OxiBLAS 0.2.2 Released — 57 Doctests That Never Ran, Two Constructors That Should Have Been Unsafe, and a Fuzzer for Both Untrusted Parsers

A doctest marked ignore isn’t a test. It’s a comment that compiles.

Today we released OxiBLAS 0.2.2 — a production-readiness hardening release. A systematic multi-agent audit swept the entire workspace (oxiblas-core, oxiblas-matrix, oxiblas-blas, oxiblas-lapack, oxiblas-ndarray, oxiblas-sparse), followed by adversarial re-verification of every proposed fix, then a follow-on pass over the audit closure itself for soundness gaps the first pass missed. No public API breaking changes, outside two constructor pairs that are now correctly unsafe fn.

No C. No Fortran. No external shared libraries. No FFI overhead, no build hell. Just clean, memory-safe, blazing-fast linear algebra that compiles to a single static binary and runs everywhere — the mathematical foundation of the COOLJAPAN scientific computing ecosystem.

Why OxiBLAS 0.2.2 is a game changer

The audit found the kind of gaps that don’t show up until someone goes looking for them:

• PackedRef::new/PackedMut::new and BandedRef::new/BandedMut::new were still safe pub fn over raw pointers with no validation — even though the sibling MatRef::new/MatMut::new had already been hardened to unsafe fn. Safe code could construct an out-of-bounds view and read/write past the backing allocation.
• 57 of 64 public-API doctests were marked ```ignore — never compiled, never verified — across five crates. A prior audit pass had only caught 7 of the 64.
• The Matrix Market parser pre-allocated straight from an untrusted size line. A ~30-byte crafted file (3 3 18446744073709551615) could trigger a capacity-overflow abort before a single data line was read.
• MmapMatMut::create’s size computation could wrap on an oversized (nrows, ncols), mapping a small file while the struct still recorded the original huge dimensions — letting ordinary safe accessors write past the mapping.
• Four new CBLAS modules reproduced a bug class cblas/basic.rs had already been hardened against — zero lda/ldb/ldc/null-pointer validation on 74 extern "C" entry points.

OxiBLAS 0.2.2 closes all of it:

• PackedRef::new/PackedMut::new/BandedRef::new/BandedMut::new are now unsafe fn with # Safety docs; every in-workspace call site was updated with // SAFETY: justifications.
• 57 doctests became real, executed tests with concrete inputs and assertions on the results.
• mtx.rs’s read_header now rejects nnz > nrows*ncols (checked with saturating_mul) and uses checked multiplication for array-format cell counts — malformed headers return MtxError instead of aborting the process.
• MmapMatMut::create uses checked arithmetic and re-validates the layout against the actual mapped file size.
• A shared cblas/validate.rs module wires gemv_params_valid/gemm_params_valid-family checks plus null checks into all 74 entry points across the four new CBLAS modules, no-oping on invalid input (matching the xerbla-then-return convention) instead of indexing out of bounds.

Technical Deep Dive: how the audit was structured

1. 16 domain auditors + a coverage critic + 4 gap auditors, each assigned a slice of the workspace, surfaced correctness, honesty, and documentation findings independently.
2. Adversarial re-verification — every proposed fix was checked against the actual bug it claimed to close, not just accepted on the auditor’s word, catching cases where a fix addressed the symptom in one call site but left sibling call sites (the four new CBLAS modules, the wasm32 SIMD lane-index bug) with the identical latent defect.
3. A follow-on hardening pass over the audit’s own closure — including two pre-existing test bugs the verification pass itself surfaced (test_aarch64_neon_always_present/test_aarch64_neon_always_true asserting NEON unconditionally present without accounting for force-scalar’s limited_to() masking) and an incomplete no_std gate on x86_64 SIMD test code that was invisible to aarch64-host --no-default-features checks until --target x86_64-apple-darwin was added to the verification command.
4. Workspace hygiene: deny.toml (COOLJAPAN dependency-ban list), rustfmt.toml/clippy.toml, SECURITY.md/CONTRIBUTING.md, four files split back under the workspace’s 2000-line limit, and a new independent fuzz/ workspace with libFuzzer targets for both of the crate’s untrusted-input parsers (mtx_matrix_market, mmap_header).

Getting Started

[dependencies]
oxiblas = "0.2"

# With parallelization
oxiblas = { version = "0.2", features = ["parallel"] }

use oxiblas_blas::level3::gemm;
use oxiblas_matrix::Mat;

let a = Mat::from_rows(&[
    &[1.0, 2.0, 3.0],
    &[4.0, 5.0, 6.0],
]);
let b = Mat::from_rows(&[
    &[7.0, 8.0],
    &[9.0, 10.0],
    &[11.0, 12.0],
]);
let mut c = Mat::zeros(2, 2);

// GEMM: C = A * B
gemm(1.0, a.as_ref(), b.as_ref(), 0.0, c.as_mut());
// Result: [[58, 64], [139, 154]]

What’s New in 0.2.2

• Fixed: numerical correctness bugs across BLAS/LAPACK/sparse (Hermitian/symmetric diagonal handling, SVD/eigensolver convergence and deflation, sparse factorization fill-in, incremental SVD, IRAM restart); several fabricated/stub code paths replaced with real algorithms (a dead-code MRRR eigensolver path, an untested symmetric divide-and-conquer EVD merge, fake complex-routine aliases); panics on edge-case inputs converted to Result-based errors.
• Changed: PackedRef::new/PackedMut::new/BandedRef::new/BandedMut::new are now unsafe fn (the one breaking change); the last four per-crate dependency version pins hoisted into [workspace.dependencies]; oxiblas-blas’s crate-wide clippy lint suppressions removed in favor of real # Safety docs and explicit transmute::<From, To>() turbofish annotations; four oversized files split into cohesive modules.
• Added: [package.metadata.docs.rs] with all-features = true on every publishable crate; rustfmt.toml, clippy.toml, deny.toml, SECURITY.md, CONTRIBUTING.md; an independent fuzz/ workspace with two libFuzzer targets.

Tips

• If you construct PackedRef/PackedMut/BandedRef/BandedMut directly from raw pointers, wrap the call in unsafe { ... } with a // SAFETY: comment — this is the release’s one breaking change, and it closes a real out-of-bounds-view hazard.
• Feed the Matrix Market or .oxiblas mmap parsers untrusted input? Upgrade for the overflow fixes alone — both mtx.rs’s header parsing and MmapMatMut::create’s size computation now reject malformed/oversized input with a typed error instead of aborting or reading out of bounds.
• Trust the doctests again. 57 of the 64 previously-ignored examples across oxiblas-core/matrix/lapack/ndarray/sparse now actually compile and assert on real output — if you were copy-pasting from the docs, they’re verified now.
• Want to fuzz the parsers yourself? cd fuzz && cargo +nightly fuzz run mtx_matrix_market or mmap_header — the new independent fuzz workspace stays out of the main cargo build/clippy --workspace path so it never forces a nightly toolchain on a normal build.
• --no-default-features checks on an aarch64 host won’t catch x86_64-only gaps — if you maintain a similar #[cfg(target_arch = "x86_64")]-gated module tree, add an explicit --target x86_64-apple-darwin (or your x86_64 target) to your no_std verification command; a same-architecture check alone can’t see it.

This is the foundation

Correct, panic-free linear algebra with fuzzed untrusted-input parsers matters most for whatever sits underneath a scientific computing stack. SciRS2, NumRS2, ToRSh, TrustFormers, OxiCAD, OxiEDA, OxiMed, OxiEML, OxiAero, and TenFlowers all pin oxiblas-* crates for BLAS/LAPACK/sparse linear algebra.

Repository: https://github.com/cool-japan/oxiblas

Star the repo if a doctest that actually compiles is the bar every doctest should have cleared from day one.

The era of ignored examples masquerading as documentation is over. Pure Rust linear algebra that’s fast, safe, and sovereign — is here.

— KitaSan at COOLJAPAN OÜ August 6, 2026