toolchain/60317: build.sh distribution sets fails with -pipe -O2 in CPUFLAGS

["bbartlomiej%gmail.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60317
>Category:       toolchain
>Synopsis:       build.sh distribution sets fails with -pipe -O2 in CPUFLAGS
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    toolchain-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jun 09 06:25:01 +0000 2026
>Originator:     Bart Krawczyk
>Release:        NetBSD 11.0_RC4
>Organization:
>Environment:
NetBSD vps 11.0_RC4 NetBSD 11.0_RC4 (GENERIC) #0: Tue May 12 04:23:51 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
When I tried to build distribution sets to test the fix for PR 60292 the build failed with:

--- dependall-../crypto/external/bsd/openssh/lib ---
 --- kexmlkem768x25519.pico ---
 In file included from 
 /home/bartek/netbsd/src/crypto/external/bsd/openssh/dist/kexmlkem768x25519.c:46:
 /home/bartek/netbsd/src/crypto/external/bsd/openssh/dist/libcrux_mlkem768_sha3.h: 
 In function 'libcrux_ml_kem_ind_cpa_unpacked_default_8b_1b':
 /home/bartek/netbsd/src/crypto/external/bsd/openssh/dist/libcrux_mlkem768_sha3.h:8112:11: 
 error: array subscript '<unnamed-unsigned:256>[0]' is partly outside 
 array bounds of 'uint8_t[2]' {aka 'unsigned char[2]'} [-Werror=array-bounds]
   8112 |   uint8_t uu____1[32U] = {0U};
        |           ^~~~~~~

 I used:

 ./build.sh -u -U -j6 tools distribution sets

 and my mk.conf:

 WRKOBJDIR=/var/tmp/pkg
 MAKE_JOBS=6
 CPUFLAGS+=-pipe -O2 -mtune=native -march=native
 PKG_DEFAULT_OPTIONS+= -avahi -pulseaudio -wayland dbus x11
 SKIP_LICENSE_CHECK= yes

It was suggested by Martin that it may be related to -pipe and that this should be raised as a separate PR.

After removing CPUFLAGS definition the build succeeded.

>How-To-Repeat:
- download clean netbsd-11-0-RC4 sources
- add -pipe -O2 to your CPUFLAGS in /etc/mk.conf
- build tools distribution sets with build.sh
>Fix: