linux-x64-baseline payload still contains POPCNT — SIGILL on pre-SSE4.2 CPUs

[shukebeta]

What happened

The linux-x64-baseline payload still contains a popcnt instruction, so it dies with SIGILL on a CPU older than SSE4.2 — exactly like the optimized build it is supposed to rescue.

The baseline fallback itself works: the launcher selected the baseline target and the metadata confirms it. The delivered binary is simply not baseline-clean.

This is distinct from #1288 / #1134, which are Windows CPUs that have SSE4.2 and only lack AVX2. Here the baseline binary was actually obtained, and the faulting instruction is identified.

Steps to reproduce

1. On an x86-64 CPU without popcnt/sse4_2 (Intel Core 2 Duo P8600, Penryn 2008), run npm install -g freebuff
2. Run freebuff — the launcher correctly downloads the baseline target
3. Confirm the target that was fetched:

$ cat ~/.config/manicode/freebuff-metadata.json
{
  "version": "0.0.180",
  "target": "linux-x64-baseline"
}

4. Run the payload:

$ ~/.config/manicode/freebuff --version
Illegal instruction (core dumped)      # exit code 132

Faulting instruction

$ gdb -batch -ex run -ex 'x/1i $pc' --args ~/.config/manicode/freebuff --version

Program received signal SIGILL, Illegal instruction.
0x00000000039fc488 in ?? ()
=> 0x39fc488:   popcnt %r8,%r9
rip            0x39fc488           0x39fc488

POPCNT is SSE4.2-era (Nehalem, 2008+) and is not part of the x86-64 baseline ISA, so it should not appear in a linux-x64-baseline artifact.

Environment

• freebuff 0.0.180, installed with npm install -g freebuff
• Payload: ~/.config/manicode/freebuff, 139,208,832 bytes
• OS: Linux Mint 22.3 (Ubuntu 24.04 base), kernel 6.17, x86_64
• CPU: Intel Core 2 Duo P8600 (Penryn, 2008) — no popcnt, no sse4_2
  (grep -m1 flags /proc/cpuinfo | tr ' ' '\n' | grep -cE '^(popcnt|sse4_2)$' → 0)

Two separate findings

1. The baseline artifact is not baseline-clean. Bun's --target=bun-linux-x64-baseline lowers the JS engine's own codegen, but a statically linked native dependency compiled with -mpopcnt / -march=x86-64-v2 can still put a POPCNT in the final binary. A one-line check on a built artifact, which should be 0 for a baseline target:

$ objdump -d <payload> | grep -c popcnt

2. Target selection only considers AVX2. In cli/release-core/launcher.js:

if (BASELINE_FALLBACK_TARGETS[platformKey] && !machineHasAvx2()) {
  return BASELINE_FALLBACK_TARGETS[platformKey]
}

Selection keys solely on machineHasAvx2(), which implies baseline is aimed at "has SSE4.2, lacks AVX2" machines. Even with finding 1 fixed, a pre-SSE4.2 CPU would benefit from the capability check covering popcnt/sse4_2 as well, so the ISA floor the baseline target actually promises is explicit.

Additional context

The same machine runs other native CLIs fine when they are genuinely built for baseline x86-64 (e.g. a static-musl Rust binary of comparable size), so the hardware is otherwise usable — this payload's ISA level is the only blocker.