CWE-1461 Hardware Simulation / Synthesis Mismatch

The hardware design contains structures that are interpreted differently during synthesis than during simulation, which cause inconsistencies in security-relevant behavior between the synthesized implementation and the simulation.

Hardware-description-language (HDL) code describes functionality which can be verified as correct using simulation tools. Synthesis tools then (automatically) convert this into a physically-realizable representation. Certain HDL code structures cannot be exactly represented, or have multiple valid representations from which the synthesis tool must choose. This can result in output which behaves differently to the (functionally-correct) HDL code. These "simulation/synthesis mismatches" may have security consequences.

• Other: Varies by Context — The consequences depend on the affected hardware behavior. The synthesized implementation may make different control decisions, incorrectly update protected state, expose data, or fail to enforce restrictions that appeared to operate correctly during HDL simulation.

• Establish and enforce HDL coding and review practices that minimize differences between simulation semantics and synthesis interpretation. Avoid HDL constructs, synthesis directives, and tool-dependent behaviors known to cause simulation/synthesis mismatch, with particular attention to security-relevant logic. • For security-critical logic, preserve intentional redundancy that is required for security. Examples may include redundant logic, triple modular redundancy (TMR) structures, Hamming-distance state encodings, or state-machine recovery logic. Use synthesis constraints, preservation attributes, carefully controlled structural implementation, or manual implementation of selected critical blocks to prevent this redundancy from being merged, re-encoded, or optimized away.

• Automated Static Analysis - Source Code: HDL linting, rule-based static analysis, and HDL checker tools can examine source code for structures that may be interpreted differently by simulation and synthesis tools. They may identify synthesis-sensitive coding patterns associated with this weakness. • Manual Analysis: Synthesis warning review can examine synthesis logs and reports for tool messages associated with possible simulation/synthesis mismatch. It may identify ignored constructs, unsupported HDL semantics, synthesis assumptions, or optimizations that could affect security-relevant behavior. • Formal Verification: HDL-source-to-netlist formal equivalence checking can examine the simulated model and synthesized netlist for behavioral mismatch associated with this weakness. It may identify non-equivalent outputs, failed compare-points, state-mapping issues, or counterexamples under the checked constraints. • Simulation / Emulation: Cross-simulation across HDL-source and post-synthesis models can examine both abstraction levels for observable behavioral divergence associated with this weakness. It may identify mismatches when security-relevant behaviors are explicitly exercised. • Fuzzing: Coverage-guided differential fuzzing can examine HDL source code and synthesized implementation models for behavioral divergence associated with this weakness. It may identify generated inputs or state conditions that expose synthesis-induced mismatches.

• CVE-2025-51678: The synthesized netlist incorrectly calculates memory addresses and fetches co-processor instructions, potentially causing unintended memory accesses or incorrect custom-instruction execution. • CVE-2025-51677: Debug-load requests should return complete load store unit (LSU) data, but the synthesized netlist returned incomplete data, potentially causing incorrect interpretation of memory state. • CVE-2025-51679: Instruction execution should update program-counter state correctly, but the synthesized netlist produced incomplete or undefined updates, potentially causing unintended control flow. • CVE-2025-51675: The program counter should update when the next-program-counter value changes, but the synthesized netlist allowed stale PC state, potentially causing incorrect instruction fetches or stalls.