let offset = ctx.dynstr.hdr.shdr.sh_size.get(); | CODE |
| CRITICAL | elf/passes.rs | 2795 | ctx.dynstr.hdr.shdr.sh_size.set(end); | CODE |
| CRITICAL | elf/passes.rs | 2806 | ctx.dynsym.hdr.shdr.sh_info.set(num_locals as u32 + 1); | CODE |
| CRITICAL | elf/passes.rs | 3848 | let before = ctx.reldyn.hdr.shdr.sh_size.get(); | CODE |
| CRITICAL | elf/passes.rs | 3850 | if before != ctx.reldyn.hdr.shdr.sh_size.get() { | CODE |
| CRITICAL | elf/chunks/versym.rs | 34 | ctx.versym.hdr.shdr.sh_size.set(size); | CODE |
| CRITICAL | elf/chunks/versym.rs | 35 | ctx.versym.hdr.shdr.sh_link.set(ctx.dynsym.hdr.shndx); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 65 | let size = ctx.got.hdr.shdr.sh_size.get(); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 73 | ctx.got.hdr.shdr.sh_size.set(size.wrapping_add(increment)); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 78 | let size = ctx.got.hdr.shdr.sh_size.get(); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 82 | ctx.got.hdr.shdr.sh_size.set(size + word::<E>()); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 87 | let size = ctx.got.hdr.shdr.sh_size.get(); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 91 | ctx.got.hdr.shdr.sh_size.set(size + 2 * word::<E>()); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 104 | let size = ctx.got.hdr.shdr.sh_size.get(); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 108 | ctx.got.hdr.shdr.sh_size.set(size + 2 * word::<E>()); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 114 | let size = ctx.got.hdr.shdr.sh_size.get(); | CODE |
| CRITICAL⚡ | elf/chunks/got.rs | 116 | ctx.got.hdr.shdr.sh_size.set(size + 2 * word::<E>()); | CODE |
| CRITICAL | elf/chunks/got.rs | 305 | ctx.got.hdr.shdr.sh_addr.get() + ent.idx as u64 * word::<E>(), | CODE |
| CRITICAL | elf/chunks/gotplt.rs | 50 | write(buf, i + 3, ctx.plt.hdr.shdr.sh_addr.get()); | CODE |
| CRITICAL | elf/chunks/pltgot.rs | 44 | ctx.pltgot.hdr.shdr.sh_size.set(size); | CODE |
| CRITICAL | elf/chunks/relplt.rs | 53 | let ptr = ctx.plt.hdr.shdr.sh_addr.get() | CODE |
| CRITICAL | elf/chunks/dynsym.rs | 66 | ctx.dynsym.hdr.shdr.sh_link.set(ctx.dynstr.hdr.shndx); | CODE |
| CRITICAL | elf/chunks/dynsym.rs | 67 | ctx.dynsym.hdr.shdr.sh_size.set(size); | CODE |
| CRITICAL | elf/chunks/plt.rs | 54 | ctx.plt.hdr.shdr.sh_size.set(if n == 0 { | CODE |
| CRITICAL | elf/chunks/reldyn.rs | 131 | let old_size = ctx.reldyn.hdr.shdr.sh_size.get() as usize; | CODE |
| CRITICAL | elf/chunks/reldyn.rs | 144 | ctx.reldyn.hdr.shdr.sh_size.set(size); | CODE |
| CRITICAL | elf/chunks/reldyn.rs | 145 | ctx.reldyn.hdr.shdr.sh_link.set(ctx.dynsym.hdr.shndx); | CODE |
| CRITICAL | elf/chunks/mod.rs | 520 | if ctx.sframe.hdr.shdr.sh_size.get() != 0 && ctx.chunks.contains(&ChunkId::SFrame) { | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 81 | if ctx.reldyn.hdr.shdr.sh_size.get() != 0 { | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 88 | define(rel, ctx.reldyn.hdr.shdr.sh_addr.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 89 | define(relsz, ctx.reldyn.hdr.shdr.sh_size.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 91 | define(rel, ctx.reldyn.hdr.shdr.sh_addr.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 92 | define(relsz, ctx.reldyn.hdr.shdr.sh_size.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 129 | if ctx.dynsym.hdr.shdr.sh_size.get() != 0 { | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 130 | define(DT_SYMTAB, ctx.dynsym.hdr.shdr.sh_addr.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 133 | if ctx.dynstr.hdr.shdr.sh_size.get() != 0 { | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 134 | define(DT_STRTAB, ctx.dynstr.hdr.shdr.sh_addr.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 135 | define(DT_STRSZ, ctx.dynstr.hdr.shdr.sh_size.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 155 | if ctx.versym.hdr.shdr.sh_size.get() != 0 { | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 156 | define(DT_VERSYM, ctx.versym.hdr.shdr.sh_addr.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 158 | if ctx.verneed.hdr.shdr.sh_size.get() != 0 { | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 159 | define(DT_VERNEED, ctx.verneed.hdr.shdr.sh_addr.get()); | CODE |
| CRITICAL⚡ | elf/chunks/dynamic.rs | 160 | define(DT_VERNEEDNUM, ctx.verneed.hdr.shdr.sh_info.get() as u64); | CODE |
| CRITICAL | elf/chunks/sframe_reloc.rs | 40 | let r_offset = ctx.sframe.hdr.shdr.sh_addr.get() | CODE |
| CRITICAL | elf/chunks/verneed.rs | 117 | ctx.verneed.hdr.shdr.sh_info.set(builder.num_groups); | CODE |
| CRITICAL | elf/chunks/verneed.rs | 182 | ctx.verneed.hdr.shdr.sh_size.set(size); | CODE |
| CRITICAL | elf/chunks/verneed.rs | 183 | ctx.verneed.hdr.shdr.sh_link.set(ctx.dynstr.hdr.shndx); | CODE |
| CRITICAL | elf/arch/sparc64.rs | 202 | let plt = ctx.plt.hdr.shdr.sh_addr.get(); | CODE |
| CRITICAL | elf/arch/sparc64.rs | 400 | let got = ctx.got.hdr.shdr.sh_addr.get(); | CODE |
| CRITICAL | elf/arch/arm64.rs | 232 | let plt = ctx.plt.hdr.shdr.sh_addr.get(); | CODE |
| CRITICAL | elf/arch/arm64.rs | 447 | let got = ctx.got.hdr.shdr.sh_addr.get(); | CODE |
| CRITICAL | elf/arch/sh4.rs | 178 | let got = u64::from(ctx.got.hdr.shdr.sh_addr.get()); | CODE |
| CRITICAL | elf/arch/sh4.rs | 210 | gotplt.wrapping_sub(u64::from(ctx.got.hdr.shdr.sh_addr.get())) as u32, | CODE |
| CRITICAL | elf/arch/sh4.rs | 242 | got.wrapping_sub(u64::from(ctx.got.hdr.shdr.sh_addr.get())) as u32, | CODE |
| 23 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | dist.sh | 1 | #!/bin/bash | COMMENT |
| LOW | dist.sh | 21 | # Neither do the musl builds, which are built on Alpine Linux. Alpine keeps | COMMENT |
| LOW | macho/symbol.rs | 61 | /// slice - mold's name_ptr/name_len. Read through name(). | COMMENT |
| LOW | macho/symbol.rs | 81 | /// The boolean attributes, packed into one atomic word as mold | COMMENT |
| LOW | macho/symbol.rs | 381 | } | COMMENT |
| LOW | macho/symbol.rs | 421 | /// dylib or bundle, by flat lookup (an image loaded before it may), | COMMENT |
| LOW | macho/symbol.rs | 541 | /// every loaded image for the coalesced definition - rather than | COMMENT |
| LOW | macho/symbol.rs | 601 | } else { | COMMENT |
| LOW | macho/symbol.rs | 761 | /// each `NO_IDX` when absent. Only the few symbols that take a slot | COMMENT |
| LOW | macho/symbol.rs | 801 | /// symbol table: keys carry their xxh3 hash, computed in parallel | COMMENT |
| LOW | macho/arch.rs | 21 | /// How LC_SEGMENT_SPLIT_INFO records a reference a relocation type | COMMENT |
| LOW | macho/arch.rs | 41 | /// initializes at its first use (see lazy_load::create_lazy_loads and | COMMENT |
| LOW | macho/arch.rs | 101 | const PAGE_SIZE: u64; | COMMENT |
| LOW | macho/arch.rs | 121 | /// alignment of __delay_stubs and __delay_helper. | COMMENT |
| LOW | macho/arch.rs | 141 | const RELOC_GOT_LOADS: &'static [u8]; | COMMENT |
| LOW | macho/arch.rs | 181 | /// reference loads the slot's pointer (arm64's adrp, or the ldr | COMMENT |
| LOW | macho/arch.rs | 201 | /// Writes the __TEXT,__stub_helper section: the header that pushes | COMMENT |
| LOW | macho/arm64.rs | 1421 | // code branches to one of its own (see LazyUse::Load and | COMMENT |
| LOW | macho/cmdline.rs | 61 | /// A file path a -filelist gives, which ld-prime takes as it is, | COMMENT |
| LOW | macho/cmdline.rs | 81 | Path(PathBuf), | COMMENT |
| LOW | macho/cmdline.rs | 101 | /// -hidden-l, -hidden_framework, -load_hidden: an archive whose | COMMENT |
| LOW | macho/cmdline.rs | 121 | NoMerge, | COMMENT |
| LOW | macho/cmdline.rs | 201 | #[derive(Debug)] | COMMENT |
| LOW | macho/cmdline.rs | 241 | /// The output file type: MH_EXECUTE, MH_DYLIB, MH_BUNDLE, | COMMENT |
| LOW | macho/cmdline.rs | 281 | pub load_objc: bool, | COMMENT |
| LOW | macho/cmdline.rs | 301 | pub map: Option<PathBuf>, | COMMENT |
| LOW | macho/cmdline.rs | 321 | pub no_fixup_chains: bool, | COMMENT |
| LOW | macho/cmdline.rs | 341 | /// lasts; 0 for libLTO's default. | COMMENT |
| LOW | macho/cmdline.rs | 361 | /// -v: print the version and the search paths. | COMMENT |
| LOW | macho/cmdline.rs | 381 | /// -version_load_command: give a -static image LC_BUILD_VERSION. | COMMENT |
| LOW | macho/cmdline.rs | 401 | /// -data_const / -no_data_const: whether read-only-after-fixup data | COMMENT |
| LOW | macho/cmdline.rs | 421 | /// though dyld refuses to load an image without one. | COMMENT |
| LOW | macho/cmdline.rs | 441 | /// object references weakly (weak_import). | COMMENT |
| LOW | macho/cmdline.rs | 461 | /// -force_symbols_weak_list / -force_symbols_not_weak_list: the | COMMENT |
| LOW | macho/cmdline.rs | 481 | /// warning unless given). | COMMENT |
| LOW | macho/cmdline.rs | 501 | /// device's image): the image's code may be encrypted after the | COMMENT |
| LOW | macho/cmdline.rs | 521 | /// load costs every process (resolved at the end of parsing). | COMMENT |
| LOW | macho/cmdline.rs | 541 | /// -no_compact_unwind: no __unwind_info; the image unwinds by its | COMMENT |
| LOW | macho/cmdline.rs | 561 | /// variable, which marks it too) makes that the default, which | COMMENT |
| LOW | macho/cmdline.rs | 581 | /// in the search path in its Versions/Current too. | COMMENT |
| LOW | macho/cmdline.rs | 601 | pub order_file_statistics: bool, | COMMENT |
| LOW | macho/cmdline.rs | 621 | /// output section whatever its members ask for. | COMMENT |
| LOW | macho/cmdline.rs | 641 | /// $LD_TRACE_SYMBOLS_DIR: the directory -trace_symbols_file's record | COMMENT |
| LOW | macho/cmdline.rs | 661 | pub dylib_subtypes_must_match: bool, | COMMENT |
| LOW | macho/cmdline.rs | 681 | /// header's; a -segaddr for __TEXT sets it too. resolve_image_base | COMMENT |
| LOW | macho/cmdline.rs | 701 | /// the file, as regular sections. | COMMENT |
| LOW | macho/cmdline.rs | 721 | /// modification times. | COMMENT |
| LOW | macho/cmdline.rs | 741 | pub text_exec: bool, | COMMENT |
| LOW | macho/cmdline.rs | 761 | /// Xcode builds a MERGEABLE_LIBRARY. | COMMENT |
| LOW | macho/cmdline.rs | 781 | /// -no_dwarf_unwind: leave the inputs' __eh_frame out of the output | COMMENT |
| LOW | macho/cmdline.rs | 2781 | /// $LD_DYLIB_CPU_SUBTYPES_MUST_MATCH give one, names one of the CPU | COMMENT |
| LOW | macho/cmdline.rs | 3061 | // -no_fixup_chains for them. | COMMENT |
| LOW | macho/cmdline.rs | 3241 | } | COMMENT |
| LOW | macho/cmdline.rs | 3561 | COMMENT | |
| LOW | macho/icf.rs | 1 | //! This file implements identical code folding: it merges functions whose | COMMENT |
| LOW | macho/icf.rs | 221 | COMMENT | |
| LOW | macho/lto.rs | 1 | //! This file implements link-time optimization (LTO). As with ELF, when | COMMENT |
| LOW | macho/lto.rs | 141 | // SAFETY: T is a function pointer type of the same size as the | COMMENT |
| LOW | macho/lto.rs | 361 | /// What the command line asks of ThinLTO. | COMMENT |
| LOW | macho/lto.rs | 621 | /// A bitcode file LTO compiled, as the passes after LTO still see it | COMMENT |
| 351 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | dist.sh | 147 | # Create a Podman image containing the native C tools and a pinned Rust | COMMENT |
| MEDIUM | tests/elf/shuffle-sections.sh | 11 | # Create a lot of sections to lower the probability that | COMMENT |
| MEDIUM | tests/elf/shuffle-sections-seed.sh | 11 | # Create a lot of sections to lower the probability that | COMMENT |
| MEDIUM | tests/elf/as-needed-gc.sh | 4 | # Create a shared library | COMMENT |
| MEDIUM | tests/elf/as-needed-gc.sh | 9 | # Create an object file with a dead function referencing foo(), | COMMENT |
| MEDIUM | tests/elf/lto-unclaimed.sh | 7 | # Create a fake LLVM bitcode file | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/macho.yml | 20 | # the harness runs every test natively and again under Rosetta. | COMMENT |
| MEDIUM | .github/workflows/macho.yml | 37 | # The unit tests, then the shell tests with twice the harness's | COMMENT |
| MEDIUM | .github/workflows/macho.yml | 48 | # The harness reports only which tests failed; each test's log | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | elf/chunks/gotplt.rs | 44 | // The first slot of .got.plt points to _DYNAMIC, as requested by | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/elf/arch-x86_64-z-rewrite-endbr3.sh | 7 | # Check if Intel SDE CPU emulator is available | COMMENT |
| LOW | tests/elf/print-dependencies-crel.sh | 31 | # Set sh_type to SHT_CREL and sh_size to 4. They are at offsets 4 and 32 | COMMENT |
| LOW | tests/elf/arch-ppc64-opd-crel.sh | 35 | # Set sh_type to SHT_CREL and sh_size to 4. They are at offsets 4 and 32 | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/macho/dof-dump.py | 27 | CODE |