Architectural Invariant Design: eBPF TC Ingress Packet Slicing and Verifier-Bounded Loop Invariants
eBPF TC Ingress Packet Slicing and Verifier-Bounded Loop Invariants defines an industrial-grade behavioral standard for devops engineering. Enforces verifier-bounded loops and strict linear packet bounds verification for Layer 7 protocol parsing within Traffic Control (TC) ingress eBPF programs. Guarantees that packet pointers are recalculated after calls to bpf_skb_pull_data and prevents BPF verifier path explosion and tail-call stack overflows during high-throughput packet routing. Ensures production safety by maintaining the 512-byte BPF stack limit and restricting tail calls within kernel recursion limits. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.
Hazard Analysis: What Breaks Without This Rule
The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:
| Failure Mode | AI Symptom (The Anti-Pattern) | Severity | Production Impact & Remedy |
|---|---|---|---|
| AI Hallucination & Deprecation Drift | Unbounded L7 Header Parsing Loops with Stale SKB Data Pointers and Unchecked Tail Calls | Critical | Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository. |
| Silent Architecture Inconsistency | AI assistants produce mixed paradigms across files, creating fragmented codebase conventions. | Medium | Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails. |
Step-by-Step Production Directives
Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:
Engineers MUST ALWAYS reload ctx->data and ctx->data_end pointers immediately following any invocation of bpf_skb_pull_data or helper functions that may linearize or reallocate socket buffer memory.
Engineers MUST ALWAYS reload ctx->data and ctx->data_end pointers immediately following any invocation of bpf_skb_pull_data or helper functions that may linearize or reallocate socket buffer memory.
Engineers MUST ALWAYS bound all parsing loops with a compile-time static constant (#pragma unroll or explicitly bounded loop counter <= MAX_PARSER_ITERATIONS) to satisfy verifier state complexity and path pruning constraints.
Engineers MUST ALWAYS bound all parsing loops with a compile-time static constant (#pragma unroll or explicitly bounded loop counter <= MAX_PARSER_ITERATIONS) to satisfy verifier state complexity and path pruning constraints.
Engineers MUST verify (void *)(cursor + struct_size) > data_end before every dereference, using unsigned comparison operators to prevent signed integer overflow vulnerabilities.
Engineers MUST verify (void *)(cursor + struct_size) > data_end before every dereference, using unsigned comparison operators to prevent signed integer overflow vulnerabilities.
Code SHOULD avoid storing large intermediate L7 state structures on the BPF stack
Code SHOULD avoid storing large intermediate L7 state structures on the BPF stack; engineers MUST enforce the BPF stack budget limit (<= 512 bytes) by using per-CPU array scratch buffers for L7 parsing state.
Services MUST bound tail-call depth explicitly to prevent hitting the kernel-enforced MAX_TAIL_CALL_CNT (33 in modern kernels) which results in silent, unrecoverable packet drops.
Services MUST bound tail-call depth explicitly to prevent hitting the kernel-enforced MAX_TAIL_CALL_CNT (33 in modern kernels) which results in silent, unrecoverable packet drops.
Components NEVER assume contiguous SKB memory when parsing payload past the transport layer
Components NEVER assume contiguous SKB memory when parsing payload past the transport layer; non-linear packet slicing MUST use bpf_skb_pull_data or bpf_skb_load_bytes.
Frequently Asked Technical Questions
Common questions developers face when configuring AI coding assistants for this stack:
Q:Why is eBPF TC Ingress Packet Slicing and Verifier-Bounded Loop Invariants critical for AI coding assistants?
Enforces verifier-bounded loops and strict linear packet bounds verification for Layer 7 protocol parsing within Traffic Control (TC) ingress eBPF programs. Guarantees that packet pointers are recalculated after calls to bpf_skb_pull_data and prevents BPF verifier path explosion and tail-call stack overflows during high-throughput packet routing. Ensures production safety by maintaining the 512-byte BPF stack limit and restricting tail calls within kernel recursion limits. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.
Q:How does adopting this rule prevent AI hallucinations?
This rule explicitly declares what the AI must avoid (Unbounded L7 Header Parsing Loops with Stale SKB Data Pointers and Unchecked Tail Calls) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.
Q:Which AI coding environments are supported?
This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).
Q:Can I combine this rule with other technology stacks?
Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.