90 files changed, 199 insertions, 4 deletions
diff --git a/classification_output/01/README.md b/classification_output/01/README.md
deleted file mode 100644
index b71a384d..00000000
--- a/classification_output/01/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-- instruction: 13
-- mistranslation: 14
-- semantic: 8
-- other: 48
diff --git a/classification_output/01/instruction/7733130 b/classification_output/01/instruction/11357571
index 1c3bc483..1c3bc483 100644
--- a/classification_output/01/instruction/7733130
+++ b/classification_output/01/instruction/11357571
diff --git a/classification_output/01/instruction/7658242 b/classification_output/01/instruction/11933524
index 3ff255be..3ff255be 100644
--- a/classification_output/01/instruction/7658242
+++ b/classification_output/01/instruction/11933524
diff --git a/classification_output/01/instruction/5843372 b/classification_output/01/instruction/24190340
index 784962c9..784962c9 100644
--- a/classification_output/01/instruction/5843372
+++ b/classification_output/01/instruction/24190340
diff --git a/classification_output/01/instruction/7960594 b/classification_output/01/instruction/26095107
index c06d35dd..c06d35dd 100644
--- a/classification_output/01/instruction/7960594
+++ b/classification_output/01/instruction/26095107
diff --git a/classification_output/01/instruction/2609717 b/classification_output/01/instruction/33802194
index b8e563ad..b8e563ad 100644
--- a/classification_output/01/instruction/2609717
+++ b/classification_output/01/instruction/33802194
diff --git a/classification_output/01/instruction/2880487 b/classification_output/01/instruction/42226390
index 1d455d6f..1d455d6f 100644
--- a/classification_output/01/instruction/2880487
+++ b/classification_output/01/instruction/42226390
diff --git a/classification_output/01/instruction/7647456 b/classification_output/01/instruction/50773216
index d887fe7b..d887fe7b 100644
--- a/classification_output/01/instruction/7647456
+++ b/classification_output/01/instruction/50773216
diff --git a/classification_output/01/instruction/9818783 b/classification_output/01/instruction/51610399
index a7858528..a7858528 100644
--- a/classification_output/01/instruction/9818783
+++ b/classification_output/01/instruction/51610399
diff --git a/classification_output/01/instruction/0966902 b/classification_output/01/instruction/55961334
index 80cdabd2..80cdabd2 100644
--- a/classification_output/01/instruction/0966902
+++ b/classification_output/01/instruction/55961334
diff --git a/classification_output/01/instruction/6117378 b/classification_output/01/instruction/62179944
index 5dad058d..5dad058d 100644
--- a/classification_output/01/instruction/6117378
+++ b/classification_output/01/instruction/62179944
diff --git a/classification_output/01/instruction/8566429 b/classification_output/01/instruction/63565653
index dfac92bf..dfac92bf 100644
--- a/classification_output/01/instruction/8566429
+++ b/classification_output/01/instruction/63565653
diff --git a/classification_output/01/instruction/3457423 b/classification_output/01/instruction/70868267
index ffcf905b..ffcf905b 100644
--- a/classification_output/01/instruction/3457423
+++ b/classification_output/01/instruction/70868267
diff --git a/classification_output/01/instruction/8019995 b/classification_output/01/instruction/73660729
index 92d85cc8..92d85cc8 100644
--- a/classification_output/01/instruction/8019995
+++ b/classification_output/01/instruction/73660729
diff --git a/classification_output/01/mistranslation/6178292 b/classification_output/01/mistranslation/14887122
index f13db3b8..f13db3b8 100644
--- a/classification_output/01/mistranslation/6178292
+++ b/classification_output/01/mistranslation/14887122
diff --git a/classification_output/01/mistranslation/5798945 b/classification_output/01/mistranslation/22219210
index 95c3f61d..95c3f61d 100644
--- a/classification_output/01/mistranslation/5798945
+++ b/classification_output/01/mistranslation/22219210
diff --git a/classification_output/01/mistranslation/5373318 b/classification_output/01/mistranslation/23270873
index e4d4789c..e4d4789c 100644
--- a/classification_output/01/mistranslation/5373318
+++ b/classification_output/01/mistranslation/23270873
diff --git a/classification_output/01/mistranslation/3886413 b/classification_output/01/mistranslation/24930826
index 5f79c452..5f79c452 100644
--- a/classification_output/01/mistranslation/3886413
+++ b/classification_output/01/mistranslation/24930826
diff --git a/classification_output/01/mistranslation/8874178 b/classification_output/01/mistranslation/25842545
index 1ebfe288..1ebfe288 100644
--- a/classification_output/01/mistranslation/8874178
+++ b/classification_output/01/mistranslation/25842545
diff --git a/classification_output/01/mistranslation/7711787 b/classification_output/01/mistranslation/26430026
index ead1f32f..ead1f32f 100644
--- a/classification_output/01/mistranslation/7711787
+++ b/classification_output/01/mistranslation/26430026
diff --git a/classification_output/01/mistranslation/5933279 b/classification_output/01/mistranslation/36568044
index 719c03c7..719c03c7 100644
--- a/classification_output/01/mistranslation/5933279
+++ b/classification_output/01/mistranslation/36568044
diff --git a/classification_output/01/mistranslation/6866700 b/classification_output/01/mistranslation/64322995
index 2f16ce87..2f16ce87 100644
--- a/classification_output/01/mistranslation/6866700
+++ b/classification_output/01/mistranslation/64322995
diff --git a/classification_output/01/mistranslation/1693040 b/classification_output/01/mistranslation/70294255
index 67353acd..67353acd 100644
--- a/classification_output/01/mistranslation/1693040
+++ b/classification_output/01/mistranslation/70294255
diff --git a/classification_output/01/mistranslation/0247400 b/classification_output/01/mistranslation/71456293
index 746a624c..746a624c 100644
--- a/classification_output/01/mistranslation/0247400
+++ b/classification_output/01/mistranslation/71456293
diff --git a/classification_output/01/mistranslation/1267916 b/classification_output/01/mistranslation/74466963
index fffafcf7..fffafcf7 100644
--- a/classification_output/01/mistranslation/1267916
+++ b/classification_output/01/mistranslation/74466963
diff --git a/classification_output/01/mistranslation/8720260 b/classification_output/01/mistranslation/74545755
index 32d247ac..32d247ac 100644
--- a/classification_output/01/mistranslation/8720260
+++ b/classification_output/01/mistranslation/74545755
diff --git a/classification_output/01/mistranslation/4158985 b/classification_output/01/mistranslation/80604314
index 798c2e86..798c2e86 100644
--- a/classification_output/01/mistranslation/4158985
+++ b/classification_output/01/mistranslation/80604314
diff --git a/classification_output/01/mistranslation/4412535 b/classification_output/01/mistranslation/80615920
index 97712c2f..97712c2f 100644
--- a/classification_output/01/mistranslation/4412535
+++ b/classification_output/01/mistranslation/80615920
diff --git a/classification_output/01/other/3749377 b/classification_output/01/other/02364653
index 0142a965..0142a965 100644
--- a/classification_output/01/other/3749377
+++ b/classification_output/01/other/02364653
diff --git a/classification_output/01/other/5321072 b/classification_output/01/other/02572177
index 55a82678..55a82678 100644
--- a/classification_output/01/other/5321072
+++ b/classification_output/01/other/02572177
diff --git a/classification_output/01/other/5443005 b/classification_output/01/other/04472277
index 95b28c96..95b28c96 100644
--- a/classification_output/01/other/5443005
+++ b/classification_output/01/other/04472277
diff --git a/classification_output/01/other/4970412 b/classification_output/01/other/12869209
index 7fa99572..7fa99572 100644
--- a/classification_output/01/other/4970412
+++ b/classification_output/01/other/12869209
diff --git a/classification_output/01/other/4800759 b/classification_output/01/other/13442371
index 95a58c71..95a58c71 100644
--- a/classification_output/01/other/4800759
+++ b/classification_output/01/other/13442371
diff --git a/classification_output/01/other/4314117 b/classification_output/01/other/14488057
index e48b5162..e48b5162 100644
--- a/classification_output/01/other/4314117
+++ b/classification_output/01/other/14488057
diff --git a/classification_output/01/other/5362491 b/classification_output/01/other/16056596
index db7724db..db7724db 100644
--- a/classification_output/01/other/5362491
+++ b/classification_output/01/other/16056596
diff --git a/classification_output/01/other/0001467 b/classification_output/01/other/16201167
index ebd92216..ebd92216 100644
--- a/classification_output/01/other/0001467
+++ b/classification_output/01/other/16201167
diff --git a/classification_output/01/other/4938208 b/classification_output/01/other/16228234
index 33edbe3c..33edbe3c 100644
--- a/classification_output/01/other/4938208
+++ b/classification_output/01/other/16228234
diff --git a/classification_output/01/other/5057521 b/classification_output/01/other/17743720
index b2baccb3..b2baccb3 100644
--- a/classification_output/01/other/5057521
+++ b/classification_output/01/other/17743720
diff --git a/classification_output/01/other/4774720 b/classification_output/01/other/21221931
index 97f1a001..97f1a001 100644
--- a/classification_output/01/other/4774720
+++ b/classification_output/01/other/21221931
diff --git a/classification_output/01/other/9948366 b/classification_output/01/other/21247035
index fcd04e57..fcd04e57 100644
--- a/classification_output/01/other/9948366
+++ b/classification_output/01/other/21247035
diff --git a/classification_output/01/other/7427991 b/classification_output/01/other/23300761
index 7c8b06cc..7c8b06cc 100644
--- a/classification_output/01/other/7427991
+++ b/classification_output/01/other/23300761
diff --git a/classification_output/01/other/6739993 b/classification_output/01/other/23448582
index 795a7c15..795a7c15 100644
--- a/classification_output/01/other/6739993
+++ b/classification_output/01/other/23448582
diff --git a/classification_output/01/other/6998781 b/classification_output/01/other/25892827
index 98a199ee..98a199ee 100644
--- a/classification_output/01/other/6998781
+++ b/classification_output/01/other/25892827
diff --git a/classification_output/01/other/1067127 b/classification_output/01/other/31349848
index 5ebbf984..5ebbf984 100644
--- a/classification_output/01/other/1067127
+++ b/classification_output/01/other/31349848
diff --git a/classification_output/01/other/5396868 b/classification_output/01/other/32484936
index f04ba791..f04ba791 100644
--- a/classification_output/01/other/5396868
+++ b/classification_output/01/other/32484936
diff --git a/classification_output/01/other/3825088 b/classification_output/01/other/35170175
index e9f59b8c..e9f59b8c 100644
--- a/classification_output/01/other/3825088
+++ b/classification_output/01/other/35170175
diff --git a/classification_output/01/other/2562302 b/classification_output/01/other/42613410
index 9058ba90..9058ba90 100644
--- a/classification_output/01/other/2562302
+++ b/classification_output/01/other/42613410
diff --git a/classification_output/01/other/6983580 b/classification_output/01/other/42974450
index b0e56b61..b0e56b61 100644
--- a/classification_output/01/other/6983580
+++ b/classification_output/01/other/42974450
diff --git a/classification_output/01/other/5215275 b/classification_output/01/other/43643137
index d563c812..d563c812 100644
--- a/classification_output/01/other/5215275
+++ b/classification_output/01/other/43643137
diff --git a/classification_output/01/other/6355518 b/classification_output/01/other/48245039
index 650c1008..650c1008 100644
--- a/classification_output/01/other/6355518
+++ b/classification_output/01/other/48245039
diff --git a/classification_output/01/other/7639274 b/classification_output/01/other/55247116
index cbe17cc2..cbe17cc2 100644
--- a/classification_output/01/other/7639274
+++ b/classification_output/01/other/55247116
diff --git a/classification_output/01/other/2537817 b/classification_output/01/other/55367348
index 099e5686..099e5686 100644
--- a/classification_output/01/other/2537817
+++ b/classification_output/01/other/55367348
diff --git a/classification_output/01/other/6531392 b/classification_output/01/other/55753058
index 73752120..73752120 100644
--- a/classification_output/01/other/6531392
+++ b/classification_output/01/other/55753058
diff --git a/classification_output/01/other/8691137 b/classification_output/01/other/56309929
index 7847ba8b..7847ba8b 100644
--- a/classification_output/01/other/8691137
+++ b/classification_output/01/other/56309929
diff --git a/classification_output/01/other/2393649 b/classification_output/01/other/56937788
index 87a9c6fb..87a9c6fb 100644
--- a/classification_output/01/other/2393649
+++ b/classification_output/01/other/56937788
diff --git a/classification_output/01/other/5912779 b/classification_output/01/other/57195159
index df589df3..df589df3 100644
--- a/classification_output/01/other/5912779
+++ b/classification_output/01/other/57195159
diff --git a/classification_output/01/other/1195866 b/classification_output/01/other/57231878
index e91a98df..e91a98df 100644
--- a/classification_output/01/other/1195866
+++ b/classification_output/01/other/57231878
diff --git a/classification_output/01/other/6156219 b/classification_output/01/other/57756589
index a0977e39..a0977e39 100644
--- a/classification_output/01/other/6156219
+++ b/classification_output/01/other/57756589
diff --git a/classification_output/01/other/8621822 b/classification_output/01/other/59540920
index a27abd64..a27abd64 100644
--- a/classification_output/01/other/8621822
+++ b/classification_output/01/other/59540920
diff --git a/classification_output/01/other/6416205 b/classification_output/01/other/60339453
index c32e4043..c32e4043 100644
--- a/classification_output/01/other/6416205
+++ b/classification_output/01/other/60339453
diff --git a/classification_output/01/other/1398669 b/classification_output/01/other/64571620
index 17e9f6ea..17e9f6ea 100644
--- a/classification_output/01/other/1398669
+++ b/classification_output/01/other/64571620
diff --git a/classification_output/01/other/3501174 b/classification_output/01/other/65781993
index 6543b7f2..6543b7f2 100644
--- a/classification_output/01/other/3501174
+++ b/classification_output/01/other/65781993
diff --git a/classification_output/01/other/8627146 b/classification_output/01/other/66743673
index dc13c18a..dc13c18a 100644
--- a/classification_output/01/other/8627146
+++ b/classification_output/01/other/66743673
diff --git a/classification_output/01/other/3223447 b/classification_output/01/other/67821138
index 8d257ea4..8d257ea4 100644
--- a/classification_output/01/other/3223447
+++ b/classification_output/01/other/67821138
diff --git a/classification_output/01/other/6257722 b/classification_output/01/other/68897003
index afdfbfd3..afdfbfd3 100644
--- a/classification_output/01/other/6257722
+++ b/classification_output/01/other/68897003
diff --git a/classification_output/01/other/0804350 b/classification_output/01/other/70021271
index c030ad8d..c030ad8d 100644
--- a/classification_output/01/other/0804350
+++ b/classification_output/01/other/70021271
diff --git a/classification_output/01/other/9840852 b/classification_output/01/other/70416488
index d5827c3d..d5827c3d 100644
--- a/classification_output/01/other/9840852
+++ b/classification_output/01/other/70416488
diff --git a/classification_output/01/other/7143139 b/classification_output/01/other/74715356
index 18fcc3e0..18fcc3e0 100644
--- a/classification_output/01/other/7143139
+++ b/classification_output/01/other/74715356
diff --git a/classification_output/01/other/8109943 b/classification_output/01/other/79834768
index 7f2b12fb..7f2b12fb 100644
--- a/classification_output/01/other/8109943
+++ b/classification_output/01/other/79834768
diff --git a/classification_output/01/other/2308923 b/classification_output/01/other/81775929
index 9c03c9d1..9c03c9d1 100644
--- a/classification_output/01/other/2308923
+++ b/classification_output/01/other/81775929
diff --git a/classification_output/01/other/8653736 b/classification_output/01/other/85542195
index f3d47976..f3d47976 100644
--- a/classification_output/01/other/8653736
+++ b/classification_output/01/other/85542195
diff --git a/classification_output/01/other/1412913 b/classification_output/01/other/88225572
index b3cb5b26..b3cb5b26 100644
--- a/classification_output/01/other/1412913
+++ b/classification_output/01/other/88225572
diff --git a/classification_output/01/other/9777608 b/classification_output/01/other/88281850
index c82ece20..c82ece20 100644
--- a/classification_output/01/other/9777608
+++ b/classification_output/01/other/88281850
diff --git a/classification_output/01/other/2409210 b/classification_output/01/other/92957605
index 7371cd57..7371cd57 100644
--- a/classification_output/01/other/2409210
+++ b/classification_output/01/other/92957605
diff --git a/classification_output/01/other/5745618 b/classification_output/01/other/95154278
index afd2ea5d..afd2ea5d 100644
--- a/classification_output/01/other/5745618
+++ b/classification_output/01/other/95154278
diff --git a/classification_output/01/other/9937102 b/classification_output/01/other/99674399
index 181ac23c..181ac23c 100644
--- a/classification_output/01/other/9937102
+++ b/classification_output/01/other/99674399
diff --git a/classification_output/01/semantic/3847403 b/classification_output/01/semantic/05479587
index be4dcd77..be4dcd77 100644
--- a/classification_output/01/semantic/3847403
+++ b/classification_output/01/semantic/05479587
diff --git a/classification_output/01/semantic/8511484 b/classification_output/01/semantic/12360755
index 1340f1aa..1340f1aa 100644
--- a/classification_output/01/semantic/8511484
+++ b/classification_output/01/semantic/12360755
diff --git a/classification_output/01/semantic/7837801 b/classification_output/01/semantic/28596630
index 8816300a..8816300a 100644
--- a/classification_output/01/semantic/7837801
+++ b/classification_output/01/semantic/28596630
diff --git a/classification_output/01/semantic/0504199 b/classification_output/01/semantic/30680944
index 1d5b4d11..1d5b4d11 100644
--- a/classification_output/01/semantic/0504199
+++ b/classification_output/01/semantic/30680944
diff --git a/classification_output/01/semantic/3242247 b/classification_output/01/semantic/46572227
index d8352e56..d8352e56 100644
--- a/classification_output/01/semantic/3242247
+++ b/classification_output/01/semantic/46572227
diff --git a/classification_output/01/semantic/1452608 b/classification_output/01/semantic/53568181
index 6750978a..6750978a 100644
--- a/classification_output/01/semantic/1452608
+++ b/classification_output/01/semantic/53568181
diff --git a/classification_output/01/semantic/0891566 b/classification_output/01/semantic/80570214
index f2e9cca0..f2e9cca0 100644
--- a/classification_output/01/semantic/0891566
+++ b/classification_output/01/semantic/80570214
diff --git a/classification_output/01/semantic/2047990 b/classification_output/01/semantic/96782458
index d0391c1e..d0391c1e 100644
--- a/classification_output/01/semantic/2047990
+++ b/classification_output/01/semantic/96782458
diff --git a/classification_output/01/semantic/gitlab_semantic_addsubps b/classification_output/01/semantic/gitlab_semantic_addsubps
new file mode 100644
index 00000000..cbd5eeb7
--- /dev/null
+++ b/classification_output/01/semantic/gitlab_semantic_addsubps
@@ -0,0 +1,28 @@
+semantic: 0.974
+instruction: 0.931
+other: 0.732
+mistranslation: 0.299
+
+x86 SSE/SSE2/SSE3 instruction semantic bugs with NaN
+
+Description of problem
+The result of SSE/SSE2/SSE3 instructions with NaN is different from the CPU. From Intel manual Volume 1 Appendix D.4.2.2, they defined the behavior of such instructions with NaN. But I think QEMU did not implement this semantic exactly because the byte result is different.
+
+Steps to reproduce
+
+Compile this code
+
+void main() {
+    asm("mov rax, 0x000000007fffffff; push rax; mov rax, 0x00000000ffffffff; push rax; movdqu XMM1, [rsp];");
+    asm("mov rax, 0x2e711de7aa46af1a; push rax; mov rax, 0x7fffffff7fffffff; push rax; movdqu XMM2, [rsp];");
+    asm("addsubps xmm1, xmm2");
+}
+
+Execute and compare the result with the CPU. This problem happens with other SSE/SSE2/SSE3 instructions specified in the manual, Volume 1 Appendix D.4.2.2.
+
+CPU xmm1[3] = 0xffffffff
+
+QEMU xmm1[3] = 0x7fffffff
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/classification_output/01/semantic/gitlab_semantic_adox b/classification_output/01/semantic/gitlab_semantic_adox
new file mode 100644
index 00000000..c30dc410
--- /dev/null
+++ b/classification_output/01/semantic/gitlab_semantic_adox
@@ -0,0 +1,41 @@
+semantic: 0.990
+instruction: 0.944
+mistranslation: 0.452
+other: 0.286
+
+x86 ADOX and ADCX semantic bug
+Description of problem
+The result of instruction ADOX and ADCX are different from the CPU. The value of one of EFLAGS is different.
+
+Steps to reproduce
+
+Compile this code
+
+
+void main() {
+    asm("push 512; popfq;");
+    asm("mov rax, 0xffffffff84fdbf24");
+    asm("mov rbx, 0xb197d26043bec15d");
+    asm("adox eax, ebx");
+}
+
+
+
+Execute and compare the result with the CPU. This problem happens with ADCX, too (with CF).
+
+CPU
+
+OF = 0
+
+
+QEMU
+
+OF = 1
+
+
+
+
+
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/classification_output/01/semantic/gitlab_semantic_bextr b/classification_output/01/semantic/gitlab_semantic_bextr
new file mode 100644
index 00000000..436e0ec9
--- /dev/null
+++ b/classification_output/01/semantic/gitlab_semantic_bextr
@@ -0,0 +1,30 @@
+semantic: 0.993
+instruction: 0.944
+mistranslation: 0.337
+other: 0.099
+
+x86 BEXTR semantic bug
+Description of problem
+The result of instruction BEXTR is different with from the CPU. The value of destination register is different. I think QEMU does not consider the operand size limit.
+
+Steps to reproduce
+
+Compile this code
+
+void main() {
+    asm("mov rax, 0x17b3693f77fb6e9");
+    asm("mov rbx, 0x8f635a775ad3b9b4");
+    asm("mov rcx, 0xb717b75da9983018");
+    asm("bextr eax, ebx, ecx");
+}
+
+Execute and compare the result with the CPU.
+
+CPU
+RAX = 0x5a
+
+QEMU
+RAX = 0x635a775a
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/classification_output/01/semantic/gitlab_semantic_blsi b/classification_output/01/semantic/gitlab_semantic_blsi
new file mode 100644
index 00000000..84c589fb
--- /dev/null
+++ b/classification_output/01/semantic/gitlab_semantic_blsi
@@ -0,0 +1,25 @@
+semantic: 0.983
+instruction: 0.964
+other: 0.609
+mistranslation: 0.606
+
+x86 BLSI and BLSR semantic bug
+Description of problem
+The result of instruction BLSI and BLSR is different from the CPU. The value of CF is different.
+
+Steps to reproduce
+
+Compile this code
+
+
+void main() {
+    asm("blsi rax, rbx");
+}
+
+
+
+Execute and compare the result with the CPU. The value of CF is exactly the opposite. This problem happens with BLSR, too.
+
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/classification_output/01/semantic/gitlab_semantic_blsmsk b/classification_output/01/semantic/gitlab_semantic_blsmsk
new file mode 100644
index 00000000..7f962189
--- /dev/null
+++ b/classification_output/01/semantic/gitlab_semantic_blsmsk
@@ -0,0 +1,32 @@
+semantic: 0.987
+instruction: 0.962
+mistranslation: 0.603
+other: 0.269
+
+x86 BLSMSK semantic bug
+Description of problem
+The result of instruction BLSMSK is different with from the CPU. The value of CF is different.
+
+Steps to reproduce
+
+Compile this code
+
+void main() {
+    asm("mov rax, 0x65b2e276ad27c67");
+    asm("mov rbx, 0x62f34955226b2b5d");
+    asm("blsmsk eax, ebx");
+}
+
+Execute and compare the result with the CPU.
+
+CPU
+
+CF = 0
+
+
+QEMU
+
+CF = 1
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.
diff --git a/classification_output/01/semantic/gitlab_semantic_bzhi b/classification_output/01/semantic/gitlab_semantic_bzhi
new file mode 100644
index 00000000..09ab02dc
--- /dev/null
+++ b/classification_output/01/semantic/gitlab_semantic_bzhi
@@ -0,0 +1,43 @@
+semantic: 0.920
+instruction: 0.623
+mistranslation: 0.171
+other: 0.064
+
+x86 BZHI semantic bug
+Description of problem
+The result of instruction BZHI is different from the CPU. The value of destination register and SF of EFLAGS are different.
+
+Steps to reproduce
+
+Compile this code
+
+
+void main() {
+    asm("mov rax, 0xb1aa9da2fe33fe3");
+    asm("mov rbx, 0x80000000ffffffff");
+    asm("mov rcx, 0xf3fce8829b99a5c6");
+    asm("bzhi rax, rbx, rcx");
+}
+
+
+
+Execute and compare the result with the CPU.
+
+CPU
+
+RAX = 0x0x80000000ffffffff
+SF = 1
+
+
+QEMU
+
+RAX = 0xffffffff
+SF = 0
+
+
+
+
+
+
+Additional information
+This bug is discovered by research conducted by KAIST SoftSec.