lib/60744: memchr(3) is busticated

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60744
>Category:       lib
>Synopsis:       memchr(3) is busticated
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Sep 18 21:55:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The Memchr Foundation, Inc.
>Environment:
>Description:

	We have a very clever hand-written assembly memchr function --
	it gives answers very quickly, but sometimes the answers are
	wrong.  Clever, isn't it?

	For example, if s is a pointer to a NUL byte, memchr(s, 0, -1)
	should return s, but it does not -- it returns a null pointer:

$ cat memchr0.c
#include <string.h>

int
main(void)
{
	const char s[] = "";
	return (memchr(s, 0, (size_t)-1) == s ? 0 : 1);
}
$ cc -o memchr0 -fno-builtin -O2 memchr0.c
$ ./memchr0
$ echo $?
1

>How-To-Repeat:

	as above

>Fix:

	1. Add a test.
	2. Fix the size=-1 case and whatever else is broken on amd64.
	3. Audit all the other memchr.S files too.