{"record":{"id":"eeb792b897be541b","repo":"go-delve/delve","slug":"reading-nt-file-entry-v-v","errorCode":null,"errorMessage":"reading NT_FILE entry %v: %v","messagePattern":"reading NT_FILE entry (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proc/core/linux_core.go","lineNumber":358,"sourceCode":"\t\t}\n\tcase elf.NT_PRPSINFO:\n\t\tnote.Desc = &linuxPrPsInfo{}\n\t\tif err := binary.Read(descReader, binary.LittleEndian, note.Desc); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading NT_PRPSINFO: %v\", err)\n\t\t}\n\tcase _NT_FILE:\n\t\t// No good documentation reference, but the structure is\n\t\t// simply a header, including entry count, followed by that\n\t\t// many entries, and then the file name of each entry,\n\t\t// null-delimited. Not reading the names here.\n\t\tdata := &linuxNTFile{}\n\t\tif err := binary.Read(descReader, binary.LittleEndian, &data.linuxNTFileHdr); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"reading NT_FILE header: %v\", err)\n\t\t}\n\t\tfor i := 0; i < int(data.Count); i++ {\n\t\t\tentry := &linuxNTFileEntry{}\n\t\t\tif err := binary.Read(descReader, binary.LittleEndian, entry); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"reading NT_FILE entry %v: %v\", i, err)\n\t\t\t}\n\t\t\tdata.entries = append(data.entries, entry)\n\t\t}\n\t\tnote.Desc = data\n\tcase _NT_X86_XSTATE:\n\t\tif machineType == _EM_X86_64 {\n\t\t\tvar fpregs amd64util.AMD64Xstate\n\t\t\tif err := amd64util.AMD64XstateRead(desc, true, &fpregs, 0); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tnote.Desc = &fpregs\n\t\t}\n\tcase _NT_AUXV, elfwriter.DelveHeaderNoteType, elfwriter.DelveThreadNodeType:\n\t\tnote.Desc = desc\n\tcase _NT_FPREGSET:\n\t\tif machineType == _EM_AARCH64 {\n\t\t\terr = readFpregsetNote(note, &linutil.ARM64PtraceFpRegs{}, desc[:_ARM_FP_HEADER_START])\n\t\t} else if machineType == _EM_RISCV {","sourceCodeStart":340,"sourceCodeEnd":376,"githubUrl":"https://github.com/go-delve/delve/blob/a23773e6c31361e43246bc43a424ee009679b174/pkg/proc/core/linux_core.go#L340-L376","documentation":"readNote wraps binary.Read failures when decoding an individual NT_FILE mapped-file entry (start/end/file-ofs addresses) into linuxNTFileEntry. The NT_FILE header said there are data.Count entries, but entry i could not be read from the descriptor — the note is truncated mid-table or the count is wrong.","triggerScenarios":"The NT_FILE descriptor contains fewer entry bytes than the header's Count implies (truncated note or bogus Count field), so the loop's i-th binary.Read fails.","commonSituations":"Cores written by a dumper that set Count too high or truncated entries, corrupted downloads, cores trimmed by post-processing tools that shortened the note but not the header count.","solutions":["Re-dump the core with the standard kernel dumper or gcore and retry dlv core.","Validate with readelf -n <core>; a truncated NT_FILE note shows up there.","If using a custom trimmer, recompute the note size (header + Count*entrySize + filename bytes) consistently.","Sanity-check Count against Descsz before parsing: (Descsz - headerSize) / entrySize >= Count."],"exampleFix":"// before\nfor i := 0; i < int(data.Count); i++ {\n    binary.Read(descReader, binary.LittleEndian, entry) // panics/errors at i-th entry\n}\n// after\navail := (hdr.Descsz - uint64(hdrSize)) / entrySize\nif uint64(data.Count) > avail {\n    return fmt.Errorf(\"NT_FILE count %d exceeds available entries %d\", data.Count, avail)\n}","handlingStrategy":"validation","validationCode":"// Check NT_FILE entry count sanity before debugging (header says Count, Descsz must hold it):\n// bytesAvailable = Descsz - headerSize\n// required = Count * entrySize + filenameBytes\n// if bytesAvailable < required -> core is truncated/corrupt; re-dump.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Reject cores whose note sizes don't add up (validate with readelf -n).","Avoid third-party tools that rewrite NT_FILE notes in place.","Capture cores atomically (write to temp + rename) so partially written dumps never circulate.","Monitor CI artifact storage for interrupted uploads."],"tags":["core-dump","elf","binary-decoding","memory-maps"],"backgroundTag":"core-note-decode-failed","analyzedSha":"a23773e6c31361e43246bc43a424ee009679b174","analyzedAt":"2026-08-31T15:12:45.221Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}